From tpatnoe@cisco.com Mon Nov 2 10:42:34 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 70DA93A67AB for ; Mon, 2 Nov 2009 10:42:34 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1bQQOa5qZ-pt for ; Mon, 2 Nov 2009 10:42:33 -0800 (PST) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id 915693A63EB for ; Mon, 2 Nov 2009 10:42:33 -0800 (PST) Authentication-Results: sj-iport-2.cisco.com; dkim=neutral (message not signed) header.i=none X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEAA237kqrR7H+/2dsb2JhbADGZ5Z0hDwE X-IronPort-AV: E=Sophos;i="4.44,668,1249257600"; d="scan'208";a="220382026" Received: from sj-core-2.cisco.com ([171.71.177.254]) by sj-iport-2.cisco.com with ESMTP; 02 Nov 2009 18:42:53 +0000 Received: from [64.101.72.206] (dhcp-64-101-72-206.cisco.com [64.101.72.206]) by sj-core-2.cisco.com (8.13.8/8.14.3) with ESMTP id nA2IgrRP015592 for ; Mon, 2 Nov 2009 18:42:53 GMT Message-ID: <4AEF282D.1080803@cisco.com> Date: Mon, 02 Nov 2009 11:42:53 -0700 From: Tory Patnoe User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.4pre) Gecko/20090915 Lightning/1.0pre Thunderbird/3.0b4 MIME-Version: 1.0 To: xmpp@ietf.org References: <4AE1F9B9.4090209@stpeter.im> <7fc4fa880910271132p4616cc93g899c330253e50149@mail.gmail.com> <4AE750F4.8070507@stpeter.im> In-Reply-To: <4AE750F4.8070507@stpeter.im> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [xmpp] updated bis drafts X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Nov 2009 18:42:34 -0000 On 10/27/2009 01:58 PM, Peter Saint-Andre wrote: > As to whether the server needs to deliver inbound presence subscription > stanzas (subscribed, unsubscribe, unsubscribed), my reasoning is that if > the server does not deliver them to the client then the client has no > way to tell whether the roster push was generated by another resource or > triggered by the contact. > Would it not be better to put that information in the roster-push itself? Perhaps with a copy of the triggering stanza as a sub-element to the roster push. That way client writers would not have to use two stanzas to trigger an event but look for a single stanza in the roster push while looking for extra details. If the "double" stanza is preferred then I believe the presence stanza MUST be delivered _before_ the roster push. Tory Patnoe From stpeter@stpeter.im Mon Nov 2 12:54:08 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 632323A6927 for ; Mon, 2 Nov 2009 12:54:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.581 X-Spam-Level: X-Spam-Status: No, score=-2.581 tagged_above=-999 required=5 tests=[AWL=0.018, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SJYp1-hnDcMY for ; Mon, 2 Nov 2009 12:54:07 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 622153A67E7 for ; Mon, 2 Nov 2009 12:54:07 -0800 (PST) Received: from dhcp-64-101-72-247.cisco.com (dhcp-64-101-72-247.cisco.com [64.101.72.247]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 2E26640D17; Mon, 2 Nov 2009 13:54:27 -0700 (MST) Message-ID: <4AEF4702.9080106@stpeter.im> Date: Mon, 02 Nov 2009 13:54:26 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Tory Patnoe References: <4AE1F9B9.4090209@stpeter.im> <7fc4fa880910271132p4616cc93g899c330253e50149@mail.gmail.com> <4AE750F4.8070507@stpeter.im> <4AEF282D.1080803@cisco.com> In-Reply-To: <4AEF282D.1080803@cisco.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: xmpp@ietf.org Subject: Re: [xmpp] updated bis drafts X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Nov 2009 20:54:08 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/2/09 11:42 AM, Tory Patnoe wrote: > On 10/27/2009 01:58 PM, Peter Saint-Andre wrote: >> As to whether the server needs to deliver inbound presence subscription >> stanzas (subscribed, unsubscribe, unsubscribed), my reasoning is that if >> the server does not deliver them to the client then the client has no >> way to tell whether the roster push was generated by another resource or >> triggered by the contact. >> > > Would it not be better to put that information in the roster-push itself? > > Perhaps with a copy of the triggering stanza as a sub-element to the > roster push. That way client writers would not have to use two stanzas > to trigger an event but look for a single stanza in the roster push > while looking for extra details. > > If the "double" stanza is preferred then I believe the presence stanza > MUST be delivered _before_ the roster push. The double stanza is the way things have been specified since 1999. If we define a new roster protocol (a hot topic of discussion a few months ago), we'd add this feature to that protocol rather than force it into the old protocol. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkrvRwIACgkQNL8k5A2w/vx3UwCfXThIj86SA3Tps215fotEiYQ5 yH0AnjjRdnWfJVc+8LtS5EFvph6manWs =U6zt -----END PGP SIGNATURE----- From stpeter@stpeter.im Mon Nov 2 13:28:33 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F1E993A6A3C for ; Mon, 2 Nov 2009 13:28:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.582 X-Spam-Level: X-Spam-Status: No, score=-2.582 tagged_above=-999 required=5 tests=[AWL=0.017, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jUecTLUNMqg0 for ; Mon, 2 Nov 2009 13:28:33 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id EC8163A692D for ; Mon, 2 Nov 2009 13:28:32 -0800 (PST) Received: from dhcp-64-101-72-247.cisco.com (dhcp-64-101-72-247.cisco.com [64.101.72.247]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 4F26440D23; Mon, 2 Nov 2009 14:28:51 -0700 (MST) Message-ID: <4AEF4F11.2040408@stpeter.im> Date: Mon, 02 Nov 2009 14:28:49 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Tory Patnoe References: <4AE1F9B9.4090209@stpeter.im> <7fc4fa880910271132p4616cc93g899c330253e50149@mail.gmail.com> <4AE750F4.8070507@stpeter.im> <4AEF282D.1080803@cisco.com> <4AEF4702.9080106@stpeter.im> In-Reply-To: <4AEF4702.9080106@stpeter.im> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: xmpp@ietf.org Subject: Re: [xmpp] updated bis drafts X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 02 Nov 2009 21:28:34 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/2/09 1:54 PM, Peter Saint-Andre wrote: > On 11/2/09 11:42 AM, Tory Patnoe wrote: >> On 10/27/2009 01:58 PM, Peter Saint-Andre wrote: >>> As to whether the server needs to deliver inbound presence subscription >>> stanzas (subscribed, unsubscribe, unsubscribed), my reasoning is that if >>> the server does not deliver them to the client then the client has no >>> way to tell whether the roster push was generated by another resource or >>> triggered by the contact. >>> >> Would it not be better to put that information in the roster-push itself? > >> Perhaps with a copy of the triggering stanza as a sub-element to the >> roster push. That way client writers would not have to use two stanzas >> to trigger an event but look for a single stanza in the roster push >> while looking for extra details. > >> If the "double" stanza is preferred then I believe the presence stanza >> MUST be delivered _before_ the roster push. > > The double stanza is the way things have been specified since 1999. If > we define a new roster protocol (a hot topic of discussion a few months > ago), we'd add this feature to that protocol rather than force it into > the old protocol. I chatted with Tory about this offlist. He's right that the subscription-related presence stanza MUST be sent before the roster push, so I've updated my working copy of 3921bis to clarify that. I also checked RFC 3921 and it is a MUST there to pass along the subscription-related presence stanza. Thus the only difference between 3921 and 3921bis is that we have made the order of events explicit (presence stanza, then roster push). Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkrvTxEACgkQNL8k5A2w/vzB3gCfQj2dV6/GWWFi0QvWT73YCBFo gqsAoOfG/+tqs1iYRLwHYZOCxog2CZsI =pB3V -----END PGP SIGNATURE----- From stpeter@stpeter.im Thu Nov 5 15:48:08 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 321F528C10F for ; Thu, 5 Nov 2009 15:48:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.575 X-Spam-Level: X-Spam-Status: No, score=-2.575 tagged_above=-999 required=5 tests=[AWL=0.024, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U0GWWFZVXmO6 for ; Thu, 5 Nov 2009 15:48:07 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 6C4963A681B for ; Thu, 5 Nov 2009 15:48:07 -0800 (PST) Received: from dhcp-64-101-72-247.cisco.com (dhcp-64-101-72-247.cisco.com [64.101.72.247]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 4FAC340D1F for ; Thu, 5 Nov 2009 16:48:30 -0700 (MST) Message-ID: <4AF3644D.4090502@stpeter.im> Date: Thu, 05 Nov 2009 16:48:29 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: [xmpp] 3920bis topics for WG meeting X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Nov 2009 23:48:08 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have made a first draft of slides for my presentation about rfc3920bis at IETF76: http://www.saint-andre.com/jabber/IETF76-xmpp-3920bis.pdf If you see anything missing there, please let me know. I'm especially interested in figuring out what the open issues are. These not the final slides so please don't depend on them during the WG meeting! I'll work on the slides for 3921bis tomorrow. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkrzZE0ACgkQNL8k5A2w/vwTGgCfRafjFS9/2MI4smN0L1cuc2er QeEAoMZy1q+IfxQpnENbW+0CvpZiinxV =aMgD -----END PGP SIGNATURE----- From stpeter@stpeter.im Fri Nov 6 10:03:22 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4ED983A697D for ; Fri, 6 Nov 2009 10:03:22 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.807 X-Spam-Level: X-Spam-Status: No, score=-0.807 tagged_above=-999 required=5 tests=[AWL=1.792, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9dIMAV-1x3jr for ; Fri, 6 Nov 2009 10:03:21 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 580773A6944 for ; Fri, 6 Nov 2009 10:03:21 -0800 (PST) Received: from squire.local (dsl-175-187.dynamic-dsl.frii.net [216.17.175.187]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id ADC1B40D09 for ; Fri, 6 Nov 2009 11:03:44 -0700 (MST) Message-ID: <4AF464FF.40302@stpeter.im> Date: Fri, 06 Nov 2009 11:03:43 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: [xmpp] 3921bis topics for WG meeting X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Nov 2009 18:03:22 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I have made a first draft of slides for my presentation about rfc3921bis at IETF76: http://www.saint-andre.com/jabber/IETF76-xmpp-3921bis.pdf If you see anything missing there, please let me know. I'm especially interested in figuring out what the open issues are, if any (as far as I can see, there are no open issues with 3921bis). FYI, I've also made some small updates to my slides about 3920bis: http://www.saint-andre.com/jabber/IETF76-xmpp-3920bis.pdf However, please note that these not the final slides so don't depend on them during the WG meeting! I might make further changes in the next few days... Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkr0ZP8ACgkQNL8k5A2w/vx2AACcCEavpPtqdT3EZ+avTy2+FgwN nswAoMgZ9kTEn4nHIc0lT5n5tKiRvD/S =niJQ -----END PGP SIGNATURE----- From turners@ieca.com Sun Nov 8 23:11:02 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 40B473A69A5 for ; Sun, 8 Nov 2009 23:11:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.879 X-Spam-Level: X-Spam-Status: No, score=-1.879 tagged_above=-999 required=5 tests=[AWL=0.118, BAYES_00=-2.599, HS_INDEX_PARAM=0.001, J_CHICKENPOX_44=0.6, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NT0Ie8FkXeFZ for ; Sun, 8 Nov 2009 23:11:01 -0800 (PST) Received: from smtp107.biz.mail.mud.yahoo.com (smtp107.biz.mail.mud.yahoo.com [68.142.200.255]) by core3.amsl.com (Postfix) with SMTP id F272B3A6882 for ; Sun, 8 Nov 2009 23:11:00 -0800 (PST) Received: (qmail 24056 invoked from network); 9 Nov 2009 07:11:24 -0000 Received: from host-24-125.meeting.ietf.org (turners@133.93.24.125 with plain) by smtp107.biz.mail.mud.yahoo.com with SMTP; 08 Nov 2009 23:11:24 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: 3_rTpVMVM1lVukEBf3xYTrk7sq518QJDm1XppJaZYl2HiVvjuw1Dp54CPkCKnj8Gj16XNWmQYZIa7rfulA3sVvGkmsjVZ62ELzEvEPkPSKk8uEZecjqQP96bn_GXEmLdZrlq5GeZAesrQOmoG1ZF6qGeYBnbgeOytfScRQTAN7RCaJjH1A4cZdV2d4vkpEmMaIuvT3js8dTg8Zmxjac9qtwi5H.zADTRRbONTxpfZalvOjvuYbUOWS3p.mOK__J4EPhF98Wklfrytg2IZ6KZkU3uJNmRRsVX9pTHC_XnQiTkNkdXhAtKEMpR2AIxKWLWlpBM33gRwqgnPKZ.f7OlSiUJkIbbeR.p8Qx8kppJ3RZcCmoKpnNwR20kUDNB125E1X4563zYX9QkBqZ3yHwvs4Qk5GCJqu7K0XCt9CAnW8W.GButGSZIQtZK9I6u7K5o28MTiBziLK5sfC_Kvjx1NcSwsXfGoqpatCvrMKlPKjsTQC.tfXP7M.GcRbAfe1f5nJH.B4SDbl3qXLvtE.rYT7a8NRYf3K6bEpf6M6PcaG0oMJdfeRLNEm_Yk0.N1LTqKerAIRLt X-Yahoo-Newman-Property: ymail-3 Message-ID: <4AF7C09A.3090209@ieca.com> Date: Mon, 09 Nov 2009 16:11:22 +0900 From: Sean Turner User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [xmpp] Announcing the XMPP WG X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Nov 2009 07:11:02 -0000 This message is intended to help participants prepare for the XMPP WG at IETF 76. Date: November 11, 2009 Time: 13:00-15:00 local time 04:00-06:00 UTC (Note: this is the evening of November 10 in North America!) Building: ANA Crowne Plaza Hiroshima Hotel 7-20 Nakamachi, Naka-ku Hiroshima 730-0037 JAPAN Tel: +81 82-241-1111 http://www.anacrowneplaza-hiroshima.jp/en/ Room: Orchid East http://tools.ietf.org/agenda/76/venue/?room=cattleya-east Description: The Extensible Messaging and Presence Protocol (XMPP) is an technology for the near-real-time exchange of messages and presence notifications, where data is exchanged over Extensible Markup Language (XML) streams. The original XMPP working group published RFCs 3920-3923. At IETF 76, the XMPP WG will discuss revision to the published RFCs as well as solutions for end-to-end and server-to-server security solutions. Agenda: http://tools.ietf.org/wg/xmpp/agenda?item=agenda76.html Audio: http://videolab.uoregon.edu/events/ietf/ietf764.m3u Chat Room: xmpp:xmpp at jabber.ietf.org?join Chat Logs: http://www.ietf.org/jabber/logs/xmpp/ Charter: http://www.ietf.org/dyn/wg/charter/xmpp-charter.html WG documents: http://tools.ietf.org/html/draft-ietf-xmpp-e2e-requirements-00.txt http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03.txt http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03.txt Proposed WG documents: http://tools.ietf.org/html/draft-hildebrand-dna-00 Mailing list archives: http://www.ietf.org/mail-archive/web/xmpp Chairs: Joe Hildebrand and Sean Turner Responsible AD: Robert Sparks From stpeter@stpeter.im Tue Nov 10 13:09:47 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A4EC13A6B65 for ; Tue, 10 Nov 2009 13:09:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.574 X-Spam-Level: X-Spam-Status: No, score=-2.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S-2EUqpE-lgD for ; Tue, 10 Nov 2009 13:09:46 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id CE4503A6914 for ; Tue, 10 Nov 2009 13:09:18 -0800 (PST) Received: from host-113-169.meeting.ietf.org (64-104-46-217.cisco.com [64.104.46.217]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id E900240D09 for ; Tue, 10 Nov 2009 14:09:45 -0700 (MST) Message-ID: <4AF9D697.6020900@stpeter.im> Date: Wed, 11 Nov 2009 06:09:43 +0900 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: [xmpp] [Fwd: Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 10 Nov 2009 21:09:47 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FYI from the TLS list... - -------- Original Message -------- Subject: Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance Date: Wed, 11 Nov 2009 06:09:08 +0900 From: Peter Saint-Andre To: Nicolas Williams CC: tls@ietf.org References: <006FEB08D9C6444AB014105C9AEB133FB36A4EBF03@il-ex01.ad.checkpoint.com> <200911092152.nA9LqVkW000963@fs4113.wdf.sap.corp> <20091109223417.GK1105@Sun.COM> <4AF8E755.5020208@extendedsubset.com> <20091110164609.GS1105@Sun.COM> <4AF9AA9E.8030603@extendedsubset.com> <20091110181544.GW1105@Sun.COM> On 11/11/09 3:15 AM, Nicolas Williams wrote: > On Tue, Nov 10, 2009 at 12:02:06PM -0600, Marsh Ray wrote: >> Nicolas Williams wrote: >>> On Mon, Nov 09, 2009 at 10:08:53PM -0600, Marsh Ray wrote: >>> >>> TLS connections are not so long lived >> But there is no defined upper limit. > > True, and indeed, IMAP depends on that. Are there IMAP/other servers > the request re-negotiation when a client's cert reaches/nears > expiration? > > If so then my assertion that we don't have to worry about key rollover/ > cert expiration would be wrong. Indeed, it's safer to assume that that > assertion was wrong as finding out for sure would be hard. > > However, this is a constraint that _applications_ could enforce, or > request be enforced by the TLS implementation (oh dear, back to APIs). IMHO this is the responsibility of the application. For example in XMPP we use long-lived TCP connections and, on top of those, long-lived XML streams that can be TLS-protected. In practice, for server-to-server federation (and even for client-to-server communication) those connections might be up for days, weeks, even months. At this point the handling of long-lived XML streams is unspecified, but I would expect most XMPP servers to terminate the connection and force the other party to reconnect. I'll bring this up on the XMPP WG list... Peter _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkr51pcACgkQNL8k5A2w/vwVXwCdEMCH1UdYXcJy5qlC+0i/A91c 7oAAn1FIW22I240HvRxGOjHI6nvjmicw =pCXp -----END PGP SIGNATURE----- From fippo@mail.symlynx.com Wed Nov 11 00:15:08 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4BBE728C2DA for ; Wed, 11 Nov 2009 00:15:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.249 X-Spam-Level: X-Spam-Status: No, score=-2.249 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yAD1ih39ibXM for ; Wed, 11 Nov 2009 00:15:07 -0800 (PST) Received: from lectern.tobij.de (lectern.tobij.de [62.75.216.40]) by core3.amsl.com (Postfix) with ESMTP id A52CC28C2D6 for ; Wed, 11 Nov 2009 00:15:02 -0800 (PST) Received: from lectern.tobij.de (localhost [127.0.0.1]) by lectern.tobij.de (8.14.0/8.14.0) with ESMTP id nAB8FS4f006257 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Wed, 11 Nov 2009 09:15:28 +0100 Received: from localhost (fippo@localhost) by lectern.tobij.de (8.14.0/8.14.0/Submit) with ESMTP id nAB8FRm5006254 for ; Wed, 11 Nov 2009 09:15:28 +0100 X-Authentication-Warning: lectern.tobij.de: fippo owned process doing -bs Date: Wed, 11 Nov 2009 09:15:27 +0100 (CET) From: Philipp Hancke X-X-Sender: fippo@lectern.tobij.de To: XMPP In-Reply-To: <4AF9D697.6020900@stpeter.im> Message-ID: References: <4AF9D697.6020900@stpeter.im> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: Re: [xmpp] [Fwd: Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Nov 2009 08:15:08 -0000 On Wed, 11 Nov 2009, Peter Saint-Andre wrote: [snip] > IMHO this is the responsibility of the application. For example in XMPP > we use long-lived TCP connections and, on top of those, long-lived XML > streams that can be TLS-protected. In practice, for server-to-server > federation (and even for client-to-server communication) those > connections might be up for days, weeks, even months. At this point the > handling of long-lived XML streams is unspecified, but I would expect > most XMPP servers to terminate the connection and force the other party > to reconnect. I'll bring this up on the XMPP WG list... I don't think this is what is usually done. The certificate is checked once - XEP 0178 s2s step 7 - and the authorization persists until the stream is closed. If the receiving server closes the stream and the originating server reestablishes the stream, (starttls+)dialback might be used for authorization (it would be sensible to completly reject expired certificates, but that is not done in practice). philipp From turners@ieca.com Wed Nov 11 17:25:52 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 67F453A6828 for ; Wed, 11 Nov 2009 17:25:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.433 X-Spam-Level: X-Spam-Status: No, score=-2.433 tagged_above=-999 required=5 tests=[AWL=0.165, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mqy711OMfrKe for ; Wed, 11 Nov 2009 17:25:51 -0800 (PST) Received: from smtp104.biz.mail.mud.yahoo.com (smtp104.biz.mail.mud.yahoo.com [68.142.200.252]) by core3.amsl.com (Postfix) with SMTP id 7A9413A67B6 for ; Wed, 11 Nov 2009 17:25:51 -0800 (PST) Received: (qmail 78457 invoked from network); 12 Nov 2009 01:26:17 -0000 Received: from host-24-125.meeting.ietf.org (turners@133.93.24.125 with plain) by smtp104.biz.mail.mud.yahoo.com with SMTP; 11 Nov 2009 17:26:17 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: 9mjFDzkVM1nETtUggq9o.o1RxLRlheWuTNp9nY0EwT9DPf0kPMkHnqHKC56.8NQTokcll3uBM_MscAJ0Owh0xIlrcsXGpEOtQnR5qzjTDA_PVe.9FYXBDwMpNLcoJ5c8e1uBXrVvYZv6QV1YH_YmzO7GHWic_fQTcA6RpWCQ7teiL7IkFSo4f04AbHecQBjKr3aEkDaeGj2TY9vDvD9MVBVAdwdySGxNLNOnz9kB1MWq6rAfWyzUBdKBj6XLlhlWd.Xu3ln9Kr96kzT00hvezUIbeHR0VTtUXxnJmevRIWZD54wwfjscuBQ- X-Yahoo-Newman-Property: ymail-3 Message-ID: <4AFB6437.1020000@ieca.com> Date: Thu, 12 Nov 2009 10:26:15 +0900 From: Sean Turner User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Peter Saint-Andre References: <4AF9D697.6020900@stpeter.im> In-Reply-To: <4AF9D697.6020900@stpeter.im> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] [Fwd: Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2009 01:25:52 -0000 Peter Saint-Andre wrote: > On 11/11/09 3:15 AM, Nicolas Williams wrote: >> On Tue, Nov 10, 2009 at 12:02:06PM -0600, Marsh Ray wrote: >>> Nicolas Williams wrote: >>>> On Mon, Nov 09, 2009 at 10:08:53PM -0600, Marsh Ray wrote: >>>> >>>> TLS connections are not so long lived >>> But there is no defined upper limit. >> True, and indeed, IMAP depends on that. Are there IMAP/other servers >> the request re-negotiation when a client's cert reaches/nears >> expiration? >> >> If so then my assertion that we don't have to worry about key rollover/ >> cert expiration would be wrong. Indeed, it's safer to assume that that >> assertion was wrong as finding out for sure would be hard. >> >> However, this is a constraint that _applications_ could enforce, or >> request be enforced by the TLS implementation (oh dear, back to APIs). > > IMHO this is the responsibility of the application. For example in XMPP > we use long-lived TCP connections and, on top of those, long-lived XML > streams that can be TLS-protected. In practice, for server-to-server > federation (and even for client-to-server communication) those > connections might be up for days, weeks, even months. At this point the > handling of long-lived XML streams is unspecified, but I would expect > most XMPP servers to terminate the connection and force the other party > to reconnect. I'll bring this up on the XMPP WG list... One of the things we talked about was possibly checking an OCSP server for revocation information periodically during a long-lived session. This will only work if we a) manually configure servers to know where to look for the OCSP responder b) we put a Authority Information Access (AIA) extension in the server's certificate (points to the location of the OCSP responder). I poked around and see that some SSL/TLS certificates include AIA so option b seems plausible. spt From stpeter@stpeter.im Wed Nov 11 17:30:46 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4E1BE3A6B11 for ; Wed, 11 Nov 2009 17:30:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.784 X-Spam-Level: X-Spam-Status: No, score=-2.784 tagged_above=-999 required=5 tests=[AWL=-0.185, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0by7Nnc0YWFg for ; Wed, 11 Nov 2009 17:30:45 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id A04C628C1A2 for ; Wed, 11 Nov 2009 17:30:44 -0800 (PST) Received: from host-18-99.meeting.ietf.org (64-104-46-217.cisco.com [64.104.46.217]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 0BCB040D09; Wed, 11 Nov 2009 18:31:11 -0700 (MST) Message-ID: <4AFB655D.8080806@stpeter.im> Date: Thu, 12 Nov 2009 10:31:09 +0900 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Sean Turner References: <4AF9D697.6020900@stpeter.im> <4AFB6437.1020000@ieca.com> In-Reply-To: <4AFB6437.1020000@ieca.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms080003080802030308070301" Cc: XMPP Subject: Re: [xmpp] [Fwd: Re: [TLS] draft-rescorla-tls-renegotiate and MITM resistance] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2009 01:30:46 -0000 This is a cryptographically signed message in MIME format. --------------ms080003080802030308070301 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/12/09 10:26 AM, Sean Turner wrote: > Peter Saint-Andre wrote: >> On 11/11/09 3:15 AM, Nicolas Williams wrote: >>> On Tue, Nov 10, 2009 at 12:02:06PM -0600, Marsh Ray wrote: >>>> Nicolas Williams wrote: >>>>> On Mon, Nov 09, 2009 at 10:08:53PM -0600, Marsh Ray wrote: >>>>> >>>>> TLS connections are not so long lived >>>> But there is no defined upper limit. >>> True, and indeed, IMAP depends on that. Are there IMAP/other servers >>> the request re-negotiation when a client's cert reaches/nears >>> expiration? >>> >>> If so then my assertion that we don't have to worry about key rollover/ >>> cert expiration would be wrong. Indeed, it's safer to assume that that >>> assertion was wrong as finding out for sure would be hard. >>> >>> However, this is a constraint that _applications_ could enforce, or >>> request be enforced by the TLS implementation (oh dear, back to APIs). >> >> IMHO this is the responsibility of the application. For example in XMPP >> we use long-lived TCP connections and, on top of those, long-lived XML >> streams that can be TLS-protected. In practice, for server-to-server >> federation (and even for client-to-server communication) those >> connections might be up for days, weeks, even months. At this point the >> handling of long-lived XML streams is unspecified, but I would expect >> most XMPP servers to terminate the connection and force the other party >> to reconnect. I'll bring this up on the XMPP WG list... > > One of the things we talked about was possibly checking an OCSP server > for revocation information periodically during a long-lived session. > This will only work if we a) manually configure servers to know where to > look for the OCSP responder b) we put a Authority Information Access > (AIA) extension in the server's certificate (points to the location of > the OCSP responder). I poked around and see that some SSL/TLS > certificates include AIA so option b seems plausible. Yes. I know that the XMPP ICA (with the StartCom root) supports the AIA extension, and IMHO that should be a best practice or even a SHOULD for PKCs issued to XMPP entities, precisely because XMPP streams can live for so long. Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms080003080802030308070301 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExMjAxMzEwOVowIwYJKoZIhvcNAQkEMRYEFOfr0BxUD1/kaBLsm9Ks IdWWty0eMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAgMeBf6sOMvK3KUlKyBm4BWjb56hCpklibZaK8FVP 6SUfIEPEaSAf7ypJtTKWToS1kxdUPtHDq/Yv7pHmK3J2+4rZ/6Yu02p3iW2dM8HfCSkdRpV2 06fjqvIUT1eUR6KJ6tyn9qwA/OGvbUM8U+wY+g/hp9kzTOtCLPvOPif97vUEF2ERBtGeKRKN gi4KBn0rJ1+UUfj1X4Sc0ubqPGC8/fFCkv/8TNS9SDVki/YQE/CHvj8f1L6/BaLgLPS67xgq qI2fsRGYrs4UnHUPpO60X51wsTlZgPvE8SO3oIOcKF72QApVUzacoTfYMIEnksXcoAf3CJLp iVH2u0QW8qi2oAAAAAAAAA== --------------ms080003080802030308070301-- From turners@ieca.com Wed Nov 11 20:17:29 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 879B53A63EB for ; Wed, 11 Nov 2009 20:17:29 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.446 X-Spam-Level: X-Spam-Status: No, score=-2.446 tagged_above=-999 required=5 tests=[AWL=0.152, BAYES_00=-2.599, UNPARSEABLE_RELAY=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8ORYpsKFptWO for ; Wed, 11 Nov 2009 20:17:28 -0800 (PST) Received: from smtp106.biz.mail.mud.yahoo.com (smtp106.biz.mail.mud.yahoo.com [68.142.200.254]) by core3.amsl.com (Postfix) with SMTP id A2BF03A6767 for ; Wed, 11 Nov 2009 20:17:28 -0800 (PST) Received: (qmail 26935 invoked from network); 12 Nov 2009 04:17:54 -0000 Received: from host-24-125.meeting.ietf.org (turners@133.93.24.125 with plain) by smtp106.biz.mail.mud.yahoo.com with SMTP; 11 Nov 2009 20:17:54 -0800 PST X-Yahoo-SMTP: ZrP3VLSswBDL75pF8ymZHDSu9B.vcMfDPgLJ X-YMail-OSG: 7e7o1usVM1m9qMImaLOHxd189rBiozMM0BvXFGOtFBeamQNc3LDIcPClE8qaPtVV7LXk3SrB60OPQo9JK7KO_dygX3DZOLvvo_9OjmlkqESK.qHU51kSb3q7nlmeaxk5jArL2mSBWlmEN_Rn9dz1q8GYoR5GDtgC.f2UlDzqy8XsyZBse3K267riMdGgXHuzeH8ErcEGwln9FesL1dYyC28aDxu0ysSNfaWvAwP4jVZx6iLGhxwAR9sesAjwHWXnxQnMQuHdwqQ6.gIitUktQI.0QtkaiMgtJaTLQnehVSmev_v_wVoY51U- X-Yahoo-Newman-Property: ymail-3 Message-ID: <4AFB8C70.4010005@ieca.com> Date: Thu, 12 Nov 2009 13:17:52 +0900 From: Sean Turner User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [xmpp] Acceptance of draft-hildeband-dna as WG item X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2009 04:17:29 -0000 There was clear consensus (hums measured by Ralph) in the WG to accept draft-hildebrand-dna as a WG item. After new authors have been identified, it will be resubmitted as a WG document. The reason new authors need to be identified is that Joe and I are the current authors. spt From stpeter@stpeter.im Thu Nov 12 13:49:11 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1588C3A68F0 for ; Thu, 12 Nov 2009 13:49:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.747 X-Spam-Level: X-Spam-Status: No, score=-2.747 tagged_above=-999 required=5 tests=[AWL=-0.148, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E1ANneWiFDTd for ; Thu, 12 Nov 2009 13:49:10 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id CEEAC3A684D for ; Thu, 12 Nov 2009 13:49:09 -0800 (PST) Received: from host-113-169.meeting.ietf.org (64-104-46-217.cisco.com [64.104.46.217]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 3C65240D09 for ; Thu, 12 Nov 2009 14:49:38 -0700 (MST) Message-ID: <4AFC82F0.70301@stpeter.im> Date: Fri, 13 Nov 2009 06:49:36 +0900 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms050507070003040409060402" Subject: [xmpp] [Fwd: Re: [TLS] TLS or HTTP issue?] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2009 21:49:11 -0000 This is a cryptographically signed message in MIME format. --------------ms050507070003040409060402 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit FYI from the TLS list. -------- Original Message -------- Subject: Re: [TLS] TLS or HTTP issue? Date: Wed, 11 Nov 2009 15:34:49 -0800 From: Chris Newman To: Peter Saint-Andre , Nikos Mavrogiannopoulos CC: Eric Rescorla , tls@ietf.org References: <73843DF9-EFCB-4B8D-913E-FE2235E5BDD3@rtfm.com> <4AF33D07.7040100@gnutls.org> <4AF455DF.5040106@stpeter.im> It is likely XMPP is vulnerable. IMAP and SMTP are vulnerable. The only application protocol I've studied that I believe resists the vulnerability is POP3+STLS (even pops may be vulnerable). I know of two ways to leverage the TLS re-negotiation vulnerability to attack applications: 1. Authenticating an otherwise un-trusted directive using credentials from an authorized user. As far as I know this attack only applies to HTTP-like protocols (including IPP, SIP, HTTP, WebDAV, CalDAV, etc.) due to the poor design of HTTP authentication, cookie and client certificate mechanisms. Application protocols like IMAP, POP, SMTP, XMPP, BEEP with cleanly separate not-authenticated and authenticated states are immune to this attack. 2. Having one authorized and authenticated TLS session decrypt data from a different TLS session. This attack is most severe for SMTP+STARTTLS+BDAT (since SMTP relays typically treat all senders as authenticated as long as the recipient is in the local domain), but impacts most application protocols that have a command to "send", "post", "put", "set an attribute" or perform any write operation that can subsequently be read back. In the case of IMAP, this can be used by one authorized IMAP user (someone with an account on the IMAP server) to potentially steal the login password of another IMAP user on the same server (with some IMAP client behavior caveats). It is likely that XMPP is vulnerable to attack #2. I would recommend anyone running an SMTP relay (port 25) to turn off both the STARTTLS and SMTP AUTH features immediately until this is resolved. An SMTP Submission server (port 587, RFC 4409, requires SMTP AUTH to submit mail) should keep STARTTLS enabled. Sites that have not made the split between SMTP relay and SMTP submission should do so -- they have different security properties and this is yet another reason they should be different services (either on different ports or different IP addresses). - Chris --On November 6, 2009 9:59:11 -0700 Peter Saint-Andre wrote: > On 11/5/09 2:00 PM, Nikos Mavrogiannopoulos wrote: >> Eric Rescorla wrote: >>> TLS WG members will want to check out this announcement of a >>> new attack on the TLS renegotiation logic. See here: >>> >>> http://www.extendedsubset.com/ >>> >>> The high-level summary is that the attacker negotiates TLS with the >>> server and then subsequently proxies the client's negotiation *over* >>> that channel. This allows the attacker to inject arbitrary content of >>> their choice in front of data sent from the TLS client to the TLS >>> server. This data will be treated by the server as if it came from the >>> client. Once the new handshake has finished, the attacker can't >>> do anything else useful. > >> I'll become a bit pedantic and note here that this isn't really a TLS >> issue. We have an initial server-authenticated only session and some >> renegotiation of parameters over it to authenticate the client. However >> TLS doesn't guarantee[0] that if the renegotiation is successful >> authenticating the client, then the data from the initial session were >> also by the same authenticated client. >> Think for example a session that it is anonymous (DH). Why one should >> assume that commands over the anonymous connection are to be trusted if >> a successful renegotiation follows? > >> So for me the issue is on HTTP's usage of the TLS protocol >> renegotiation. After a TLS renegotiation for authentication the previous >> command cache should have been cleared and reissued after negotiation. > > I tend to agree. Some folks in the XMPP community have analyzed the use > of TLS in XMPP, and their preliminary conclusion is that XMPP is not > vulnerable to this attack because the client and server are required to > clear the security context and restart the XML stream after TLS > negotiation (or renegotiation). Those who did this analysis will publish > a brief report about their findings in the near future. > > Peter > --------------ms050507070003040409060402 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExMjIxNDkzNlowIwYJKoZIhvcNAQkEMRYEFBPpmi+FqV45B/3vwK9b xhPf6r9WMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAGqAiq54LJH3BXqXZ3WZAwI5SXSZ+dXadSVU1Lfg/ haOgWPAKGOAhSAwX/+bf3fLAYFZ1VBfVPn2hnaYaAToZF6h2m+PVqsOqfGkFdgKdsJJR/xap ePF5x7HOoLkNK9cfacDe5EY8RelrLSJCyxqatM8MP137bfSgDQf+QTLd3E2VEJfZR4lW1P9C cfI4IdeGMYFkTTbeXggrJSB7yrmt8y2EeDHDRE4lI6q90heot2DmeOzhOCRDiOKjoHZVHYyR dtA9qL+OnRZvkvUBerKaMOibaBeqNEXY4CZFhiez74N9ZDhbH+SbS/eHm4N1npgKQQs4Eko/ oQbt148HN6ezFAAAAAAAAA== --------------ms050507070003040409060402-- From mwild1@gmail.com Thu Nov 12 14:42:32 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 42D4E3A69A9 for ; Thu, 12 Nov 2009 14:42:32 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.382 X-Spam-Level: X-Spam-Status: No, score=-2.382 tagged_above=-999 required=5 tests=[AWL=0.217, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o22ggO0uoA2L for ; Thu, 12 Nov 2009 14:42:31 -0800 (PST) Received: from mail-bw0-f223.google.com (mail-bw0-f223.google.com [209.85.218.223]) by core3.amsl.com (Postfix) with ESMTP id 358E13A69A2 for ; Thu, 12 Nov 2009 14:42:31 -0800 (PST) Received: by bwz23 with SMTP id 23so2839431bwz.29 for ; Thu, 12 Nov 2009 14:42:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=INzxI/pKrxnyeN74Dqr+0kkiVkrw5UDCn702CP1UF2w=; b=YohwC17CimHlAoGhZt75OMHW68NP1yowafYv8j58AUF+5xRsyVbrtuNcmeJaoze4Eg NdlLNd6A/jTmYmC9gYSGY7swbWkSlS/twSGxf+4YztFUbLdjBiQ9pQoIkqBGn5RESpn/ dceBHsNKFp1cvZdfM2g2+2TY9AEqPbOZvxWEo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=Yi3Cc1ijjoSq/gi/Zw7f2piof9036LWSAqfu3ZRDaREEap537qMQoLflswb6DpKEu5 rBE+8FgTvC9Muh1NGZSr4hKBzOyP0StK3tw80GjgLz0DchQnf0GTI78MoZquSX6U7dVl +6cdreO0khNkJY2dj1lxJZOgJvEbPP86YEX1s= MIME-Version: 1.0 Received: by 10.204.7.87 with SMTP id c23mr2795221bkc.97.1258065776434; Thu, 12 Nov 2009 14:42:56 -0800 (PST) In-Reply-To: <4AFC82F0.70301@stpeter.im> References: <4AFC82F0.70301@stpeter.im> From: Matthew Wild Date: Thu, 12 Nov 2009 22:42:36 +0000 Message-ID: <4db9cacb0911121442j1ae2a0c3xc48dd3e67695a101@mail.gmail.com> To: Peter Saint-Andre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Cc: XMPP Subject: Re: [xmpp] [Fwd: Re: [TLS] TLS or HTTP issue?] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2009 22:42:32 -0000 2009/11/12 Peter Saint-Andre : > FYI from the TLS list. > > -------- Original Message -------- > Subject: Re: [TLS] TLS or HTTP issue? > Date: Wed, 11 Nov 2009 15:34:49 -0800 > From: Chris Newman > To: Peter Saint-Andre , =A0 =A0 =A0 =A0Nikos > Mavrogiannopoulos > CC: Eric Rescorla , tls@ietf.org > References: <73843DF9-EFCB-4B8D-913E-FE2235E5BDD3@rtfm.com> > <4AF33D07.7040100@gnutls.org> <4AF455DF.5040106@stpeter.im> > > It is likely XMPP is vulnerable. =A0IMAP and SMTP are vulnerable. =A0The = only > application protocol I've studied that I believe resists the vulnerabilit= y > is POP3+STLS (even pops may be vulnerable). > > I know of two ways to leverage the TLS re-negotiation vulnerability to > attack applications: > > > 2. Having one authorized and authenticated TLS session decrypt data from = a > different TLS session. =A0This attack is most severe for SMTP+STARTTLS+BD= AT > (since SMTP relays typically treat all senders as authenticated as long a= s > the recipient is in the local domain), but impacts most application > protocols that have a command to "send", "post", "put", "set an attribute= " > or perform any write operation that can subsequently be read back. =A0In = the > case of IMAP, this can be used by one authorized IMAP user (someone with = an > account on the IMAP server) to potentially steal the login password of > another IMAP user on the same server (with some IMAP client behavior > caveats). > > It is likely that XMPP is vulnerable to attack #2. > I'm curious... are there any references to this form of attack? I've failed to find any mention of it so far. Do I need to join another mailing list? :) Matthew From stpeter@stpeter.im Thu Nov 12 15:23:17 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5C5433A6AFB for ; Thu, 12 Nov 2009 15:23:17 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.736 X-Spam-Level: X-Spam-Status: No, score=-2.736 tagged_above=-999 required=5 tests=[AWL=-0.137, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XbWitoAZ2NDx for ; Thu, 12 Nov 2009 15:23:16 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 6FFBE3A67F0 for ; Thu, 12 Nov 2009 15:23:16 -0800 (PST) Received: from host-113-169.meeting.ietf.org (64-104-46-217.cisco.com [64.104.46.217]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id A4E7140D09; Thu, 12 Nov 2009 16:23:44 -0700 (MST) Message-ID: <4AFC98FE.7030808@stpeter.im> Date: Fri, 13 Nov 2009 08:23:42 +0900 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Matthew Wild References: <4AFC82F0.70301@stpeter.im> <4db9cacb0911121442j1ae2a0c3xc48dd3e67695a101@mail.gmail.com> In-Reply-To: <4db9cacb0911121442j1ae2a0c3xc48dd3e67695a101@mail.gmail.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms060905020009060502050207" Cc: XMPP Subject: Re: [xmpp] [Fwd: Re: [TLS] TLS or HTTP issue?] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Nov 2009 23:23:17 -0000 This is a cryptographically signed message in MIME format. --------------ms060905020009060502050207 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/13/09 7:42 AM, Matthew Wild wrote: > 2009/11/12 Peter Saint-Andre : >> FYI from the TLS list. >> >> -------- Original Message -------- >> Subject: Re: [TLS] TLS or HTTP issue? >> Date: Wed, 11 Nov 2009 15:34:49 -0800 >> From: Chris Newman >> To: Peter Saint-Andre , Nikos >> Mavrogiannopoulos >> CC: Eric Rescorla , tls@ietf.org >> References: <73843DF9-EFCB-4B8D-913E-FE2235E5BDD3@rtfm.com> >> <4AF33D07.7040100@gnutls.org> <4AF455DF.5040106@stpeter.im> >> >> It is likely XMPP is vulnerable. IMAP and SMTP are vulnerable. The only >> application protocol I've studied that I believe resists the vulnerability >> is POP3+STLS (even pops may be vulnerable). >> >> I know of two ways to leverage the TLS re-negotiation vulnerability to >> attack applications: >> > >> 2. Having one authorized and authenticated TLS session decrypt data from a >> different TLS session. This attack is most severe for SMTP+STARTTLS+BDAT >> (since SMTP relays typically treat all senders as authenticated as long as >> the recipient is in the local domain), but impacts most application >> protocols that have a command to "send", "post", "put", "set an attribute" >> or perform any write operation that can subsequently be read back. In the >> case of IMAP, this can be used by one authorized IMAP user (someone with an >> account on the IMAP server) to potentially steal the login password of >> another IMAP user on the same server (with some IMAP client behavior >> caveats). >> >> It is likely that XMPP is vulnerable to attack #2. >> > > I'm curious... are there any references to this form of attack? I've > failed to find any mention of it so far. Do I need to join another > mailing list? :) Nico Williams asked for a description of this attack on the TLS mailing list. If such is provided, I'll pass it along here. :) Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms060905020009060502050207 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExMjIzMjM0MlowIwYJKoZIhvcNAQkEMRYEFEa8S4+nfCrzPG+23ngr OuUMw4+hMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAJzanK0OSFYPGHonMX9BjfDQW6/8/dQLRdc/zkou4 aZvTxZrIk+XEpaWdGUG5IAJbyGc71F2IkuxsF/C/ATZMnm7KHbn2MIBS2dH4u3f4lmK+U03k 267AUE//gNWS732CxkPHgo5d8fphAY/AFOeSMMQHX04mvqmxbxTrgSuGJd1q7+DtUTxMSce6 aKAj1AghD8ks/p5YZhxEMgQj1X/glCg5El02hg5hydSxw8+Qq+rhNEgTcWo0qNJRCy4Wym5k HrUAOt6/9pg4HLx5QNy/MfEcrZIog3kOMDqRBq3Q8feJF9XMfdUfKPJ3b+Q8fFUCX4gJ00b2 gW7Y0vntZYBKXQAAAAAAAA== --------------ms060905020009060502050207-- From tmarkmann@googlemail.com Mon Nov 16 11:27:06 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 75F0C28C10D for ; Mon, 16 Nov 2009 11:27:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.976 X-Spam-Level: X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id upI-h6R3DyZB for ; Mon, 16 Nov 2009 11:27:05 -0800 (PST) Received: from ey-out-2122.google.com (ey-out-2122.google.com [74.125.78.27]) by core3.amsl.com (Postfix) with ESMTP id 46A7A3A69EB for ; Mon, 16 Nov 2009 11:27:05 -0800 (PST) Received: by ey-out-2122.google.com with SMTP id 9so2068819eyd.51 for ; Mon, 16 Nov 2009 11:27:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:from:date:message-id :subject:to:content-type; bh=A5ux12l+go2acC2Q5kGS5bKyetHN8Gh1itHDkzJ3jyI=; b=vTsch8JSbQrUBq7CCQs+tIdXcOhpsuLg8qPyhhIm9fvFi6o9OSyRE8tDhIZQxfB/ni C1Bvo9PV7EnI29brrTeJVN8Yk4aa+gJxbnTRbLEnN7SHhvNP0a24qO04iSIaFtYKeE5B hWh1NdbSBlNUo0LpF7LwtQ7C3tXiXL+gU3Dqs= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=pTgQDBKhA8uRrVvBcf4rT3tgx6SuHNKweDry2NJP6Rj1TYBYpSH9yYVfQuYky9Ha1C Qt2dwotIraSgKLD5uaWoUjFIIrMKR13mIHxTp20D/kEp7a5mJvcz/L18Sa6dGquyXf9t Nnc3J4gWU/5IKkX6kb8RX2MZM5loCa8UxAO3M= MIME-Version: 1.0 Received: by 10.213.25.79 with SMTP id y15mr4809774ebb.78.1258399620795; Mon, 16 Nov 2009 11:27:00 -0800 (PST) From: Tobias Markmann Date: Mon, 16 Nov 2009 20:26:40 +0100 Message-ID: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> To: xmpp@ietf.org Content-Type: multipart/alternative; boundary=000e0ce0b726620d6d047881fe78 Subject: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 16 Nov 2009 19:27:06 -0000 --000e0ce0b726620d6d047881fe78 Content-Type: text/plain; charset=UTF-8 Hi, According to 3920bis-03 there are this two errors defined: mechanism-invalid [1] and mechanism-too-weak [2]. I think mechanism-invalid would be sufficient. SASL usually works the way that first the server advertises what it supports and then the client gets to choose. A client selecting a mechanism which hasn't advertised is quite broken in my opinion. Since it's broken why have two errors for this. I mean the client can't really do something useful with the info mechanism-too-weak. Selecting and unsupported mechanism is quite a bug and I think it would be cleaner to not split our errors in areas that are about buggy clients. Or have I missed the clients that bring up a text box where the user can enter the mechanism to use manually? ;) Cheers, Tobias [1] http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03#section-7.4.7 [2] http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03#section-7.4.9 -- Tobias Markmann http://ayena.de --000e0ce0b726620d6d047881fe78 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hi,

According to 3920bis-03 there are this two errors de= fined: mechanism-invalid [1] and mechanism-too-weak [2]. I think mechanism-= invalid would be sufficient.

SASL usually works th= e way that first the server advertises what it supports and then the client= gets to choose. A client selecting a mechanism which hasn't advertised= is quite broken in my opinion. Since it's broken why have two errors f= or this. I mean the client can't really do something useful with the in= fo mechanism-too-weak. Selecting and unsupported mechanism is quite a bug a= nd I think it would be cleaner to not split our errors in areas that are ab= out buggy clients. Or have I missed the clients that bring up a text box wh= ere the user can enter the mechanism to use manually? ;)

Cheers,
Tobias

[1]=C2=A0http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03#secti= on-7.4.7

--
Tobias Markmann
http://ayena.de
--000e0ce0b726620d6d047881fe78-- From alexey.melnikov@isode.com Mon Nov 16 23:52:30 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3AA813A6A7D for ; Mon, 16 Nov 2009 23:52:30 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jm+uh+A2E5Xi for ; Mon, 16 Nov 2009 23:52:29 -0800 (PST) Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by core3.amsl.com (Postfix) with ESMTP id 61B6E3A68B1 for ; Mon, 16 Nov 2009 23:52:29 -0800 (PST) Received: from [92.40.109.123] (92.40.109.123.sub.mbb.three.co.uk [92.40.109.123]) by rufus.isode.com (submission channel) via TCP with ESMTPA id ; Tue, 17 Nov 2009 07:52:27 +0000 Message-ID: <4B025638.6090101@isode.com> Date: Tue, 17 Nov 2009 16:52:24 +0900 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.21) Gecko/20090303 SeaMonkey/1.1.15 To: Tobias Markmann References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> In-Reply-To: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 07:52:30 -0000 Tobias Markmann wrote: > Hi, Hi Tobias, > According to 3920bis-03 there are this two errors defined: > mechanism-invalid [1] and mechanism-too-weak [2]. I think > mechanism-invalid would be sufficient. > > SASL usually works the way that first the server advertises what it > supports and then the client gets to choose. A client selecting a > mechanism which hasn't advertised is quite broken in my opinion. I agree. But there might be another use case for the error code - selection of a mechanism which is considered too weak for a particular user. In such case the server would advertise the mechanism to everybody, but return the error for some users. > Since it's broken why have two errors for this. I mean the client > can't really do something useful with the info mechanism-too-weak. > Selecting and unsupported mechanism is quite a bug and I think it > would be cleaner to not split our errors in areas that are about buggy > clients. Or have I missed the clients that bring up a text box where > the user can enter the mechanism to use manually? ;) > > Cheers, > Tobias > > [1] http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03#section-7.4.7 > [2] http://tools.ietf.org/html/draft-ietf-xmpp-3920bis-03#section-7.4.9 From tmarkmann@googlemail.com Tue Nov 17 00:11:47 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6863E3A6B8E for ; Tue, 17 Nov 2009 00:11:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.976 X-Spam-Level: X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BUuuNPaHGGUX for ; Tue, 17 Nov 2009 00:11:46 -0800 (PST) Received: from ey-out-2122.google.com (ey-out-2122.google.com [74.125.78.27]) by core3.amsl.com (Postfix) with ESMTP id CC34C3A6856 for ; Tue, 17 Nov 2009 00:11:40 -0800 (PST) Received: by ey-out-2122.google.com with SMTP id 9so2246618eyd.51 for ; Tue, 17 Nov 2009 00:11:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:content-type; bh=v2gvxk/QUEdeXrCTemtCi4CA/bWs/DvSFDMc1aGpZkk=; b=uE1qy8YFoWrSXLiDGuPRPAK8LpkR8Eglhs16I6MikSnTvQ6kwvR8KUlE3BpqB69DDR tsTgfojgv72RWCseiYXoi7VarakECVFqLVqcYqm93qxN7Ozq8Ing5bBRxYQVdD9orUKb 13yya0VEpzzutClxOz4VkKcMJ3fPBU1zc31S4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; b=wwa39sBqL9Y8GHB8gVAg2xEOPfe48nVUt3MMxZi0TwFo/roGVvDDVwLwqx40wI/orz mEEGRWsSZBAJEyYz+IA2ihcMVIMGmaOuocoVHD/d4rRMx0HN6tqgm3K1DBhHD/kwD4g9 eGrDuhcLPwM6qTPxz3j6At6334ai9a2qACpnw= MIME-Version: 1.0 Received: by 10.213.100.168 with SMTP id y40mr1318059ebn.77.1258445496441; Tue, 17 Nov 2009 00:11:36 -0800 (PST) In-Reply-To: <4B025638.6090101@isode.com> References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> From: Tobias Markmann Date: Tue, 17 Nov 2009 09:11:15 +0100 Message-ID: <5cfc0a8e0911170011o5842b7abkd09787ecfc3d9c90@mail.gmail.com> To: xmpp@ietf.org Content-Type: multipart/alternative; boundary=00504502e2bbc8ddcf04788cacf3 Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 08:11:47 -0000 --00504502e2bbc8ddcf04788cacf3 Content-Type: text/plain; charset=UTF-8 On Tue, Nov 17, 2009 at 8:52 AM, Alexey Melnikov wrote: > But there might be another use case for the error code - selection of a > mechanism which is considered too weak for a particular user. In such case > the server would advertise the mechanism to everybody, but return the error > for some users. So you're are suggesting to use the mechanism-too-weak error for per-user authentication profiles since you initially can only have them on per-domain basis. But then again how should the client know what to chose for the current user? Try each advertised mechanism and after 20 round trips finally find one that doesn't respond with an mechanism-too-error? Which client does provide manual SASL mechanism choice so the user could select a more secure mechanism? -- Tobias Markmann http://ayena.de --00504502e2bbc8ddcf04788cacf3 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Tue, Nov 17, 2009 at 8:52 AM, Alexey Melnikov=C2= =A0<alexey.melnikov@isode.com>=C2=A0wrote:
But there might be another use case for the error code - selection of a mec= hanism which is considered too weak for a particular user. In such case the= server would advertise the mechanism to everybody, but return the error fo= r some users.

So you're are suggesting to use the mechanism-too-weak = error for per-user authentication profiles since you initially can only hav= e them on per-domain basis. But then again how should the client know what = to chose for the current user? Try each advertised mechanism and after 20 r= ound trips finally find one that doesn't respond with an mechanism-too-= error?

 --00504502e2bbc8ddcf04788cacf3-- From fippo@mail.symlynx.com Tue Nov 17 01:28:38 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9B8913A67C2 for ; Tue, 17 Nov 2009 01:28:38 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.649 X-Spam-Level: X-Spam-Status: No, score=-1.649 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, J_CHICKENPOX_64=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ljKBhfixmmH for ; Tue, 17 Nov 2009 01:28:38 -0800 (PST) Received: from lectern.tobij.de (lectern.tobij.de [62.75.216.40]) by core3.amsl.com (Postfix) with ESMTP id B49D23A69FD for ; Tue, 17 Nov 2009 01:28:37 -0800 (PST) Received: from lectern.tobij.de (localhost [127.0.0.1]) by lectern.tobij.de (8.14.0/8.14.0) with ESMTP id nAH9SZfC018179 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 17 Nov 2009 10:28:35 +0100 Received: from localhost (fippo@localhost) by lectern.tobij.de (8.14.0/8.14.0/Submit) with ESMTP id nAH9SZiE018176 for ; Tue, 17 Nov 2009 10:28:35 +0100 X-Authentication-Warning: lectern.tobij.de: fippo owned process doing -bs Date: Tue, 17 Nov 2009 10:28:35 +0100 (CET) From: Philipp Hancke X-X-Sender: fippo@lectern.tobij.de To: xmpp@ietf.org In-Reply-To: <4B025638.6090101@isode.com> Message-ID: References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 09:28:38 -0000 Hi Alexey, > But there might be another use case for the error code - selection of a > mechanism which is considered too weak for a particular user. In > such case the server would advertise the mechanism to everybody, but > return the error for some users. If stream:from is set, the servers knows the users jid before offering the list of mechanisms and should not offer any weak mechanisms. Might solve Tobias problem at least. cheers philipp From tmarkmann@googlemail.com Tue Nov 17 01:35:55 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BB66528C0E1 for ; Tue, 17 Nov 2009 01:35:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.676 X-Spam-Level: X-Spam-Status: No, score=-1.676 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_64=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sa-gQjZYT4lu for ; Tue, 17 Nov 2009 01:35:54 -0800 (PST) Received: from ey-out-2122.google.com (ey-out-2122.google.com [74.125.78.26]) by core3.amsl.com (Postfix) with ESMTP id 92A9F3A6A9D for ; Tue, 17 Nov 2009 01:35:54 -0800 (PST) Received: by ey-out-2122.google.com with SMTP id 9so2266651eyd.51 for ; Tue, 17 Nov 2009 01:35:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=7ujnymuIFawt7ycPrs89tZ24DDVY3CfVvdrk/rYPwL8=; b=EbJINKH9nVRmdiMGiUqyRAtaFyUIQAkEy9F8Jx6o7VpXLGaqo5BespDQIKlBh8gkrb hTE1m5WIwbYOTHxPmlaHBg+AgHGK0aw3ra6OX54u4wERgQG+XFGyKw/MsIFrxRogBA/J uCX686WRdR9AC4RTZQy/DgLF8VjHXPADMxSfY= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=akQAxRAqv/ni1PY/squzvms9Hu8RCVIO5ekWxk0hdxRxHQeUU4ydPNka+cqiBP6M6S kNWxU6iEKLvfXIJYDgqaNLbsCdhZ0d70PmD9mBtAeCJeoX1UJ8bFrsNgqBkVbs7hZ7XA pTi0y5Hvu6Lbo4BsxYkS7TX578gyg6wDIoiks= MIME-Version: 1.0 Received: by 10.213.68.143 with SMTP id v15mr2269094ebi.45.1258450549194; Tue, 17 Nov 2009 01:35:49 -0800 (PST) In-Reply-To: References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> From: Tobias Markmann Date: Tue, 17 Nov 2009 10:35:29 +0100 Message-ID: <5cfc0a8e0911170135w35a1c08bw42c8f634260e921d@mail.gmail.com> To: Philipp Hancke Content-Type: multipart/alternative; boundary=00c09f76b5dff3c00004788dd9b0 Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 09:35:55 -0000 --00c09f76b5dff3c00004788dd9b0 Content-Type: text/plain; charset=UTF-8 On Tue, Nov 17, 2009 at 10:28 AM, Philipp Hancke wrote: > If stream:from is set, the servers knows the users jid before offering the > list of mechanisms and should not offer any weak mechanisms. Exactly this was my thinking. Dumb client, why are you selecting a mechanism that hasn't been advertised. ;) Sure if during usage of PLAIN or DIGEST-MD5 the server receives the username and decides this mechanism is too weak one could reply with a mechanism-too-weak error but the process with having to know stream:from is way cleaner. Cheers, Tobias -- Tobias Markmann http://ayena.de --00c09f76b5dff3c00004788dd9b0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Nov 17, 2009 at 10:28 AM, Philipp Hancke <fippo@mail.symlynx.= com> wrote:
If stream:from is set, the servers knows the users jid before offering the = list of mechanisms and should not offer any weak mechanisms.

Exactly this was my thinking. Dumb client, why are you s= electing a mechanism that hasn't been advertised. ;)
Sure if during usage of PLAIN or DIGEST-MD5 the server receives the usernam= e and decides this mechanism is too weak one could reply with a mechanism-t= oo-weak error but the process with having to know stream:from is way cleane= r.

Cheers,
Tobias

--
Tobias = Markmann
http://ayena.de
--00c09f76b5dff3c00004788dd9b0-- From dave@cridland.net Tue Nov 17 02:27:14 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5EF3D28C0EC for ; Tue, 17 Nov 2009 02:27:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.399 X-Spam-Level: X-Spam-Status: No, score=-1.399 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_64=0.6, J_CHICKENPOX_66=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VjzrgIAZE3NY for ; Tue, 17 Nov 2009 02:27:13 -0800 (PST) Received: from peirce.dave.cridland.net (peirce.dave.cridland.net [217.155.137.61]) by core3.amsl.com (Postfix) with ESMTP id 13AD028C216 for ; Tue, 17 Nov 2009 02:27:00 -0800 (PST) Received: from localhost (localhost.localdomain [127.0.0.1]) by peirce.dave.cridland.net (Postfix) with ESMTP id 385492F0002; Tue, 17 Nov 2009 10:26:55 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at peirce.dave.cridland.net Received: from peirce.dave.cridland.net ([127.0.0.1]) by localhost (peirce.dave.cridland.net [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tjt-og406zA4; Tue, 17 Nov 2009 10:26:54 +0000 (GMT) Received: from invsysm1 (shiny.isode.com [62.3.217.250]) by peirce.dave.cridland.net (Postfix) with ESMTPA id 2DE352F0001; Tue, 17 Nov 2009 10:26:54 +0000 (GMT) References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <5cfc0a8e0911170135w35a1c08bw42c8f634260e921d@mail.gmail.com> In-Reply-To: <5cfc0a8e0911170135w35a1c08bw42c8f634260e921d@mail.gmail.com> MIME-Version: 1.0 Message-Id: <2340.1258453614.076176@invsysm1> Date: Tue, 17 Nov 2009 10:26:54 +0000 From: Dave Cridland To: Tobias Markmann Content-Type: text/plain; delsp="yes"; charset="us-ascii"; format="flowed" Cc: XMPP Working Group Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 10:27:14 -0000 On Tue Nov 17 09:35:29 2009, Tobias Markmann wrote: > On Tue, Nov 17, 2009 at 10:28 AM, Philipp Hancke > wrote: > > > If stream:from is set, the servers knows the users jid before > offering the > > list of mechanisms and should not offer any weak mechanisms. > > > Exactly this was my thinking. Dumb client, why are you selecting a > mechanism > that hasn't been advertised. ;) > Sure if during usage of PLAIN or DIGEST-MD5 the server receives the > username > and decides this mechanism is too weak one could reply with a > mechanism-too-weak error but the process with having to know > stream:from is > way cleaner. It could also be that the client has used DIGEST-MD5, but failed to negotiate a suitable security layer, or something. There's enough sub-option negotiation in deployed mechanisms that I can't see your reasoning for arguing against this so hard. After all, nobody's forcing you to do this. One minor point, though - the stream:stream's from attribute (not, of course, stream:from) isn't typically set by clients. I don't think RFC 3920 (and bis) suggest that it should be, either. Dave. -- Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/ - http://dave.cridland.net/ Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade From stpeter@stpeter.im Tue Nov 17 11:41:20 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ED38228C158 for ; Tue, 17 Nov 2009 11:41:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W7QMNM-7zjbT for ; Tue, 17 Nov 2009 11:41:20 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 010133A69CD for ; Tue, 17 Nov 2009 11:41:20 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 3A24C40D16; Tue, 17 Nov 2009 12:41:18 -0700 (MST) Message-ID: <4B02FC5D.5080305@stpeter.im> Date: Tue, 17 Nov 2009 12:41:17 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Alexey Melnikov References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> In-Reply-To: <4B025638.6090101@isode.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms050804030604060700000904" Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 19:41:21 -0000 This is a cryptographically signed message in MIME format. --------------ms050804030604060700000904 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/17/09 12:52 AM, Alexey Melnikov wrote: > Tobias Markmann wrote: >> Hi, > Hi Tobias, >> According to 3920bis-03 there are this two errors defined: >> mechanism-invalid [1] and mechanism-too-weak [2]. I think >> mechanism-invalid would be sufficient. >> >> SASL usually works the way that first the server advertises what it >> supports and then the client gets to choose. A client selecting a >> mechanism which hasn't advertised is quite broken in my opinion. > I agree. > But there might be another use case for the error code - selection of a > mechanism which is considered too weak for a particular user. In such > case the server would advertise the mechanism to everybody, but return > the error for some users. That was the intent for mechanism-too-weak. For example, if you want to authenticate as an administrative user then you might not be allowed to use a weaker mechanism (even if the server offered it to you because it didn't know who you were at that point). Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms050804030604060700000904 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzE5NDExN1owIwYJKoZIhvcNAQkEMRYEFLzsp1hgkW2wPW1poCYk 1T3Vz8ZSMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEATjxZkQ6q5omwPfvPFWbqL7U9lp6lsZuAPjTy2fE8 Byrhy2KROmhzH1DIiup7k2q7cqrq+K5fT1sJU1AHkzXE+Y892ZlcJXiGrYe1qVW5OazfLkcR 6oMuVpn4EUxeTElyxIQ1+0ZkqfDaq3lj+MSrppYE//Hrh/oLwxqgzkqUYLZomuLlk+/3v+fH WsqYLQTZPDx7jnRm3VKrPs31hRPQCyvqvQgBPqEXzTyRdJqCGDl9RTRayaM+ouIhMe0Sibv/ On1M1Fm5kZB74hIZIM0zP33rz78phiT5xnaqT1U38kILe8KGIJyBTU/k/CiWfCkSm7Ypqr4b DcHpDZdZThRklQAAAAAAAA== --------------ms050804030604060700000904-- From stpeter@stpeter.im Tue Nov 17 13:26:36 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BA35C3A68B6 for ; Tue, 17 Nov 2009 13:26:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q1QwCgATURk9 for ; Tue, 17 Nov 2009 13:26:36 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id F1DD83A683E for ; Tue, 17 Nov 2009 13:26:35 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 5F73D40D16 for ; Tue, 17 Nov 2009 14:26:34 -0700 (MST) Message-ID: <4B031509.5000305@stpeter.im> Date: Tue, 17 Nov 2009 14:26:33 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms080704000504070603090403" Subject: [xmpp] 3921bis: ack of subscription request X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 21:26:36 -0000 This is a cryptographically signed message in MIME format. --------------ms080704000504070603090403 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit 3921bis says: As a way of acknowledging receipt of the presence subscription request, the contact's server MAY send a presence stanza of type "unavailable" from the bare JID of the contact to the bare JID of the user. Do we have consensus on adding this to the spec? /psa --------------ms080704000504070603090403 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzIxMjYzM1owIwYJKoZIhvcNAQkEMRYEFH1nYn5VDbZ/gf1FiYbT bM7O9aK+MF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAly4MQTZrY6FWE5VTCQbkGlMeEdRmEV7IQ2EPMfbw 1KMZYIG8JiSPg1mfE9F590dTyP4O2wuD3FQDaXRmhbSYxVZgoZWBSAcj2xAQTxaXTIr66Eie 9/Ay/V9RWGRM/VaTUXcQUbhr3s1aS5/r9i0BJ1W6hojbDmqhEfYeB8gvno/eKTMxjXGPujw9 1gOpnGhlx8XZXDkcZnTn0wsE5dMnsMsQhWfmllcES/62jSLEugo1NXtbFL6Psg1HQufumbKL XJwdbDIYJDpkHHlDZzlDry2r9xNlkngXXEpw0ffZb9/U8jSXjbG2ZcyS1+dwF10BAChqWiUl FXS+pPXwX1jXZAAAAAAAAA== --------------ms080704000504070603090403-- From Joe.Hildebrand@webex.com Tue Nov 17 13:33:39 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B5D7B3A68B6 for ; Tue, 17 Nov 2009 13:33:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uNaEb8MkJ7Vo for ; Tue, 17 Nov 2009 13:33:39 -0800 (PST) Received: from gw1.webex.com (gw1.webex.com [64.68.122.208]) by core3.amsl.com (Postfix) with SMTP id 0FE813A683E for ; Tue, 17 Nov 2009 13:33:39 -0800 (PST) Received: from SRV-EXSC03.webex.local ([192.168.252.197]) by gw1.webex.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 17 Nov 2009 13:33:37 -0800 Received: from 10.21.127.233 ([10.21.127.233]) by SRV-EXSC03.webex.local ([192.168.252.200]) with Microsoft Exchange Server HTTP-DAV ; Tue, 17 Nov 2009 21:32:44 +0000 User-Agent: Microsoft-Entourage/12.20.0.090605 Date: Tue, 17 Nov 2009 11:32:43 -1000 From: Joe Hildebrand To: Peter Saint-Andre , XMPP Message-ID: Thread-Topic: [xmpp] 3921bis: ack of subscription request Thread-Index: AcpnzX79HZm7yo+18EqjdODIJR4IFw== In-Reply-To: <4B031509.5000305@stpeter.im> IM-ID: xmpp:jhildebrand@corp.jabber.com Presence-ID: xmpp:jhildebrand@corp.jabber.com Jabber-ID: jhildebrand@corp.jabber.com Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 17 Nov 2009 21:33:37.0396 (UTC) FILETIME=[9F69FB40:01CA67CD] Subject: Re: [xmpp] 3921bis: ack of subscription request X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 21:33:39 -0000 (as individual) I assume this would go back to all of the resources of the subscribing user. There are a set of UI designers for whom the difference between "unknown" and "offline" is significant; can we put in a note for them that says that this unavailable reply does not imply anything about the actual presence state of the user until the subscription request is accepted? On 11/17/09 11:26 AM, "Peter Saint-Andre" wrote: > 3921bis says: > > As a way of acknowledging receipt of the presence subscription > request, the contact's server MAY send a presence stanza of > type "unavailable" from the bare JID of the contact to the bare > JID of the user. > > Do we have consensus on adding this to the spec? > > /psa > > > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp -- Joe Hildebrand From tmarkmann@googlemail.com Tue Nov 17 13:44:16 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DDCC83A68B6 for ; Tue, 17 Nov 2009 13:44:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.976 X-Spam-Level: X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JHFefGNrbJZ0 for ; Tue, 17 Nov 2009 13:44:16 -0800 (PST) Received: from gv-out-0910.google.com (gv-out-0910.google.com [216.239.58.188]) by core3.amsl.com (Postfix) with ESMTP id D21BC3A67F3 for ; Tue, 17 Nov 2009 13:44:15 -0800 (PST) Received: by gv-out-0910.google.com with SMTP id e6so153399gvc.15 for ; Tue, 17 Nov 2009 13:44:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=I0vYAM3ShjMSvad1jvX77cDfQTSpJTGkBiODQ71olsQ=; b=f1+GRa/qdXf9vvlJZ6y6F0GTHmPwfVLkZKNeOvt3pQFzAAuHu73DhpAc/VWkrVZsmQ Z6M1dJfSBdI/PVqBOefoP0grfAuIXypnOFBfABTCGVGfPiGKObycQl2XfaXOYDJBLRzi 9YnD8qluuR7kiOTmi6G3uGFmDBUwfOCrILEtE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=RJS8gMLaptK3ZOuwOysY8Tz4hkhp29Fjx2kBdmhBvL2ab/92ELaDEAzSiryX1dGAmJ dni4Sy6t9gGHQxKTFx5ddklCrpM5LtZJID5VYz0KdHLtcv3bSDaSRT9EiDDruZGFZEyo atwCSL6YmV4jrXwkpzkFaDTF2Ffyn5hmrHgMk= MIME-Version: 1.0 Received: by 10.213.0.216 with SMTP id 24mr976013ebc.55.1258494251304; Tue, 17 Nov 2009 13:44:11 -0800 (PST) In-Reply-To: <4B02FC5D.5080305@stpeter.im> References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> From: Tobias Markmann Date: Tue, 17 Nov 2009 22:43:51 +0100 Message-ID: <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> To: Peter Saint-Andre Content-Type: multipart/alternative; boundary=000e0ce03b6ccd08ef04789806e0 Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 21:44:17 -0000 --000e0ce03b6ccd08ef04789806e0 Content-Type: text/plain; charset=UTF-8 On Tue, Nov 17, 2009 at 8:41 PM, Peter Saint-Andre wrote: > That was the intent for mechanism-too-weak. For example, if you want to > authenticate as an administrative user then you might not be allowed to > use a weaker mechanism (even if the server offered it to you because it > didn't know who you were at that point). > I completely understand the use case. It just seems kind of stupid to select a mechanism which isn't advertised. Sure you can't do otherwise the way SASL has been designed since you don't know the username before advertising the supported mechanisms. Tobias -- Tobias Markmann http://ayena.de --000e0ce03b6ccd08ef04789806e0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Nov 17, 2009 at 8:41 PM, Peter Saint-Andre <stpeter@stpeter.im> wrote= :
That was the intent for mechanism-too-weak= . For example, if you want to
authenticate as an administrative user then you might not be allowed to
use a weaker mechanism (even if the server offered it to you because it
didn't know who you were at that point).

I = completely understand the use case. It just seems kind of stupid to select = a mechanism which isn't advertised. Sure you can't do otherwise the= way SASL has been designed since you don't know the username before ad= vertising the supported mechanisms.

Tobias

--
Tobias Markmann
http://ayena.de
--000e0ce03b6ccd08ef04789806e0-- From stpeter@stpeter.im Tue Nov 17 13:46:46 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AEE433A690E for ; Tue, 17 Nov 2009 13:46:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UfOqkEUpzHZe for ; Tue, 17 Nov 2009 13:46:45 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id AF8663A68E8 for ; Tue, 17 Nov 2009 13:46:45 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 1146340D16; Tue, 17 Nov 2009 14:46:43 -0700 (MST) Message-ID: <4B0319C3.7060804@stpeter.im> Date: Tue, 17 Nov 2009 14:46:43 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Tobias Markmann References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> In-Reply-To: <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms080905010301070003050101" Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 21:46:46 -0000 This is a cryptographically signed message in MIME format. --------------ms080905010301070003050101 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/17/09 2:43 PM, Tobias Markmann wrote: > On Tue, Nov 17, 2009 at 8:41 PM, Peter Saint-Andre > wrote: > > That was the intent for mechanism-too-weak. For example, if you want to > authenticate as an administrative user then you might not be allowed to > use a weaker mechanism (even if the server offered it to you because it > didn't know who you were at that point). > > > I completely understand the use case. It just seems kind of stupid to > select a mechanism which isn't advertised. Sure you can't do otherwise > the way SASL has been designed since you don't know the username before > advertising the supported mechanisms. No, you choose a mechanism (say, PLAIN) but the server doesn't allow you to authenticate as a higher class of user with that mechanism. Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms080905010301070003050101 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzIxNDY0M1owIwYJKoZIhvcNAQkEMRYEFNNsF+BVFk+g7bFHv8Zk ssYIvzcbMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAh9TD6x4Oshu5g14WyXkZfOQWrXs1GQCRETBLlx3Z Q2MZ/qWGRNAaEBClhWzXPAe8B0qmP5xzHrvtncazep78Y5hf82p2jnHnW6h/Scj+8qhBnBhJ 0Retv1SGI3UCdJrs2LcGo+pI7CJZ80R3OhdWyMnPfIe7sTHdPUPDQvQY4IWp4ZiXTRyiWkH+ 3UGEzOOXwKje3sWT0GgPTR3rxy8dpDjGpzrb3OD75pGzlfuiuXzRw78eqKGjQdb/YMy6eihZ L8Sp9C8SrfsAGVha1XeREUgJV0GP8DeLyL9IJQ8xa2+2f6hMb4jFoanCEcUqG39a8/IkOZ2u crCVwTf79VXOoQAAAAAAAA== --------------ms080905010301070003050101-- From tmarkmann@googlemail.com Tue Nov 17 13:53:59 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 821B73A68C2 for ; Tue, 17 Nov 2009 13:53:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.876 X-Spam-Level: X-Spam-Status: No, score=-1.876 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QFq7f7lHSsGw for ; Tue, 17 Nov 2009 13:53:58 -0800 (PST) Received: from ey-out-2122.google.com (ey-out-2122.google.com [74.125.78.27]) by core3.amsl.com (Postfix) with ESMTP id 609A43A6824 for ; Tue, 17 Nov 2009 13:53:58 -0800 (PST) Received: by ey-out-2122.google.com with SMTP id 9so1507479eyd.5 for ; Tue, 17 Nov 2009 13:53:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=qoNKPtC18tJY33IasWWDFXFxNHuimwYysaPTBYtdYqo=; b=EmSSqTLiNZJ9bZ/A3QWMDvYDNQCfpncp+wgQcZ0Do0SeEXo+Ytaorj6iReucZETONx 51RXdOpjfTaEiVVMQ9kSUiV3ZhIfNVGeJoqDqqpPsyBZm1DmEIwhswoELqoRsjo1P4qy aPOwgbQZKG8OxZALu04X+3C5bYFyrAJ+ujIFU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=A4unHsOsWWUmI3Gkb7klge6YS8ZtvtqQGDgEmJ+ZfWyEJMh/pfuZ1AjUY2f916yBjX YEyf77Bu3tEQ+NB9N0SzQX4L6FwOYv4iyQJKcHiAU6hmT7K71iV0NGLPy2Ez+DQYt2Td FhT44GxTsad0ZRQOJpvvqrGdoLbxAvX+nDdhI= MIME-Version: 1.0 Received: by 10.213.2.81 with SMTP id 17mr5543149ebi.45.1258494836291; Tue, 17 Nov 2009 13:53:56 -0800 (PST) In-Reply-To: <4B0319C3.7060804@stpeter.im> References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> <4B0319C3.7060804@stpeter.im> From: Tobias Markmann Date: Tue, 17 Nov 2009 22:53:36 +0100 Message-ID: <5cfc0a8e0911171353l6e22169ep39b30e8517fafd1b@mail.gmail.com> To: Peter Saint-Andre Content-Type: multipart/alternative; boundary=001517401564ab398004789829b7 Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 21:53:59 -0000 --001517401564ab398004789829b7 Content-Type: text/plain; charset=UTF-8 On Tue, Nov 17, 2009 at 10:46 PM, Peter Saint-Andre wrote: > No, you choose a mechanism (say, PLAIN) but the server doesn't allow you > to authenticate as a higher class of user with that mechanism. > Yeah. However protocol wise the cleaner way would be for the server to know the username before, look up the authentication profile for that user and send the supported mechanisms and thereby reducing the number of round trips. Tobias -- Tobias Markmann http://ayena.de --001517401564ab398004789829b7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Nov 17, 2009 at 10:46 PM, Peter Saint-Andre <<= a href=3D"mailto:stpeter@stpeter.im">stpeter@stpeter.im> wrot= e:
No, you choose a mechanism (say, PLAIN) but the server do= esn't allow you
to authenticate as a higher class of user with that mechanism.

Yeah. However protocol wise the cleaner way = would be for the server to know the username before, look up the authentica= tion profile for that user and send the supported mechanisms and thereby re= ducing the number of round trips.

Tobias

--
Tobias Markmann
http://ayena.de
--001517401564ab398004789829b7-- From stpeter@stpeter.im Tue Nov 17 13:57:07 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 856E03A6829 for ; Tue, 17 Nov 2009 13:57:07 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l2yIWJu2dYjY for ; Tue, 17 Nov 2009 13:57:06 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id ACDAC28B56A for ; Tue, 17 Nov 2009 13:56:42 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id E371540D16; Tue, 17 Nov 2009 14:56:40 -0700 (MST) Message-ID: <4B031C17.80804@stpeter.im> Date: Tue, 17 Nov 2009 14:56:39 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Tobias Markmann References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> <4B0319C3.7060804@stpeter.im> <5cfc0a8e0911171353l6e22169ep39b30e8517fafd1b@mail.gmail.com> In-Reply-To: <5cfc0a8e0911171353l6e22169ep39b30e8517fafd1b@mail.gmail.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms060106000108030302020900" Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 21:57:07 -0000 This is a cryptographically signed message in MIME format. --------------ms060106000108030302020900 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/17/09 2:53 PM, Tobias Markmann wrote: > On Tue, Nov 17, 2009 at 10:46 PM, Peter Saint-Andre > wrote: > > No, you choose a mechanism (say, PLAIN) but the server doesn't allow you > to authenticate as a higher class of user with that mechanism. > > > Yeah. However protocol wise the cleaner way would be for the server to > know the username before, look up the authentication profile for that > user and send the supported mechanisms and thereby reducing the number > of round trips. Sure. But reality is not always so clean. :) I doubt that anyone has ever seen this error on the wire, but it's defined just in case... /psa --------------ms060106000108030302020900 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzIxNTYzOVowIwYJKoZIhvcNAQkEMRYEFB0e+ixSDMKdMgYwwpiJ 8eo2pPxwMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAM0mqOouuOTSKYdp71MUrgqomxItKicj1sAP4CXBI NyqryiZHPGZlaQV82eSP7/+Hjj7CZepb/BRnoozxQrVjIxvAxczUMlOxmo+Slbgab5f62iJm Sv+gRjL3t0RESlxcVOckpnr/nIhoA6E8igUksb6/uoFmL2DUFUbEVHUyOri1stNpAWrLNUr5 s4BpuevnI9wfLtDPGH6n3oJ944KOQHKxCJbkRHConoetbOUWxeE9LIyyu9ATNyRvLgJZQcBP vdzdqIJFrc+EAj5XKjpHHgx84ZEG/WM00+QSJfEDTMT1rxm9VgTdgV7sWC/BUHfLkjVqd70V cx7Ey0WZ0KLSEwAAAAAAAA== --------------ms060106000108030302020900-- From tmarkmann@googlemail.com Tue Nov 17 14:02:13 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AE7CD3A690E for ; Tue, 17 Nov 2009 14:02:13 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.976 X-Spam-Level: X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wByZ9oHXAxtq for ; Tue, 17 Nov 2009 14:02:12 -0800 (PST) Received: from gv-out-0910.google.com (gv-out-0910.google.com [216.239.58.191]) by core3.amsl.com (Postfix) with ESMTP id 72C953A681A for ; Tue, 17 Nov 2009 14:02:12 -0800 (PST) Received: by gv-out-0910.google.com with SMTP id e6so159417gvc.15 for ; Tue, 17 Nov 2009 14:02:10 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=r4o3o5vSKPCIMrPhgiSXTBomZB467pIPP7FzZS+2JNo=; b=T+UFDroF+FhCuRoSUHafHCWCQ6z57tN5CZEwVwnAD8G46EcnK+aWdwzHTdWl4fooat i5YDJ8Y4+EVPCaq4ECmooAc4f1Ntq76bn3mrjjh7YkcJQVZ39gf8iUZHDycCtmqLoNpg IQbmoOnUdO5lC1L4w05Z4T2HlyW/8CFz8fQg0= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=c2y2hvKVDw5Lw1OurxAQU1TSPSrvsrlNLWL9IPUHD9t7iFuaWp5SwDdhKFOUcSy5/K /TaWEK+XLzv+VqzDvJPTIlO3GRwF04riv2w7dEUkHjNck4G4acGtBRB6kgIzurDqwK36 xoKy2ZeWyEjMifVN/V2XcebmUwhxuKe/Lse0c= MIME-Version: 1.0 Received: by 10.213.0.144 with SMTP id 16mr5705826ebb.37.1258495330273; Tue, 17 Nov 2009 14:02:10 -0800 (PST) In-Reply-To: <4B031C17.80804@stpeter.im> References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> <4B0319C3.7060804@stpeter.im> <5cfc0a8e0911171353l6e22169ep39b30e8517fafd1b@mail.gmail.com> <4B031C17.80804@stpeter.im> From: Tobias Markmann Date: Tue, 17 Nov 2009 23:01:50 +0100 Message-ID: <5cfc0a8e0911171401k34899711k9ce7a429675ff6de@mail.gmail.com> To: Peter Saint-Andre Content-Type: multipart/alternative; boundary=000e0cdf94481cc9a90478984756 Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 22:02:13 -0000 --000e0cdf94481cc9a90478984756 Content-Type: text/plain; charset=UTF-8 On Tue, Nov 17, 2009 at 10:56 PM, Peter Saint-Andre wrote: > Sure. But reality is not always so clean. :) I doubt that anyone has > ever seen this error on the wire, but it's defined just in case... > Well, you can always reckon on some strange Prosody dev that made it respond mechanism-too-weak if client choose ANONYMOUS but the server isn't set to support it. Tobias -- Tobias Markmann http://ayena.de --000e0cdf94481cc9a90478984756 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Nov 17, 2009 at 10:56 PM, Peter Saint-Andre <<= a href=3D"mailto:stpeter@stpeter.im">stpeter@stpeter.im> wrot= e:
Sure. But reality is not always so clean. = :) I doubt that anyone has
ever seen this error on the wire, but it's defined just in case...

Well, you can always reckon on some stra= nge = Prosody dev that made it resp= ond mechanism-too-weak if client choose ANONYMOUS but the server isn't = set to support it.

Tobias

--
Tobias Markmann
http://ayena.de
--000e0cdf94481cc9a90478984756-- From stpeter@stpeter.im Tue Nov 17 14:24:47 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B85C53A6A10 for ; Tue, 17 Nov 2009 14:24:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xx-sdApWQ2XZ for ; Tue, 17 Nov 2009 14:24:47 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id D96493A6B0E for ; Tue, 17 Nov 2009 14:24:46 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id B5A6A40D16; Tue, 17 Nov 2009 15:24:44 -0700 (MST) Message-ID: <4B0322AB.8070501@stpeter.im> Date: Tue, 17 Nov 2009 15:24:43 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Joe Hildebrand References: In-Reply-To: X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms000300070209010004040600" Cc: XMPP Subject: Re: [xmpp] 3921bis: ack of subscription request X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 22:24:47 -0000 This is a cryptographically signed message in MIME format. --------------ms000300070209010004040600 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I've added the following parenthetical remark: (the user's client MUST NOT assume that this ack provides presence information about the contact, since it comes from the contact's bare JID and is received before the subscription request has been approved) On 11/17/09 2:32 PM, Joe Hildebrand wrote: > (as individual) > > I assume this would go back to all of the resources of the subscribing user. > There are a set of UI designers for whom the difference between "unknown" > and "offline" is significant; can we put in a note for them that says that > this unavailable reply does not imply anything about the actual presence > state of the user until the subscription request is accepted? > > > On 11/17/09 11:26 AM, "Peter Saint-Andre" wrote: > >> 3921bis says: >> >> As a way of acknowledging receipt of the presence subscription >> request, the contact's server MAY send a presence stanza of >> type "unavailable" from the bare JID of the contact to the bare >> JID of the user. >> >> Do we have consensus on adding this to the spec? >> >> /psa >> >> >> _______________________________________________ >> xmpp mailing list >> xmpp@ietf.org >> https://www.ietf.org/mailman/listinfo/xmpp --------------ms000300070209010004040600 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzIyMjQ0M1owIwYJKoZIhvcNAQkEMRYEFEp/ueE/QXImd5V84Cy/ /NVXlwpHMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAO82rzpKuArPIjrFlWaS2ykTTt6rU19KudA7Fs9RE 6iEpJFiy7cudHn/JuUFMhAu6LWHBz/6g/Qe3YbuOWRqORpCCXzrVB8EhrSNc/Gw+RIjaze05 sayVqvBui3pExc9c8Fo1EIRZpzOmc/axBnuXnKHwXuuzNYv4di8G6v6cdsQofEAWCe4QQr98 /bu42lHgQ7BiPoWm5Zh60fGisTDGNJAAQQEK0ZHLxdURGm7VzIME5JAhIjuwGRaXLaTgvqsp sGYKf8lx1opkiswwvr5Sb1OSeiY0paWbffQhHz3WRw5HMuiKqpXd0+u1hAJzaEMmklkaDbEg Z8+tzCjLxKRv7QAAAAAAAA== --------------ms000300070209010004040600-- From stpeter@stpeter.im Tue Nov 17 14:35:27 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 061813A67B2 for ; Tue, 17 Nov 2009 14:35:27 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NS5G4qqPY8l1 for ; Tue, 17 Nov 2009 14:35:26 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 0B7733A6BD6 for ; Tue, 17 Nov 2009 14:35:26 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 53C6C40D16 for ; Tue, 17 Nov 2009 15:35:24 -0700 (MST) Message-ID: <4B03252A.5000409@stpeter.im> Date: Tue, 17 Nov 2009 15:35:22 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms000902070803080106070901" Subject: [xmpp] 3920bis: stream features X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 22:35:27 -0000 This is a cryptographically signed message in MIME format. --------------ms000902070803080106070901 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit At the WG meeting in Hiroshima, I mentioned two open issues regarding stream features: 1. Should we allow the receiving entity to resend stream features at any time during the life of the stream? 2. Should we allow the initiating entity to send stream features? The motivation here is that we might have long-lived streams (especially for server-to-server federation) and it's possible that a server admin might enable a feature while such a stream is live. Instead of forcing the parties to close the stream and start a new stream negotiation, it might be good to allow them to advertise and then negotiate only the newly-enabled feature. However, the desire to have this method needs to be balanced against complexity (perhaps it's really not a big deal to close the old stream and start a new one). Thoughts? Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms000902070803080106070901 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzIyMzUyMlowIwYJKoZIhvcNAQkEMRYEFC+/il/cxk7vlACvErvI V1rUbJsBMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAO2k05cllSCFiuE1Uohsd5fKdWOX43XbEZSyu9qOb /j75uhrKkB/hT/VZouffcKBJeg4Lw7QaeiC+mb+VeAHMQMI7BBOO3g/Ui6SlbX+deSeGwQr1 y7BU/cxv3SHmbTzumxvAn6ocFcmng6Of9MEfQLT9Sb2OLsOW4LymJ08V0fuR7c7JSuuhlege /QhDx3t7Fd2Z5KJ5NV4pYAjkOAazlcXM90kw9Ad8VgYlDfpgpNypFluP1PmukKiaFN02lvme m4cCw5F2QuA2PPGgVYVUF6GnjAVSCNrQ5PWaD5exIlJ5xBUvf2Eear07HgScg4TtDKMGVJdt DPq7KHsJta/rqgAAAAAAAA== --------------ms000902070803080106070901-- From stpeter@stpeter.im Tue Nov 17 14:42:25 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C6D5E3A6A05 for ; Tue, 17 Nov 2009 14:42:25 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ybyJNub0jF-m for ; Tue, 17 Nov 2009 14:42:25 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id EE6583A681A for ; Tue, 17 Nov 2009 14:42:24 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 1A3BF40D16 for ; Tue, 17 Nov 2009 15:42:23 -0700 (MST) Message-ID: <4B0326CE.9080501@stpeter.im> Date: Tue, 17 Nov 2009 15:42:22 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms050707010309010107010602" Subject: [xmpp] 3920bis: attribute certs X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 22:42:25 -0000 This is a cryptographically signed message in MIME format. --------------ms050707010309010107010602 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit At the WG meeting in Hiroshima, I think we had agreement to pull the attribute certificate profile out of 3920bis. That change will be reflected in 3920bis-04 (coming soon). /psa --------------ms050707010309010107010602 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExNzIyNDIyMlowIwYJKoZIhvcNAQkEMRYEFG8dcHCtCWjgqaDRpmDq DGlDx78oMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAjXKsAalcqlAucLpiMHNBbMGKH31uYIbOnL3hBJHK H918L/Af6zAPyVfevttw4oU1ommqG1NNQMLPfgEar5Lc6Pf39B0oaYIMtiP8rGhd4zrQemUi 5ovi0K6LbZfzcA0t4mFZycOF1ZlMbfvZ5wzIo7O89rYgGCcvfJcOJUH8VSFBJjH1WIbU87R1 8mheGo4QyO95d0x0ffbtjveFvIFiQwsfzyH2X6+AHeqsPMldnY0apLDUGt8XbAFS4KQNDGCI cW7YpkCcIwtUHyLSs7gNCofM+xcD0+llNdmPerQvgv5ilkBjLHXpi9obDvGNN/hWuiiT2dAh 04VJKaDCjfA6KwAAAAAAAA== --------------ms050707010309010107010602-- From mwild1@gmail.com Tue Nov 17 14:53:52 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 346F93A6A28 for ; Tue, 17 Nov 2009 14:53:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1CT6qGtzEs+a for ; Tue, 17 Nov 2009 14:53:51 -0800 (PST) Received: from mail-bw0-f223.google.com (mail-bw0-f223.google.com [209.85.218.223]) by core3.amsl.com (Postfix) with ESMTP id 415B33A67F4 for ; Tue, 17 Nov 2009 14:53:51 -0800 (PST) Received: by bwz23 with SMTP id 23so584346bwz.29 for ; Tue, 17 Nov 2009 14:53:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=wjJVjdrH4YK7Xq9cXK6bTdQbcXSL7uoYHPop/bpEVhA=; b=wKdLeRrlfD4QahHrzPZ8LxCd3gOcjhJYbWmIzeNMTOKv/XTTnyNbA+mMcfHEnQ9pku JxMZQuUOfiwqe9Jz9Csc+kiZJg4Manmhnh+cR9liLNccRyDERiCQkvcEhaH9j1wuS/Ys HrgG6qBsZ0lJlKMwDCM5Fq1sgXg8nGQkkxFmI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=U4E5TgxBuSLOstKfTjFPDMP0jAdGjp9AG23QoFAqTdyTLcSCQw5sqSioECjubeJJUH fYeNZ8hVNLdB7hEyMh8OEPZZIHiDFNwWbPv8ZQw4MGV9XyRrlksuj+xusJw4AM7IL8RJ aZq/Yb4iZIHXxdx0oMWpWkRmplyq9tFDah2XI= MIME-Version: 1.0 Received: by 10.103.84.32 with SMTP id m32mr5766mul.33.1258498426277; Tue, 17 Nov 2009 14:53:46 -0800 (PST) In-Reply-To: <5cfc0a8e0911171401k34899711k9ce7a429675ff6de@mail.gmail.com> References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> <4B0319C3.7060804@stpeter.im> <5cfc0a8e0911171353l6e22169ep39b30e8517fafd1b@mail.gmail.com> <4B031C17.80804@stpeter.im> <5cfc0a8e0911171401k34899711k9ce7a429675ff6de@mail.gmail.com> From: Matthew Wild Date: Tue, 17 Nov 2009 22:53:26 +0000 Message-ID: <4db9cacb0911171453g1b78e3dbi85893971f381b2@mail.gmail.com> To: Tobias Markmann Content-Type: text/plain; charset=ISO-8859-1 Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 22:53:52 -0000 2009/11/17 Tobias Markmann : > On Tue, Nov 17, 2009 at 10:56 PM, Peter Saint-Andre > wrote: >> >> Sure. But reality is not always so clean. :) I doubt that anyone has >> ever seen this error on the wire, but it's defined just in case... > > Well, you can always reckon on some strange Prosody dev that made it respond > mechanism-too-weak if client choose ANONYMOUS but the server isn't set to > support it. This strange Prosody dev (not the one that added the error) fails to understand the problem with this response, it being more specific than "invalid-mechanism". You're making a mountain out of a molehill, over an error that will never appear to a "correct" client. Hence I don't particularly care whether it gets changed in Prosody - patches welcome :) Matthew From tmarkmann@googlemail.com Tue Nov 17 14:58:33 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E06E93A6A29 for ; Tue, 17 Nov 2009 14:58:33 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.976 X-Spam-Level: X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1hoSwrGCPJB3 for ; Tue, 17 Nov 2009 14:58:33 -0800 (PST) Received: from mail-bw0-f223.google.com (mail-bw0-f223.google.com [209.85.218.223]) by core3.amsl.com (Postfix) with ESMTP id 17D223A6A25 for ; Tue, 17 Nov 2009 14:58:28 -0800 (PST) Received: by bwz23 with SMTP id 23so588780bwz.29 for ; Tue, 17 Nov 2009 14:58:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=PHlbQ94ZTIpuo3nmg+mIBrLLFlSl4Pgx1vutLjUc7SM=; b=JBig9wth6kP8E9R7Zs8vZvEbLkhReFVyYN3I6Qxg4ADD4mGc1FKPOqjrEse2scPd8M /AaFcLW4L72ufbfBN1KiSlBfVg2OshTcoSv1cOCE0BUlri/9JtfA83WkCt/D5HLc3FCe iso/sthBZwvGGwuRg7W7RlJFSzfFaAt93Qmqo= DomainKey-Signature: a=rsa-sha1; c=nofws; d=googlemail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=ti8YsQ7mmIyP73vyEe2WMCH5uYBnTgYup57InrAdCmtiwniN3dXwa5XG8eM0UA2Clb 638JAex2F6YON028/eFxPSZ83ByZGklUrneXBeYYQSvwBPJ975AByX+N2icSDRVnSAFk +9DQsVSR6jBnuBowPy3EuZsv2+DbD4lCHlPtU= MIME-Version: 1.0 Received: by 10.213.2.81 with SMTP id 17mr5575238ebi.45.1258498704112; Tue, 17 Nov 2009 14:58:24 -0800 (PST) In-Reply-To: <4db9cacb0911171453g1b78e3dbi85893971f381b2@mail.gmail.com> References: <5cfc0a8e0911161126ha0d3f1eobfb8216f929a8fab@mail.gmail.com> <4B025638.6090101@isode.com> <4B02FC5D.5080305@stpeter.im> <5cfc0a8e0911171343o58d0679eg7a6bf4c4dbc976c1@mail.gmail.com> <4B0319C3.7060804@stpeter.im> <5cfc0a8e0911171353l6e22169ep39b30e8517fafd1b@mail.gmail.com> <4B031C17.80804@stpeter.im> <5cfc0a8e0911171401k34899711k9ce7a429675ff6de@mail.gmail.com> <4db9cacb0911171453g1b78e3dbi85893971f381b2@mail.gmail.com> From: Tobias Markmann Date: Tue, 17 Nov 2009 23:58:04 +0100 Message-ID: <5cfc0a8e0911171458y3281d15ey5edfa9c27fef206e@mail.gmail.com> To: Matthew Wild Content-Type: multipart/alternative; boundary=001517401564357dfc04789910a7 Cc: xmpp@ietf.org Subject: Re: [xmpp] SASL errors in 3920bis-03 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 17 Nov 2009 22:58:34 -0000 --001517401564357dfc04789910a7 Content-Type: text/plain; charset=UTF-8 On Tue, Nov 17, 2009 at 11:53 PM, Matthew Wild wrote: > This strange Prosody dev (not the one that added the error) fails to > understand the problem with this response, it being more specific than > "invalid-mechanism". You're making a mountain out of a molehill, over > an error that will never appear to a "correct" client. Hence I don't > particularly care whether it gets changed in Prosody - patches welcome > :) > I was just wondering about the error, that's all. It just felt wrong. Though due to SASL's restrictions we seem to /need/ that error. I'm thinking more of it like making a molehill out of an earth crumb. ;) At least the questions I had have been answered in this thread. Thanks. -- Tobias Markmann http://ayena.de --001517401564357dfc04789910a7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Tue, Nov 17, 2009 at 11:53 PM, Matthew Wild <mwild1@gmail.com> wrote:
This strange Prosody dev (not the one that= added the error) fails to
understand the problem with this response, it being more specific than
"invalid-mechanism". You're making a mountain out of a molehi= ll, over
an error that will never appear to a "correct" client. Hence I do= n't
particularly care whether it gets changed in Prosody - patches welcome
:)

I was just wondering about the error, that&#= 39;s all. It just felt wrong. Though due to SASL's restrictions we seem= to /need/ that error. I'm thinking more of it like making a molehill o= ut of an earth crumb. ;)

At least the questions I had have been answered in this thre= ad. Thanks.

--
Tobias Markmann
http://ayena.de
--001517401564357dfc04789910a7-- From root@core3.amsl.com Tue Nov 17 17:15:03 2009 Return-Path: X-Original-To: xmpp@ietf.org Delivered-To: xmpp@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 99A563A6832; Tue, 17 Nov 2009 17:15:03 -0800 (PST) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20091118011503.99A563A6832@core3.amsl.com> Date: Tue, 17 Nov 2009 17:15:03 -0800 (PST) Cc: xmpp@ietf.org Subject: [xmpp] I-D Action:draft-ietf-xmpp-3920bis-04.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Nov 2009 01:15:03 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Extensible Messaging and Presence Protocol Working Group of the IETF. Title : Extensible Messaging and Presence Protocol (XMPP): Core Author(s) : P. Saint-Andre Filename : draft-ietf-xmpp-3920bis-04.txt Pages : 179 Date : 2009-11-17 This document defines the core features of the Extensible Messaging and Presence Protocol (XMPP), a technology for streaming Extensible Markup Language (XML) elements for the purpose of exchanging structured information in close to real time between any two or more network-aware entities. XMPP provides a generalized, extensible framework for incrementally exchanging XML data, upon which a variety of applications can be built. The framework includes methods for stream setup and teardown, channel encryption, authentication of a client to a server and of one server to another server, and primitives for push-style messages, publication of network availability information ("presence"), and request-response interactions. This document also specifies the format for XMPP addresses, which are fully internationalizable. This document obsoletes RFC 3920. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-xmpp-3920bis-04.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-xmpp-3920bis-04.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-11-17170301.I-D@ietf.org> --NextPart-- From root@core3.amsl.com Tue Nov 17 17:15:03 2009 Return-Path: X-Original-To: xmpp@ietf.org Delivered-To: xmpp@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id B15083A687D; Tue, 17 Nov 2009 17:15:03 -0800 (PST) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20091118011503.B15083A687D@core3.amsl.com> Date: Tue, 17 Nov 2009 17:15:03 -0800 (PST) Cc: xmpp@ietf.org Subject: [xmpp] I-D Action:draft-ietf-xmpp-3921bis-03.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Nov 2009 01:15:04 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Extensible Messaging and Presence Protocol Working Group of the IETF. Title : Extensible Messaging and Presence Protocol (XMPP): Instant Messaging and Presence Author(s) : P. Saint-Andre Filename : draft-ietf-xmpp-3921bis-03.txt Pages : 105 Date : 2009-11-17 This document defines extensions to core features of the Extensible Messaging and Presence Protocol (XMPP) that provide basic instant messaging (IM) and presence functionality in conformance with RFC 2779. This document obsoletes RFC 3921. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-xmpp-3921bis-03.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-xmpp-3921bis-03.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-11-17170311.I-D@ietf.org> --NextPart-- From stpeter@stpeter.im Tue Nov 17 17:20:21 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D275A3A685E for ; Tue, 17 Nov 2009 17:20:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CzDM7viSYxeN for ; Tue, 17 Nov 2009 17:20:21 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id DF96B3A6765 for ; Tue, 17 Nov 2009 17:20:20 -0800 (PST) Received: from squire.local (ip-216-17-182-30.rev.frii.com [216.17.182.30]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id C134E40D16 for ; Tue, 17 Nov 2009 18:20:18 -0700 (MST) Message-ID: <4B034BD1.6070606@stpeter.im> Date: Tue, 17 Nov 2009 18:20:17 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070206080603090509070206" Subject: [xmpp] updated bis drafts X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Nov 2009 01:20:21 -0000 This is a cryptographically signed message in MIME format. --------------ms070206080603090509070206 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit I've submitted 3920bis-04 and 3921bis-03, incorporating all feedback provided to date. Diffs from the prior versions are here: http://tools.ietf.org/rfcdiff?url2=draft-ietf-xmpp-3920bis-03.txt http://tools.ietf.org/rfcdiff?url2=draft-ietf-xmpp-3921bis-02.txt Aside from the few small issues I posted about earlier today and the huge problem of internationalized addresses, I think there are no remaining open issues on these I-Ds. Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms070206080603090509070206 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExODAxMjAxN1owIwYJKoZIhvcNAQkEMRYEFIITd4iWInyQVdNKIQFY L9jKuAaBMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAFhkhiDzu69ck0zYBfKhj/ILgZfv9UwM53HaKCLwm MYEhgllU+KEBQldkvKsT4b5zblr5Yo+Uth2qkrxmkaLBNI6gn/4cRNrkhaNPgR1PEXCAPaYA sWjG3AsMDi9DPu/4mbVCNLvjVCCx+GGPZPYxA5GJvpMLKsR+g9ovme7BXMejiCm0Fw64Vbqu JCa40BPuBEQjf/jXpmbPx7zprcsnUQsydI6MFYVCLYoG9kARvqDc6RuaGnQLAaqrVaPLic4q DCOTlYPVh8BvDHWacnqa42nHp33wJ5Yb/bZZELWAf0fMRVR8jWTvOovRG+wr55vh0YTiXh/B iHgJYaiaZPAX6AAAAAAAAA== --------------ms070206080603090509070206-- From stpeter@stpeter.im Tue Nov 17 17:23:41 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A0E763A6880 for ; Tue, 17 Nov 2009 17:23:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bItEt-pG1rzf for ; Tue, 17 Nov 2009 17:23:41 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id D9CB03A6811 for ; Tue, 17 Nov 2009 17:23:40 -0800 (PST) Received: from squire.local (ip-216-17-182-30.rev.frii.com [216.17.182.30]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 0D89040D16 for ; Tue, 17 Nov 2009 18:23:38 -0700 (MST) Message-ID: <4B034C99.7030208@stpeter.im> Date: Tue, 17 Nov 2009 18:23:37 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP References: <4B034BD1.6070606@stpeter.im> In-Reply-To: <4B034BD1.6070606@stpeter.im> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070508090808040308080002" Subject: Re: [xmpp] updated bis drafts X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 18 Nov 2009 01:23:41 -0000 This is a cryptographically signed message in MIME format. --------------ms070508090808040308080002 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/17/09 6:20 PM, Peter Saint-Andre wrote: > http://tools.ietf.org/rfcdiff?url2=draft-ietf-xmpp-3920bis-03.txt > > http://tools.ietf.org/rfcdiff?url2=draft-ietf-xmpp-3921bis-02.txt Oops, those are wrong because the HTML versions (and diffs) have not yet appeared at tools.ietf.org. Patience... /psa --------------ms070508090808040308080002 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTExODAxMjMzN1owIwYJKoZIhvcNAQkEMRYEFE+eTmOJBf8uWTxIwnvD z2OQbdZpMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAJuu7MzFohRRtsqfxS9rEs9cfbi9+q4DE9RnsfpH/ kXn2bfgdN794AM9uarLTHEvDKfWEyCkX7Hn43eJA3hbM2uFcNYatHajwaihkcUS98UH014Rz KT5qnFyILS65y3E+J5d/zGfJMX0NPVegVRjsrTgOyYg9rroqUrnmiTDJtb8NUMa3kQakqbSw Z2L7a1HcNxb5MhfGS+prFrd33zD+49uJi2szvR+b2R4U8kGXXYyTg0nB8VBzszQ8Ez4e1tFd E4BHnrmgrvvl8Scfv7Uhn7EInv3LbW3SafmmKp2zKaqflfEzP5DLWQaS0f/H9eIkQ8DZXrVA wefV4jegmyPR6wAAAAAAAA== --------------ms070508090808040308080002-- From bernard.aboba@gmail.com Sat Nov 21 19:58:14 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A75C83A677D for ; Sat, 21 Nov 2009 19:58:14 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xTu5PhQg7xL7 for ; Sat, 21 Nov 2009 19:58:13 -0800 (PST) Received: from mail-px0-f171.google.com (mail-px0-f171.google.com [209.85.216.171]) by core3.amsl.com (Postfix) with ESMTP id 506D73A67F6 for ; Sat, 21 Nov 2009 19:58:13 -0800 (PST) Received: by pxi1 with SMTP id 1so3188832pxi.32 for ; Sat, 21 Nov 2009 19:58:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :from:date:message-id:subject:to:cc:content-type; bh=fOEtF+mnOV4/xXGcraAmiXrXhkGUJegp8RsEqxyYIfM=; b=ChbrbX0SvGIQgY3yKUNVuKmhQUY/I137FeiBxyPVFcwZSsKMMP6pEBFDwoIc4TFyDA mOB2GL40KZ2vqBn3GpEI016RUN2pgRq7e9iw5LuqdAF4EpbMWSbXJPVD7p3CY+XT0MmP T723PTrVn+IRmsLp8cr/AiMjnr/za/TiE3xsI= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; b=HU5UWQ3JpFbMrS2IuWbnY8p4Vpx2iOkDKyfJifs6tgTIfmEU2nDgssfeZ6HA+4YoL1 CZbWjQaNXxMAB5MuD6Ph4UL2ohcoqHktag7Yq1sIXmc5prb3rtNaC8y/DTSHrO0IYDRy PmziJL9l/8FNf4qzaKcAMJTdltNEvh13NIgZg= MIME-Version: 1.0 Received: by 10.142.247.42 with SMTP id u42mr369618wfh.160.1258862287691; Sat, 21 Nov 2009 19:58:07 -0800 (PST) In-Reply-To: <4AE89778.2030806@ieca.com> References: <60c552b80910281112u76bd45f1h572c73df0c43914a@mail.gmail.com> <4AE89778.2030806@ieca.com> From: Bernard Aboba Date: Sat, 21 Nov 2009 19:57:47 -0800 Message-ID: <223709240911211957w3eca8422l4c1f2ada94e3b503@mail.gmail.com> To: Sean Turner Content-Type: multipart/alternative; boundary=00504502cc357aa02e0478edb70b Cc: xmpp@ietf.org Subject: Re: [xmpp] draft-hildebrand-dna-00 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Nov 2009 03:58:14 -0000 --00504502cc357aa02e0478edb70b Content-Type: text/plain; charset=ISO-8859-1 I share these concerns. Attribute certificates are very rarely implemented, and as a result if DNA is required for server-server this is likely to break interoperability with many existing server implementations. Given the lack of implementation experience, any DNA documents should be Experimental at best. On Wed, Oct 28, 2009 at 11:11 AM, Sean Turner wrote: > Dirk Balfanz wrote: > >> Hi guys, >> I wanted to give some feedback on draft-hildebrand-dna-00. I just joined >> the mailing list, so I probably missed a bunch of the discussion regarding >> this topic. I'm new to XMPP, but have been helping out the Wave folks at >> Google with some crypto/PKI bits. >> > > The discussion on the list has actually been pretty minimal. Technically, > it's not even a working group document. > > > My biggest question is why you're tangling up this spec with Attribute >> Certificates. I've never seen an RFC 3281-style AC in the wild, and hadn't >> heard of draft-ietf-pkix-3281update until I read this spec. Is 3281update >> real? Are there parsers out there that understand this stuff? It makes sense >> to stand on the shoulders, so to speak, of other specs if there is >> wide-spread adoption out there and code that can process these things, but >> you don't want to depend on specs that nobody is using - it just complicates >> things. >> > > I'm not sure what you mean by real? That ID fixes some errata and some > minor bugs, so it's not a big update. It's in the RFC editor's queue. The > document it was pinned on just got approved. It ought to be published soon. > > There are some code bits from bouncy castle, though I have to admit I > haven't used them. I'm sure there are others. > > > Ok, now for more detailed, turn-by-turn comments: >> >> - it says "The issuer's certificate MUST NOT have a basicConstraints >> extension with the cA BOOLEAN set to TRUE." Why? >> > > The statement is for compliance with RFC 3281/3281bis section 4.5. It > says: "The AC issuer's PKC MUST conform to [PKIXPROF], and the keyUsage > extension in the PKC MUST NOT explicitly indicate that the AC issuer's > public key cannot be used to validate a digital signature. In order to > avoid confusion regarding serial numbers and revocations, an AC issuer MUST > NOT also be a PKC Issuer. That is, an AC issuer cannot be a CA as well. > So, the AC issuer's PKC MUST NOT have a basicConstraints extension with the > cA BOOLEAN set to TRUE." > > > - The holder field MUST be the baseCertificateID. This seems to mean that >> it points to a issuer/serial number in some other PKC. Hows does the >> validating entity get hold of that PKC? How did the issuer of the AC know >> what to put there? >> > > The AC issuer will include their name in the issuer field (taken from their > PKC's subject field) and the issuer's serial # (taken from their PKC's > serial number field). Then the path for the AC would be included along with > the AC (see Section 5.5). I proposed a "certs-only" message. It would > include one attribute certificate and any public key certificates necessary > to validate them. "certs-only" message have been around a while and are > most recently documented in draft-ietf-smime-3851bis-11. > > > - http://www.ietf.org/id/draft-ietf-pkix-3281update-05.txt says >> "Conforming implementations MUST NOT use the x400Address, ediPartyName, or >> registeredID options [wherever the spec asks for a GeneralName]" Your spec >> says to use registeredId, so you seem to be advocating a >> non-3281update-compliant AC. >> > > That's my bad. We wouldn't want to be non-compliant. Joe suggested just > using OIDs for id-xmpp and another one for id-xmpp-client/id-xmpp-server so > I stuck it in there. If we can't use registerdID, then we need to pick > another one or define an other-name. I guess I lean towards a new > other-name. Thoughts? > > > - For encoding the AC, issuer cert and potential intermediate certs, >> you're depending on yet another RFC ( >> http://tools.ietf.org/html/draft-ietf-smime-3851bis-11) for encoding the >> cert chain, which seems like overkill. Why not just say that proof-type >> attribute-cert has sub-elements, like > xmlns='urn:ietf:params:xml:ns:dna' >> from='asserted.tld' >> type='urn:ietf:params:dna:proof:attribute-cert'> >> >> (base64 of AC) >> >> >> (base64 of issuer PKC) >> >> >> (base64 of intermediate PKC that issued issuer PKC) >> >> >> > > We could do that, but it's not like what we picked is new. certs-only has > been around since before '99 (see RFC 2633). I guess I don't really have a > strong opinion one way or another. If we're not going to use PKCS#7 should > we use from XMLDSig? > > > What do you guys think? You probably discussed all these things to death >> and i'm just late to the party... >> > > Cheers, > spt > > Dirk. >> >> >> ------------------------------------------------------------------------ >> >> >> _______________________________________________ >> xmpp mailing list >> xmpp@ietf.org >> https://www.ietf.org/mailman/listinfo/xmpp >> > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp > --00504502cc357aa02e0478edb70b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable I share these concerns.=A0 Attribute certificates are very rarely implement= ed, and as a result if DNA is required for server-server this is likely to = break interoperability with many existing server implementations.

Given the lack of implementation experience, any DNA documents should be Ex= perimental at best.

On Wed, Oct 28, 2009= at 11:11 AM, Sean Turner <turners@ieca.com> wrote:
Dirk Balfanz wrote:
Hi guys,
I wanted to give some feedback on draft-hildebrand-dna-00. I just joined th= e mailing list, so I probably missed a bunch of the discussion regarding th= is topic. I'm new to XMPP, but have been helping out the Wave folks at = Google with some crypto/PKI bits.

The discussion on the list has actually been pretty minimal. Technically, i= t's not even a working group document.


My biggest question is why you're tangling up this spec with Attribute = Certificates. I've never seen an RFC 3281-style AC in the wild, and had= n't heard of draft-ietf-pkix-3281update until I read this spec. Is 3281= update real? Are there parsers out there that understand this stuff? It mak= es sense to stand on the shoulders, so to speak, of other specs if there is= wide-spread adoption out there and code that can process these things, but= you don't want to depend on specs that nobody is using - it just compl= icates things.

I'm not sure what you mean by real? =A0That ID fixes some errata and so= me minor bugs, so it's not a big update. =A0It's in the RFC editor&= #39;s queue. The document it was pinned on just got approved. =A0It ought t= o be published soon.

There are some code bits from bouncy castle, though I have to admit I haven= 't used them. =A0I'm sure there are others.


Ok, now for more detailed, turn-by-turn comments:

- it says "The issuer's certificate MUST NOT have a basicConstrain= ts extension with the cA BOOLEAN set to TRUE." Why?

The statement is for compliance with RFC 3281/3281bis section 4.5. =A0It sa= ys: "The AC issuer's PKC MUST conform to [PKIXPROF], and the keyUs= age extension in the PKC MUST NOT explicitly indicate that the AC issuer= 9;s public key cannot be used to validate a digital signature. =A0In order = to avoid confusion regarding serial numbers and revocations, an AC issuer M= UST NOT also be a PKC Issuer. =A0That is, an AC issuer cannot be a CA as we= ll. =A0So, the AC issuer's PKC MUST NOT have a basicConstraints extensi= on with the cA BOOLEAN set to TRUE."


- The holder field MUST be the baseCertificateID. This seems to mean that i= t points to a issuer/serial number in some other PKC. Hows does the validat= ing entity get hold of that PKC? How did the issuer of the AC know what to = put there?

The AC issuer will include their name in the issuer field (taken from their= PKC's subject field) and the issuer's serial # (taken from their P= KC's serial number field). =A0Then the path for the AC would be include= d along with the AC (see Section 5.5). =A0I proposed a "certs-only&quo= t; message. =A0It would include one attribute certificate and any public ke= y certificates necessary to validate them. =A0"certs-only" messag= e have been around a while and are most recently documented in draft-ietf-s= mime-3851bis-11.


- http://www.ietf.org/id/draft-ietf-pkix-3281update-05.txt = says =A0"Conforming implementations MUST NOT use the x400Address, ediP= artyName, or registeredID options [wherever the spec asks for a GeneralName= ]" =A0Your spec says to use registeredId, so you seem to be advocating= a non-3281update-compliant AC.

That's my bad. =A0We wouldn't want to be non-compliant. =A0Joe sugg= ested just using OIDs for id-xmpp and another one for id-xmpp-client/id-xmp= p-server so I stuck it in there. =A0If we can't use registerdID, then w= e need to pick another one or define an other-name. I guess I lean towards = a new other-name. =A0Thoughts?


- For encoding the AC, issuer cert and potential intermediate certs, you= 9;re depending on yet another RFC (http://tools.ietf.org/html/dra= ft-ietf-smime-3851bis-11) for encoding the cert chain, which seems like= overkill. Why not just say that proof-type attribute-cert has sub-elements= , like =A0 <proof xmlns=3D'urn:ietf:params:xml:ns:dna'
=A0 =A0 =A0 =A0 =A0from=3D'asserted.tld'
=A0 =A0 =A0 =A0 =A0type=3D'urn:ietf:params:dna:proof:attribute-cert= 9;>
=A0 =A0 <ac>
=A0 =A0 =A0 (base64 of AC)
=A0 =A0 </ac>
=A0 =A0 <pkc>
=A0 =A0 =A0 (base64 of issuer PKC)
=A0 =A0 </pkc>
=A0 =A0 <pkc>
=A0 =A0 =A0 (base64 of intermediate PKC that issued issuer PKC)
=A0 =A0 </pkc>
=A0 </proof>

We could do that, but it's not like what we picked is new. =A0certs-onl= y has been around since before '99 (see RFC 2633). =A0I guess I don'= ;t really have a strong opinion one way or another. =A0If we're not goi= ng to use PKCS#7 should we use <X509Certificate> from XMLDSig?


What do you guys think? You probably discussed all these things to death an= d i'm just late to the party...

Cheers,
spt

Dirk.


------------------------------------------------------------------------

_______________________________________________
xmpp mailing list
xmpp@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/xmpp
_______________________________________________
xmpp mailing list
xmpp@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/xmpp

--00504502cc357aa02e0478edb70b-- From stpeter@stpeter.im Sun Nov 22 10:16:24 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7F2AF3A69EF for ; Sun, 22 Nov 2009 10:16:24 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.569 X-Spam-Level: X-Spam-Status: No, score=-2.569 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EvhHedAqMC2g for ; Sun, 22 Nov 2009 10:16:23 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 2642E3A69ED for ; Sun, 22 Nov 2009 10:16:23 -0800 (PST) Received: from squire.local (dsl-175-187.dynamic-dsl.frii.net [216.17.175.187]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 870BD40D09; Sun, 22 Nov 2009 11:16:18 -0700 (MST) Message-ID: <4B097FF1.5030907@stpeter.im> Date: Sun, 22 Nov 2009 11:16:17 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Bernard Aboba References: <60c552b80910281112u76bd45f1h572c73df0c43914a@mail.gmail.com> <4AE89778.2030806@ieca.com> <223709240911211957w3eca8422l4c1f2ada94e3b503@mail.gmail.com> In-Reply-To: <223709240911211957w3eca8422l4c1f2ada94e3b503@mail.gmail.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070907040202080205080805" Cc: xmpp@ietf.org Subject: Re: [xmpp] draft-hildebrand-dna-00 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Nov 2009 18:16:24 -0000 This is a cryptographically signed message in MIME format. --------------ms070907040202080205080805 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit As I understand it, the idea behind draft-hildebrand-dna-00 is that DNA would be extensible, so that the parties could support a number of different proof types. Attribute certificates (ACs) would be one proof type, but not the only one. I agree that ACs are a bit experimental, because they have never been widely deployed (there are implementations in code, but few deployments that I know of). Other possible DNA proof types might include a signed SRV record (DNSSEC), a special file uploaded to the SSL- or TLS-protected document root for the domain in question, and others we haven't considered yet. Suggestions are welcome. On 11/21/09 8:57 PM, Bernard Aboba wrote: > I share these concerns. Attribute certificates are very rarely > implemented, and as a result if DNA is required for server-server this > is likely to break interoperability with many existing server > implementations. > > Given the lack of implementation experience, any DNA documents should be > Experimental at best. > > On Wed, Oct 28, 2009 at 11:11 AM, Sean Turner > wrote: > > Dirk Balfanz wrote: > > Hi guys, > I wanted to give some feedback on draft-hildebrand-dna-00. I > just joined the mailing list, so I probably missed a bunch of > the discussion regarding this topic. I'm new to XMPP, but have > been helping out the Wave folks at Google with some crypto/PKI bits. > > > The discussion on the list has actually been pretty minimal. > Technically, it's not even a working group document. > > > My biggest question is why you're tangling up this spec with > Attribute Certificates. I've never seen an RFC 3281-style AC in > the wild, and hadn't heard of draft-ietf-pkix-3281update until I > read this spec. Is 3281update real? Are there parsers out there > that understand this stuff? It makes sense to stand on the > shoulders, so to speak, of other specs if there is wide-spread > adoption out there and code that can process these things, but > you don't want to depend on specs that nobody is using - it just > complicates things. > > > I'm not sure what you mean by real? That ID fixes some errata and > some minor bugs, so it's not a big update. It's in the RFC editor's > queue. The document it was pinned on just got approved. It ought to > be published soon. > > There are some code bits from bouncy castle, though I have to admit > I haven't used them. I'm sure there are others. > > > Ok, now for more detailed, turn-by-turn comments: > > - it says "The issuer's certificate MUST NOT have a > basicConstraints extension with the cA BOOLEAN set to TRUE." Why? > > > The statement is for compliance with RFC 3281/3281bis section 4.5. > It says: "The AC issuer's PKC MUST conform to [PKIXPROF], and the > keyUsage extension in the PKC MUST NOT explicitly indicate that the > AC issuer's public key cannot be used to validate a digital > signature. In order to avoid confusion regarding serial numbers and > revocations, an AC issuer MUST NOT also be a PKC Issuer. That is, > an AC issuer cannot be a CA as well. So, the AC issuer's PKC MUST > NOT have a basicConstraints extension with the cA BOOLEAN set to TRUE." > > > - The holder field MUST be the baseCertificateID. This seems to > mean that it points to a issuer/serial number in some other PKC. > Hows does the validating entity get hold of that PKC? How did > the issuer of the AC know what to put there? > > > The AC issuer will include their name in the issuer field (taken > from their PKC's subject field) and the issuer's serial # (taken > from their PKC's serial number field). Then the path for the AC > would be included along with the AC (see Section 5.5). I proposed a > "certs-only" message. It would include one attribute certificate > and any public key certificates necessary to validate them. > "certs-only" message have been around a while and are most recently > documented in draft-ietf-smime-3851bis-11. > > > - http://www.ietf.org/id/draft-ietf-pkix-3281update-05.txt says > "Conforming implementations MUST NOT use the x400Address, > ediPartyName, or registeredID options [wherever the spec asks > for a GeneralName]" Your spec says to use registeredId, so you > seem to be advocating a non-3281update-compliant AC. > > > That's my bad. We wouldn't want to be non-compliant. Joe suggested > just using OIDs for id-xmpp and another one for > id-xmpp-client/id-xmpp-server so I stuck it in there. If we can't > use registerdID, then we need to pick another one or define an > other-name. I guess I lean towards a new other-name. Thoughts? > > > - For encoding the AC, issuer cert and potential intermediate > certs, you're depending on yet another RFC > (http://tools.ietf.org/html/draft-ietf-smime-3851bis-11) for > encoding the cert chain, which seems like overkill. Why not just > say that proof-type attribute-cert has sub-elements, like > from='asserted.tld' > type='urn:ietf:params:dna:proof:attribute-cert'> > > (base64 of AC) > > > (base64 of issuer PKC) > > > (base64 of intermediate PKC that issued issuer PKC) > > > > > We could do that, but it's not like what we picked is new. > certs-only has been around since before '99 (see RFC 2633). I > guess I don't really have a strong opinion one way or another. If > we're not going to use PKCS#7 should we use from > XMLDSig? > > > What do you guys think? You probably discussed all these things > to death and i'm just late to the party... > > > Cheers, > spt > > Dirk. > --------------ms070907040202080205080805 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTEyMjE4MTYxN1owIwYJKoZIhvcNAQkEMRYEFB2zG86qYo8vBb+4QvXU R4Tj0fdlMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAYpFzAlpLA/o8WtWNQK/Yv7R7ZXld9x1xfABoxIan 6IIsFTQFTFB8/BNnDExNEmW2Zytj7pupN2KhZjhbZRtF8oiku+J9rU9Lm1WjxKZ2IbYVuOvO 47VPtm/UQbThch6V1QLq1JVEhKCJZ6ancoIV/4a7Beq54kOUF5Lblpm5DKdm9vHjN0YiP43Q CaS4JGXgcw0QRjviLY5ZHX0x/T7Ff25NFins9g7oWG+n+zd4nPbjYzGJatRFry5UVR7/DAmD L43Zv3SndW/Mba0ztZdt8jbHCFpSG72+xKBc09n8XtNKgiOw0n5kqe3jqL+Xkzt1pwEGKmUM gFq02U0IHZutuAAAAAAAAA== --------------ms070907040202080205080805-- From stpeter@stpeter.im Sun Nov 22 10:42:39 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8A7A53A69ED for ; Sun, 22 Nov 2009 10:42:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.58 X-Spam-Level: X-Spam-Status: No, score=-2.58 tagged_above=-999 required=5 tests=[AWL=0.019, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u9+LQ9xtmDp3 for ; Sun, 22 Nov 2009 10:42:38 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 9E8273A69E6 for ; Sun, 22 Nov 2009 10:42:38 -0800 (PST) Received: from squire.local (dsl-175-187.dynamic-dsl.frii.net [216.17.175.187]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id B9BB440D09 for ; Sun, 22 Nov 2009 11:42:34 -0700 (MST) Message-ID: <4B098619.6040107@stpeter.im> Date: Sun, 22 Nov 2009 11:42:33 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070500030301090608060208" Subject: [xmpp] [Fwd: Re: [TLS] RC4+3DES rekeying - long-lived TLS connections] X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 22 Nov 2009 18:42:39 -0000 This is a cryptographically signed message in MIME format. --------------ms070500030301090608060208 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit FYI from the TLS WG list. -------- Original Message -------- Subject: Re: [TLS] RC4+3DES rekeying - long-lived TLS connections Date: Sun, 22 Nov 2009 11:38:35 -0700 From: Peter Saint-Andre To: mrex@sap.com CC: tls@ietf.org References: <200911201828.nAKISN6Y017007@fs4113.wdf.sap.corp> On 11/20/09 11:28 AM, Martin Rex wrote: > Peter Saint-Andre wrote: >> ... For example in XMPP >> we use long-lived TCP connections and, on top of those, long-lived XML >> streams that can be TLS-protected. In practice, for server-to-server >> federation (and even for client-to-server communication) those >> connections might be up for days, weeks, even months. At this point the >> handling of long-lived XML streams is unspecified, but I would expect >> most XMPP servers to terminate the connection and force the other party >> to reconnect. > > There was a discussion around long-lived SSL connections and > reasons for rekeying, e.g. using TLS renegotiation on mogul-open. > > If you're using ciphersuites with RC4 or 3DES encryption algorithms, > you probably should not use such connections for prolonged times > or huge amounts of data without rekeying (see below). Thanks for the tip. We'll do some research about this in the XMPP WG. > The other issue: if you're authenticating such a connection once > based on X.509 certificates and leave it open for month, you might > want to talk to the PKIX folks about this. > > They might feel uneasy if you happily continue to communicate > based on an authentication that was weeks or months in the past > and do not care at all the authentication cert may have long > expired or been revoked in the meantime. That's why draft-ietf-xmpp-3920bis-04 (section 14.2.2.3) talks about the need to (1) close the stream if the expiration date occurs during the life of the stream and (2) periodically check the OCSP responder. Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms070500030301090608060208 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTEyMjE4NDIzM1owIwYJKoZIhvcNAQkEMRYEFDozj2QoILo8WrbKXWFT UlnQQNeQMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAfLia891RWSOmlao1ZJ3efdDrfUWlVOnkC6oD6HfB Ea6sjHYFLPOV26m7gC2PoMUD+EfPFB8BQmUQOVZjCAHRPxa7uXULQoZsLTCHJqVWooXJScCs RyfQ1STNWIxai9xN2wPU/KbeolpMm6ql91mIsXL4yIhXZyk//BEoOHlPrlJWQgypz3w889f+ uQCjbxGwiaY4ifgCey+yJQ0Gb1Lb3I8w3c6XxdVjUBk1xUsmPRLtRrRi5ecpX7gZGax9uC7b o3gWjAr3MdKxL4LIH7Qmwxh0JJ9JYRfykk1KAzI/+mGH88OzrWzIMB9tarX2MXO3DTfS1ctY vXfSW6dHS50KKQAAAAAAAA== --------------ms070500030301090608060208-- From stpeter@stpeter.im Mon Nov 23 08:03:43 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 145A828C136 for ; Mon, 23 Nov 2009 08:03:43 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A2yaqxJNhWXi for ; Mon, 23 Nov 2009 08:03:42 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id E59753A6953 for ; Mon, 23 Nov 2009 08:03:41 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 82B2240D12 for ; Mon, 23 Nov 2009 09:03:37 -0700 (MST) Message-ID: <4B0AAF4E.9090304@stpeter.im> Date: Mon, 23 Nov 2009 08:50:38 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms070109030400010706010702" Subject: [xmpp] MTI cipher suites (was: [Fwd: Re: [TLS] RC4+3DES rekeying - long-lived TLS connections]) X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Nov 2009 16:03:43 -0000 This is a cryptographically signed message in MIME format. --------------ms070109030400010706010702 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable FYI from the TLS WG list. The need to periodically modify the list of mandatory-to-implement cipher suites might argue for splitting the MTI list into a separate document, as previously discussed here. /psa -------- Original Message -------- Subject: Re: [TLS] RC4+3DES rekeying - long-lived TLS connections Date: Sat, 21 Nov 2009 04:06:21 +0000 From: David-Sarah Hopwood To: tls@ietf.org References: <200911201828.nAKISN6Y017007@fs4113.wdf.sap.corp> Martin Rex wrote: > Peter Saint-Andre wrote: >> ... For example in XMPP >> we use long-lived TCP connections and, on top of those, long-lived XML= >> streams that can be TLS-protected. In practice, for server-to-server >> federation (and even for client-to-server communication) those >> connections might be up for days, weeks, even months. At this point th= e >> handling of long-lived XML streams is unspecified, but I would expect >> most XMPP servers to terminate the connection and force the other part= y >> to reconnect. >=20 > There was a discussion around long-lived SSL connections and > reasons for rekeying, e.g. using TLS renegotiation on mogul-open. >=20 > If you're using ciphersuites with RC4 or 3DES encryption algorithms, > you probably should not use such connections for prolonged times > or huge amounts of data without rekeying (see below). As far as I know, RC4 as used in TLS does not have a significant problem with encrypting large amounts of data. There are small statistical biases in the RC4 keystream but they're not a serious threat in most situations. If you're worried about the information leakage in using 3DES for long-lived connections, then it's probably a better option to disable 3DES ciphersuites, than to use renegotiation to rekey. I think that disabling 3DES should not cause significant interoperability problems provided you continue to offer both RC4 and AES ciphersuites. --=20 David-Sarah Hopwood =E2=9A=A5 http://davidsarah.livejournal.com --=20 Peter Saint-Andre https://stpeter.im/ --------------ms070109030400010706010702 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTEyMzE1NTAzOFowIwYJKoZIhvcNAQkEMRYEFGTsnMQL9IBmvRgrqLmo iSUqLBCPMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAQ6EnVjNzsnfwjn7vNlXJJvEz0QYWn+gDH929WtDV XRp0mholbg4pDZ+FxQvDDauPxFU/zzheTA9PsAAKlqnWcuXb5ZR5fTOID2LW5Wd4bjPZJv8e PJCDF2VSlL+31McxSqzMd5pAWf1oRLLkHxwUPbLX1Hysy7vKQaS6Hk2kRJXj6H7Hk9/OMOxe evx9WOkeRWud9PhHRUxL47ImNfVaKCD9Djncz/hxnGazF8XqIuhyXvwCOCnBrZQstjJ8czbK pszAmUWbUBDBN+gV0vunS0Avlj5y0PDo7GisE4evk6d0WGw9+EcDUWv9bKb0lWIHc8urMj/h HmVuGPkI8ZdYdAAAAAAAAA== --------------ms070109030400010706010702-- From Joe.Hildebrand@webex.com Mon Nov 23 09:38:59 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DD6823A681E for ; Mon, 23 Nov 2009 09:38:59 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.532 X-Spam-Level: X-Spam-Status: No, score=-104.532 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, RCVD_NUMERIC_HELO=2.067, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t-uwBSHsUuR4 for ; Mon, 23 Nov 2009 09:38:58 -0800 (PST) Received: from gw2.webex.com (gw2.webex.com [64.68.122.209]) by core3.amsl.com (Postfix) with SMTP id ACE2F3A67DF for ; Mon, 23 Nov 2009 09:38:58 -0800 (PST) Received: from SRV-EXSC03.webex.local ([192.168.252.197]) by gw2.webex.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 23 Nov 2009 09:38:54 -0800 Received: from 64.101.74.200 ([64.101.74.200]) by SRV-EXSC03.webex.local ([192.168.252.200]) with Microsoft Exchange Server HTTP-DAV ; Mon, 23 Nov 2009 17:38:19 +0000 User-Agent: Microsoft-Entourage/12.20.0.090605 Date: Mon, 23 Nov 2009 10:38:18 -0700 From: Joe Hildebrand To: Peter Saint-Andre , Bernard Aboba Message-ID: Thread-Topic: [xmpp] draft-hildebrand-dna-00 Thread-Index: AcpsY74Tlju7N5fDLUmSN3CknbKk2Q== In-Reply-To: <4B097FF1.5030907@stpeter.im> IM-ID: xmpp:jhildebrand@corp.jabber.com Presence-ID: xmpp:jhildebrand@corp.jabber.com Jabber-ID: jhildebrand@corp.jabber.com Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 23 Nov 2009 17:38:54.0447 (UTC) FILETIME=[D3CCFFF0:01CA6C63] Cc: xmpp@ietf.org Subject: Re: [xmpp] draft-hildebrand-dna-00 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Nov 2009 17:39:00 -0000 (as individual) As well, there is a high degree of motivation amongst large service providers to get something deployed, that will lead to AC code being created if it needs to be. What do people think about the HTTPS proof type Peter mentions? The idea would be that you offer an https: URL as your proof; that HTTPS connection would offer a certificate related to the domain you're trying to prove (perhaps by appending "www." To the front of the domain name), and would point to an XML document with a defined schema that points to the certificate that was offered by the XMPP/TLS connection. If we're careful about how we define the AC XML, we might be able to reuse the same schema. My take is that HTTPS proof would be easier to get up and running, but might not be deployable in all situations. For example, if I'm a small company that has outsourced all of my web development to an outside firm, it might be difficult to get them to host a new XML file. Other ideas? On 11/22/09 11:16 AM, "Peter Saint-Andre" wrote: > As I understand it, the idea behind draft-hildebrand-dna-00 is that DNA > would be extensible, so that the parties could support a number of > different proof types. Attribute certificates (ACs) would be one proof > type, but not the only one. I agree that ACs are a bit experimental, > because they have never been widely deployed (there are implementations > in code, but few deployments that I know of). Other possible DNA proof > types might include a signed SRV record (DNSSEC), a special file > uploaded to the SSL- or TLS-protected document root for the domain in > question, and others we haven't considered yet. Suggestions are welcome. > > On 11/21/09 8:57 PM, Bernard Aboba wrote: >> I share these concerns. Attribute certificates are very rarely >> implemented, and as a result if DNA is required for server-server this >> is likely to break interoperability with many existing server >> implementations. >> >> Given the lack of implementation experience, any DNA documents should be >> Experimental at best. >> >> On Wed, Oct 28, 2009 at 11:11 AM, Sean Turner > > wrote: >> >> Dirk Balfanz wrote: >> >> Hi guys, >> I wanted to give some feedback on draft-hildebrand-dna-00. I >> just joined the mailing list, so I probably missed a bunch of >> the discussion regarding this topic. I'm new to XMPP, but have >> been helping out the Wave folks at Google with some crypto/PKI bits. >> >> >> The discussion on the list has actually been pretty minimal. >> Technically, it's not even a working group document. >> >> >> My biggest question is why you're tangling up this spec with >> Attribute Certificates. I've never seen an RFC 3281-style AC in >> the wild, and hadn't heard of draft-ietf-pkix-3281update until I >> read this spec. Is 3281update real? Are there parsers out there >> that understand this stuff? It makes sense to stand on the >> shoulders, so to speak, of other specs if there is wide-spread >> adoption out there and code that can process these things, but >> you don't want to depend on specs that nobody is using - it just >> complicates things. >> >> >> I'm not sure what you mean by real? That ID fixes some errata and >> some minor bugs, so it's not a big update. It's in the RFC editor's >> queue. The document it was pinned on just got approved. It ought to >> be published soon. >> >> There are some code bits from bouncy castle, though I have to admit >> I haven't used them. I'm sure there are others. >> >> >> Ok, now for more detailed, turn-by-turn comments: >> >> - it says "The issuer's certificate MUST NOT have a >> basicConstraints extension with the cA BOOLEAN set to TRUE." Why? >> >> >> The statement is for compliance with RFC 3281/3281bis section 4.5. >> It says: "The AC issuer's PKC MUST conform to [PKIXPROF], and the >> keyUsage extension in the PKC MUST NOT explicitly indicate that the >> AC issuer's public key cannot be used to validate a digital >> signature. In order to avoid confusion regarding serial numbers and >> revocations, an AC issuer MUST NOT also be a PKC Issuer. That is, >> an AC issuer cannot be a CA as well. So, the AC issuer's PKC MUST >> NOT have a basicConstraints extension with the cA BOOLEAN set to TRUE." >> >> >> - The holder field MUST be the baseCertificateID. This seems to >> mean that it points to a issuer/serial number in some other PKC. >> Hows does the validating entity get hold of that PKC? How did >> the issuer of the AC know what to put there? >> >> >> The AC issuer will include their name in the issuer field (taken >> from their PKC's subject field) and the issuer's serial # (taken >> from their PKC's serial number field). Then the path for the AC >> would be included along with the AC (see Section 5.5). I proposed a >> "certs-only" message. It would include one attribute certificate >> and any public key certificates necessary to validate them. >> "certs-only" message have been around a while and are most recently >> documented in draft-ietf-smime-3851bis-11. >> >> >> - http://www.ietf.org/id/draft-ietf-pkix-3281update-05.txt says >> "Conforming implementations MUST NOT use the x400Address, >> ediPartyName, or registeredID options [wherever the spec asks >> for a GeneralName]" Your spec says to use registeredId, so you >> seem to be advocating a non-3281update-compliant AC. >> >> >> That's my bad. We wouldn't want to be non-compliant. Joe suggested >> just using OIDs for id-xmpp and another one for >> id-xmpp-client/id-xmpp-server so I stuck it in there. If we can't >> use registerdID, then we need to pick another one or define an >> other-name. I guess I lean towards a new other-name. Thoughts? >> >> >> - For encoding the AC, issuer cert and potential intermediate >> certs, you're depending on yet another RFC >> (http://tools.ietf.org/html/draft-ietf-smime-3851bis-11) for >> encoding the cert chain, which seems like overkill. Why not just >> say that proof-type attribute-cert has sub-elements, like >> > from='asserted.tld' >> type='urn:ietf:params:dna:proof:attribute-cert'> >> >> (base64 of AC) >> >> >> (base64 of issuer PKC) >> >> >> (base64 of intermediate PKC that issued issuer PKC) >> >> >> >> >> We could do that, but it's not like what we picked is new. >> certs-only has been around since before '99 (see RFC 2633). I >> guess I don't really have a strong opinion one way or another. If >> we're not going to use PKCS#7 should we use from >> XMLDSig? >> >> >> What do you guys think? You probably discussed all these things >> to death and i'm just late to the party... >> >> >> Cheers, >> spt >> >> Dirk. >> > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp -- Joe Hildebrand From balfanz@google.com Mon Nov 23 14:26:18 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8E2243A6AC5 for ; Mon, 23 Nov 2009 14:26:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.092 X-Spam-Level: X-Spam-Status: No, score=-105.092 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_FONT_FACE_BAD=0.884, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fpFC147cbmS1 for ; Mon, 23 Nov 2009 14:26:16 -0800 (PST) Received: from smtp-out.google.com (smtp-out.google.com [216.239.33.17]) by core3.amsl.com (Postfix) with ESMTP id 2B5DC3A6AD1 for ; Mon, 23 Nov 2009 14:26:15 -0800 (PST) Received: from zps75.corp.google.com (zps75.corp.google.com [172.25.146.75]) by smtp-out.google.com with ESMTP id nANMQ9XF008243 for ; Mon, 23 Nov 2009 22:26:09 GMT DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1259015170; bh=sCbSXvY3YNCX61YYBV3UC7DZ1Hg=; h=MIME-Version:In-Reply-To:References:Date:Message-ID:Subject:From: To:Cc:Content-Type; b=ACtq7g/RCvAVU2HKJGA6Z5oSwFxl8E+kF/W9nRoNXzaaxeYnvYWw78bOI3p+zItqP 5771ut7sIJr9r0qoC8Ozw== DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:in-reply-to:references:date:message-id:subject:from:to: cc:content-type:x-system-of-record; b=siNetYtxIC5hD7MWyGLsh1EGztOguXwpNzZbi9GWCkp0au50a7HEFZMA8uxokQ3Ry YYwUF2cAc3mFu++w9FQGA== Received: from qyk41 (qyk41.prod.google.com [10.241.83.169]) by zps75.corp.google.com with ESMTP id nANMQ60c024517 for ; Mon, 23 Nov 2009 14:26:06 -0800 Received: by qyk41 with SMTP id 41so3107246qyk.29 for ; Mon, 23 Nov 2009 14:26:05 -0800 (PST) MIME-Version: 1.0 Received: by 10.229.9.83 with SMTP id k19mr735649qck.47.1259015164713; Mon, 23 Nov 2009 14:26:04 -0800 (PST) In-Reply-To: References: <4B097FF1.5030907@stpeter.im> Date: Mon, 23 Nov 2009 14:26:04 -0800 Message-ID: <60c552b80911231426m13f87c7fi79c009d7a8dd37b6@mail.gmail.com> From: Dirk Balfanz To: Joe Hildebrand Content-Type: multipart/alternative; boundary=0016e64f44f0a8e2ca0479114f66 X-System-Of-Record: true Cc: xmpp@ietf.org Subject: Re: [xmpp] draft-hildebrand-dna-00 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Nov 2009 22:26:18 -0000 --0016e64f44f0a8e2ca0479114f66 Content-Type: text/plain; charset=ISO-8859-1 On Mon, Nov 23, 2009 at 9:38 AM, Joe Hildebrand wrote: > (as individual) > > As well, there is a high degree of motivation amongst large service > providers to get something deployed, that will lead to AC code being > created > if it needs to be. > > What do people think about the HTTPS proof type Peter mentions? The idea > would be that you offer an https: URL as your proof; that HTTPS connection > would offer a certificate related to the domain you're trying to prove > (perhaps by appending "www." To the front of the domain name), and would > point to an XML document with a defined schema that points to the > certificate that was offered by the XMPP/TLS connection. If we're careful > about how we define the AC XML, we might be able to reuse the same schema. > > My take is that HTTPS proof would be easier to get up and running, but > might > not be deployable in all situations. For example, if I'm a small company > that has outsourced all of my web development to an outside firm, it might > be difficult to get them to host a new XML file. > > Other ideas? > Isn't all we really need here a signed statement of the form "domain < xyz.com> delegates XMPP-hosting authority to domain "? How about simply saying that, in XML, as part of the proof: hosted.com target.tld 2009-11-28 2010-11-28 TCDVSuG6grhyHbzhQFWFzGrxIPE= x/GyPbzmFEe... MIICyjC... MIICyjC... Ok, the xmldsig stuff isn't exactly "simple" :-), but the other things are. You could also host the element somewhere and say: which would simply point to an XML document with the statement in it (signatures and all). This would be similar to Peter's "TLS proof" idea. I'd be a bit nervous about using the TLS integrity mechanisms directly as evidence that the delegation statement is authoritative. If I understand the idea correctly, you would point, from the , to an (XML) document that would say (something equivalent to): hosted.com target.tld 2009-11-28 2010-11-28 and the fact that it was served over TLS, with a server cert issued to hosted.com, is taken as evidence that target.tld can speak XMPP for hosted.com. The problem with this approach is that documents served over TLS are just as easily "defaced" by attackers as documents not served over TLS. So the paranoid in me would like to see a static signature on the delegation document, rather than the dynamically-generated integrity protection provided by TLS. This way, if an attacker breaks into the delegation-statement-hosting server and changes the delegation statement, he would break the signature. Dirk. > On 11/22/09 11:16 AM, "Peter Saint-Andre" wrote: > > > As I understand it, the idea behind draft-hildebrand-dna-00 is that DNA > > would be extensible, so that the parties could support a number of > > different proof types. Attribute certificates (ACs) would be one proof > > type, but not the only one. I agree that ACs are a bit experimental, > > because they have never been widely deployed (there are implementations > > in code, but few deployments that I know of). Other possible DNA proof > > types might include a signed SRV record (DNSSEC), a special file > > uploaded to the SSL- or TLS-protected document root for the domain in > > question, and others we haven't considered yet. Suggestions are welcome. > > > > On 11/21/09 8:57 PM, Bernard Aboba wrote: > >> I share these concerns. Attribute certificates are very rarely > >> implemented, and as a result if DNA is required for server-server this > >> is likely to break interoperability with many existing server > >> implementations. > >> > >> Given the lack of implementation experience, any DNA documents should be > >> Experimental at best. > >> > >> On Wed, Oct 28, 2009 at 11:11 AM, Sean Turner >> > wrote: > >> > >> Dirk Balfanz wrote: > >> > >> Hi guys, > >> I wanted to give some feedback on draft-hildebrand-dna-00. I > >> just joined the mailing list, so I probably missed a bunch of > >> the discussion regarding this topic. I'm new to XMPP, but have > >> been helping out the Wave folks at Google with some crypto/PKI > bits. > >> > >> > >> The discussion on the list has actually been pretty minimal. > >> Technically, it's not even a working group document. > >> > >> > >> My biggest question is why you're tangling up this spec with > >> Attribute Certificates. I've never seen an RFC 3281-style AC in > >> the wild, and hadn't heard of draft-ietf-pkix-3281update until I > >> read this spec. Is 3281update real? Are there parsers out there > >> that understand this stuff? It makes sense to stand on the > >> shoulders, so to speak, of other specs if there is wide-spread > >> adoption out there and code that can process these things, but > >> you don't want to depend on specs that nobody is using - it just > >> complicates things. > >> > >> > >> I'm not sure what you mean by real? That ID fixes some errata and > >> some minor bugs, so it's not a big update. It's in the RFC editor's > >> queue. The document it was pinned on just got approved. It ought to > >> be published soon. > >> > >> There are some code bits from bouncy castle, though I have to admit > >> I haven't used them. I'm sure there are others. > >> > >> > >> Ok, now for more detailed, turn-by-turn comments: > >> > >> - it says "The issuer's certificate MUST NOT have a > >> basicConstraints extension with the cA BOOLEAN set to TRUE." > Why? > >> > >> > >> The statement is for compliance with RFC 3281/3281bis section 4.5. > >> It says: "The AC issuer's PKC MUST conform to [PKIXPROF], and the > >> keyUsage extension in the PKC MUST NOT explicitly indicate that the > >> AC issuer's public key cannot be used to validate a digital > >> signature. In order to avoid confusion regarding serial numbers and > >> revocations, an AC issuer MUST NOT also be a PKC Issuer. That is, > >> an AC issuer cannot be a CA as well. So, the AC issuer's PKC MUST > >> NOT have a basicConstraints extension with the cA BOOLEAN set to > TRUE." > >> > >> > >> - The holder field MUST be the baseCertificateID. This seems to > >> mean that it points to a issuer/serial number in some other PKC. > >> Hows does the validating entity get hold of that PKC? How did > >> the issuer of the AC know what to put there? > >> > >> > >> The AC issuer will include their name in the issuer field (taken > >> from their PKC's subject field) and the issuer's serial # (taken > >> from their PKC's serial number field). Then the path for the AC > >> would be included along with the AC (see Section 5.5). I proposed a > >> "certs-only" message. It would include one attribute certificate > >> and any public key certificates necessary to validate them. > >> "certs-only" message have been around a while and are most recently > >> documented in draft-ietf-smime-3851bis-11. > >> > >> > >> - http://www.ietf.org/id/draft-ietf-pkix-3281update-05.txt says > >> "Conforming implementations MUST NOT use the x400Address, > >> ediPartyName, or registeredID options [wherever the spec asks > >> for a GeneralName]" Your spec says to use registeredId, so you > >> seem to be advocating a non-3281update-compliant AC. > >> > >> > >> That's my bad. We wouldn't want to be non-compliant. Joe suggested > >> just using OIDs for id-xmpp and another one for > >> id-xmpp-client/id-xmpp-server so I stuck it in there. If we can't > >> use registerdID, then we need to pick another one or define an > >> other-name. I guess I lean towards a new other-name. Thoughts? > >> > >> > >> - For encoding the AC, issuer cert and potential intermediate > >> certs, you're depending on yet another RFC > >> (http://tools.ietf.org/html/draft-ietf-smime-3851bis-11) for > >> encoding the cert chain, which seems like overkill. Why not just > >> say that proof-type attribute-cert has sub-elements, like > >> >> from='asserted.tld' > >> type='urn:ietf:params:dna:proof:attribute-cert'> > >> > >> (base64 of AC) > >> > >> > >> (base64 of issuer PKC) > >> > >> > >> (base64 of intermediate PKC that issued issuer PKC) > >> > >> > >> > >> > >> We could do that, but it's not like what we picked is new. > >> certs-only has been around since before '99 (see RFC 2633). I > >> guess I don't really have a strong opinion one way or another. If > >> we're not going to use PKCS#7 should we use from > >> XMLDSig? > >> > >> > >> What do you guys think? You probably discussed all these things > >> to death and i'm just late to the party... > >> > >> > >> Cheers, > >> spt > >> > >> Dirk. > >> > > _______________________________________________ > > xmpp mailing list > > xmpp@ietf.org > > https://www.ietf.org/mailman/listinfo/xmpp > > -- > Joe Hildebrand > > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp > --0016e64f44f0a8e2ca0479114f66 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

On Mon, Nov 23, 2009 at 9:38 AM, Joe Hil= debrand <joe.hildebrand@webex.com> wrote:
(as individual)

As well, there is a high degree of motivation amongst large service
providers to get something deployed, that will lead to AC code being create= d
if it needs to be.

What do people think about the HTTPS proof type Peter mentions? =A0The idea=
would be that you offer an https: URL as your proof; that HTTPS connection<= br> would offer a certificate related to the domain you're trying to prove<= br> (perhaps by appending "www." To the front of the domain name), an= d would
point to an XML document with a defined schema that points to the
certificate that was offered by the XMPP/TLS connection. =A0If we're ca= reful
about how we define the AC XML, we might be able to reuse the same schema.<= br>
My take is that HTTPS proof would be easier to get up and running, but migh= t
not be deployable in all situations. =A0For example, if I'm a small com= pany
that has outsourced all of my web development to an outside firm, it might<= br> be difficult to get them to host a new XML file.

Other ideas?

Isn't all we really ne= ed here a signed statement of the form "domain <xyz.com> delegates XMPP-hosting authority = to domain <abc.com>&= quot;? How about simply saying that, in XML, as part of the proof:

 <proof xmlns=
=3D'urn:ietf:params:xml:ns:dna' xmlns:ds=3D'http://www.w3.org/2000/09/xmldsig#'
          from=3D'target.tld'
          type=3D'urn:ietf:params:dna:proof:inline-delegation'>
  <delegation id=3D"foo">
     <from>hosted.com=
=
</from>
     <to>target.tld</to>
     <not-before>2009-11-28</not-before>
     <not-after>2010-11-28</not-after>
=A0=
=A0 =A0 <ds:Signature>


=A0=A0 =
=A0 =A0 <ds:SignedInfo>
=A0=A0 =A0 =A0 =A0 <ds:CanonicalizationMethod=A0Algorithm=3D"=
=
http://www.w3.org/2001/10/xml-exc-c14=
n#"/>


=A0=A0 =
=A0 =A0 =A0 <ds:SignatureMethod Algorithm=3D"http://www.w3.org/2000/09/xmldsig#rsa-sha1=
"/>


=A0=A0 =
=A0 =A0 =A0 <ds:Reference URI=3D"#foo">
           <ds:Transforms>


=A0       =A0 =
=A0 =A0<ds:Transform Algorithm=3D"http://www.w3.org/2000/09/xmldsig#enveloped-signature<=
/font>&quo=
t;/> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0


=A0       =A0 =
=A0 =A0<ds:Transform Algorithm=3D"=
http://www.w3.org/2001/10/xml-exc-c14n#">


=A0       =A0 =
=A0 =A0 =A0<InclusiveNamespaces


=A0=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 P=
refixList=3D"#default ds"
=A0       =A0 =A0 =A0 =A0 =A0xmlns=3D"=
http://www.w3.org/2001/10/xml-exc-c14n#"/>


=A0       =A0 =
=A0 =A0</ds:Transform>


           </ds:Transforms>


           <ds:DigestMethod Algorithm=
=3D"http://www.w3.org/2000/09/xmldsig#=
sha1"/>


           <ds:DigestValue>TCDVSuG6g=
rhyHbzhQFWFzGrxIPE=3D</ds:DigestValue>


=A0=A0 =
=A0 =A0 =A0 </ds:Reference>
=A0=A0 =A0 =A0 </ds:SignedIn=
fo>


=A0=A0 =
=A0 =A0 <ds:SignatureValue>
=A0=A0 =A0 =A0 =A0 x/GyPbzmFEe.=
..


=A0=A0 =
=A0 =A0 =A0</ds:SignatureValue>
=A0=A0 =A0 =A0 <ds:Key=
Info>


=A0=A0 =
=A0 =A0 =A0 <ds:X509Data>
<ds:X509Certificate>


=A0       =A0 =
=A0 =A0MIICyjC...


           </ds:X509Certificate>


           <ds:X509Certificate>


=A0           =
=A0MIICyjC...


           </ds:X509Certificate>


=A0=A0 =
=A0 =A0 =A0 </ds:X509Data>
=A0=A0 =A0 =A0 </ds:KeyInfo&g=
t;

=A0=A0 =A0 </ds:Signature>
=A0=A0 </delegation>
=
 </proof>
=A0Ok, the xmldsig stuff isn't exactly "simple&q= uot; :-), but the other things are. You could also host the <delegation&= gt; element somewhere and say:

<proof xmlns=3D'urn:ietf:params:xml:ns:dna' xmlns:ds=3D'http://www.w3.org/2000/09/xmldsig#'
from=3D'target.tld' type=3D'urn:ietf:params:dna:proof:delegation-uri'> <delegation-uri href=3D'http://delegation-statements-r-us.com/12345.xml'&= gt; </proof>
which would simply point to an XML document with the <delegat= ion> statement in it (signatures and all). This would be similar to Pete= r's "TLS proof" idea. I'd be a bit nervous about using th= e TLS integrity mechanisms directly as evidence that the delegation stateme= nt is authoritative. If I understand the idea correctly, you would point, f= rom the <proof>, to an (XML) document that would say (something equiv= alent to):
=
  <delegat=
ion id=3D"foo">
     <from>hosted.com</from>=
;
     <to>target.tld</to>
     <not-before>2009-11-28</not-before>
     <not-after>2010-11-28</not-after>
  </delegation>
= and the fact that it was served over TLS, with a server cert issued to hosted.com, is taken as evidence that target.= tld can speak XMPP for hosted.com. The pr= oblem with this approach is that documents served over TLS are just as easi= ly "defaced" by attackers as documents not served over TLS. So th= e paranoid in me would like to see a static signature on the delegation doc= ument, rather than the dynamically-generated integrity protection provided = by TLS. This way, if an attacker breaks into the delegation-statement-hosti= ng server and changes the delegation statement, he would break the signatur= e.

= Dirk.


On 11/22/09 11:16 AM, "Peter Saint-Andre" <stpeter@stpeter.im> wrote:

> As I understand it, the idea behind draft-hildebrand-dna-00 is that DN= A
> would be extensible, so that the parties could support a number of
> different proof types. Attribute certificates (ACs) would be one proof=
> type, but not the only one. I agree that ACs are a bit experimental, > because they have never been widely deployed (there are implementation= s
> in code, but few deployments that I know of). Other possible DNA proof=
> types might include a signed SRV record (DNSSEC), a special file
> uploaded to the SSL- or TLS-protected document root for the domain in<= br> > question, and others we haven't considered yet. Suggestions are we= lcome.
>
> On 11/21/09 8:57 PM, Bernard Aboba wrote:
>> I share these concerns. =A0Attribute certificates are very rarely<= br> >> implemented, and as a result if DNA is required for server-server = this
>> is likely to break interoperability with many existing server
>> implementations.
>>
>> Given the lack of implementation experience, any DNA documents sho= uld be
>> Experimental at best.
>>
>> On Wed, Oct 28, 2009 at 11:11 AM, Sean Turner <turners@ieca.com
>> <mailto:t= urners@ieca.com>> wrote:
>>
>> =A0 =A0 Dirk Balfanz wrote:
>>
>> =A0 =A0 =A0 =A0 Hi guys,
>> =A0 =A0 =A0 =A0 I wanted to give some feedback on draft-hildebrand= -dna-00. I
>> =A0 =A0 =A0 =A0 just joined the mailing list, so I probably missed= a bunch of
>> =A0 =A0 =A0 =A0 the discussion regarding this topic. I'm new t= o XMPP, but have
>> =A0 =A0 =A0 =A0 been helping out the Wave folks at Google with som= e crypto/PKI bits.
>>
>>
>> =A0 =A0 The discussion on the list has actually been pretty minima= l.
>> =A0 =A0 Technically, it's not even a working group document. >>
>>
>> =A0 =A0 =A0 =A0 My biggest question is why you're tangling up = this spec with
>> =A0 =A0 =A0 =A0 Attribute Certificates. I've never seen an RFC= 3281-style AC in
>> =A0 =A0 =A0 =A0 the wild, and hadn't heard of draft-ietf-pkix-= 3281update until I
>> =A0 =A0 =A0 =A0 read this spec. Is 3281update real? Are there pars= ers out there
>> =A0 =A0 =A0 =A0 that understand this stuff? It makes sense to stan= d on the
>> =A0 =A0 =A0 =A0 shoulders, so to speak, of other specs if there is= wide-spread
>> =A0 =A0 =A0 =A0 adoption out there and code that can process these= things, but
>> =A0 =A0 =A0 =A0 you don't want to depend on specs that nobody = is using - it just
>> =A0 =A0 =A0 =A0 complicates things.
>>
>>
>> =A0 =A0 I'm not sure what you mean by real? =A0That ID fixes s= ome errata and
>> =A0 =A0 some minor bugs, so it's not a big update. =A0It's= in the RFC editor's
>> =A0 =A0 queue. The document it was pinned on just got approved. = =A0It ought to
>> =A0 =A0 be published soon.
>>
>> =A0 =A0 There are some code bits from bouncy castle, though I have= to admit
>> =A0 =A0 I haven't used them. =A0I'm sure there are others.=
>>
>>
>> =A0 =A0 =A0 =A0 Ok, now for more detailed, turn-by-turn comments:<= br> >>
>> =A0 =A0 =A0 =A0 - it says "The issuer's certificate MUST = NOT have a
>> =A0 =A0 =A0 =A0 basicConstraints extension with the cA BOOLEAN set= to TRUE." Why?
>>
>>
>> =A0 =A0 The statement is for compliance with RFC 3281/3281bis sect= ion 4.5.
>> =A0 =A0 =A0It says: "The AC issuer's PKC MUST conform to = [PKIXPROF], and the
>> =A0 =A0 keyUsage extension in the PKC MUST NOT explicitly indicate= that the
>> =A0 =A0 AC issuer's public key cannot be used to validate a di= gital
>> =A0 =A0 signature. =A0In order to avoid confusion regarding serial= numbers and
>> =A0 =A0 revocations, an AC issuer MUST NOT also be a PKC Issuer. = =A0That is,
>> =A0 =A0 an AC issuer cannot be a CA as well. =A0So, the AC issuer&= #39;s PKC MUST
>> =A0 =A0 NOT have a basicConstraints extension with the cA BOOLEAN = set to TRUE."
>>
>>
>> =A0 =A0 =A0 =A0 - The holder field MUST be the baseCertificateID. = This seems to
>> =A0 =A0 =A0 =A0 mean that it points to a issuer/serial number in s= ome other PKC.
>> =A0 =A0 =A0 =A0 Hows does the validating entity get hold of that P= KC? How did
>> =A0 =A0 =A0 =A0 the issuer of the AC know what to put there?
>>
>>
>> =A0 =A0 The AC issuer will include their name in the issuer field = (taken
>> =A0 =A0 from their PKC's subject field) and the issuer's s= erial # (taken
>> =A0 =A0 from their PKC's serial number field). =A0Then the pat= h for the AC
>> =A0 =A0 would be included along with the AC (see Section 5.5). =A0= I proposed a
>> =A0 =A0 "certs-only" message. =A0It would include one at= tribute certificate
>> =A0 =A0 and any public key certificates necessary to validate them= .
>> =A0 =A0 =A0"certs-only" message have been around a while= and are most recently
>> =A0 =A0 documented in draft-ietf-smime-3851bis-11.
>>
>>
>> =A0 =A0 =A0 =A0 - http://www.ietf.org/id/draft-ietf-pk= ix-3281update-05.txt says
>> =A0 =A0 =A0 =A0 =A0"Conforming implementations MUST NOT use t= he x400Address,
>> =A0 =A0 =A0 =A0 ediPartyName, or registeredID options [wherever th= e spec asks
>> =A0 =A0 =A0 =A0 for a GeneralName]" =A0Your spec says to use = registeredId, so you
>> =A0 =A0 =A0 =A0 seem to be advocating a non-3281update-compliant A= C.
>>
>>
>> =A0 =A0 That's my bad. =A0We wouldn't want to be non-compl= iant. =A0Joe suggested
>> =A0 =A0 just using OIDs for id-xmpp and another one for
>> =A0 =A0 id-xmpp-client/id-xmpp-server so I stuck it in there. =A0I= f we can't
>> =A0 =A0 use registerdID, then we need to pick another one or defin= e an
>> =A0 =A0 other-name. I guess I lean towards a new other-name. =A0Th= oughts?
>>
>>
>> =A0 =A0 =A0 =A0 - For encoding the AC, issuer cert and potential i= ntermediate
>> =A0 =A0 =A0 =A0 certs, you're depending on yet another RFC
>> =A0 =A0 =A0 =A0 (http://tools.ietf.org/html/draft-ietf-s= mime-3851bis-11) for
>> =A0 =A0 =A0 =A0 encoding the cert chain, which seems like overkill= . Why not just
>> =A0 =A0 =A0 =A0 say that proof-type attribute-cert has sub-element= s, like
>> =A0 =A0 =A0 =A0 <proof xmlns=3D'urn:ietf:params:xml:ns:dna&= #39;
>> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0from=3D'asserted.tld' >> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0type=3D'urn:ietf:params:dna= :proof:attribute-cert'>
>> =A0 =A0 =A0 =A0 =A0 =A0 <ac>
>> =A0 =A0 =A0 =A0 =A0 =A0 =A0 (base64 of AC)
>> =A0 =A0 =A0 =A0 =A0 =A0 </ac>
>> =A0 =A0 =A0 =A0 =A0 =A0 <pkc>
>> =A0 =A0 =A0 =A0 =A0 =A0 =A0 (base64 of issuer PKC)
>> =A0 =A0 =A0 =A0 =A0 =A0 </pkc>
>> =A0 =A0 =A0 =A0 =A0 =A0 <pkc>
>> =A0 =A0 =A0 =A0 =A0 =A0 =A0 (base64 of intermediate PKC that issue= d issuer PKC)
>> =A0 =A0 =A0 =A0 =A0 =A0 </pkc>
>> =A0 =A0 =A0 =A0 =A0 </proof>
>>
>>
>> =A0 =A0 We could do that, but it's not like what we picked is = new.
>> =A0 =A0 =A0certs-only has been around since before '99 (see RF= C 2633). =A0I
>> =A0 =A0 guess I don't really have a strong opinion one way or = another. =A0If
>> =A0 =A0 we're not going to use PKCS#7 should we use <X509Ce= rtificate> from
>> =A0 =A0 XMLDSig?
>>
>>
>> =A0 =A0 =A0 =A0 What do you guys think? You probably discussed all= these things
>> =A0 =A0 =A0 =A0 to death and i'm just late to the party...
>>
>>
>> =A0 =A0 Cheers,
>> =A0 =A0 spt
>>
>> =A0 =A0 =A0 =A0 Dirk.
>>
> _______________________________________________
> xmpp mailing list
> xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp

--
Joe Hildebrand

_______________________________________________
xmpp mailing list
xmpp@ietf.org
ht= tps://www.ietf.org/mailman/listinfo/xmpp

--0016e64f44f0a8e2ca0479114f66-- From stpeter@stpeter.im Tue Nov 24 19:34:15 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C441828C1C1 for ; Tue, 24 Nov 2009 19:34:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.584 X-Spam-Level: X-Spam-Status: No, score=-2.584 tagged_above=-999 required=5 tests=[AWL=0.015, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N9z99Q5zUCEE for ; Tue, 24 Nov 2009 19:34:15 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id CF57628C177 for ; Tue, 24 Nov 2009 19:34:14 -0800 (PST) Received: from squire.local (dsl-175-187.dynamic-dsl.frii.net [216.17.175.187]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 2F26940CFC for ; Tue, 24 Nov 2009 20:34:07 -0700 (MST) Message-ID: <4B0CA5AC.1080401@stpeter.im> Date: Tue, 24 Nov 2009 20:34:04 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: XMPP X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms040703040707060507050403" Subject: [xmpp] 3920bis: service name registration X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Nov 2009 03:34:15 -0000 This is a cryptographically signed message in MIME format. --------------ms040703040707060507050403 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Despite the fact that RFC 3920 mentions _xmpp-client._tcp and _xmpp-server._tcp DNS SRV records, it did not request registration of any service names with the IANA in accordance with RFC 952, for inclusion in the following registry: http://www.iana.org/assignments/service-names I shall follow up with the IANA about this to see if we need to update the IANA Considerations of draft-ietf-xmpp-3920bis... Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms040703040707060507050403 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTEyNTAzMzQwNFowIwYJKoZIhvcNAQkEMRYEFNYQcSye/eGv/6eMqo29 pVjQ2weLMF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEADw422F/pDV895E0AUiX6KALXsTui3diXGVINC5PZ XBDKSGlKG2fCRQIr/svU9DkGkTZ9sRA1MTW6JZk/NoQ7tQwircoipJkHgr1tLv/eowgoAxp/ TcIT5HkImq/ZjlTFq8BNUvOLEF1Ey1I+pfT10ly/La/GlcUDZBfOi74dgjFFTam46oWr5Nm7 T2Wa2hcS7mlZRxmqZO+Bef2GJ+jHP9yXmxzY9yg9plyF8xK/N6PU/fjEyrW+H7+dxarGt0Uz Oj9/z5Q3JBGsn64RdbYpMyHDtPZ/fYmXRExsJrA1NRA+ZlSvyFLkfpGpJFm8bq+DWiWmMYdA JF6I2IrWGFvPjgAAAAAAAA== --------------ms040703040707060507050403-- From Joe.Hildebrand@webex.com Wed Nov 25 02:00:26 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F57B3A6956 for ; Wed, 25 Nov 2009 02:00:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.25 X-Spam-Level: X-Spam-Status: No, score=-106.25 tagged_above=-999 required=5 tests=[AWL=0.349, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZZQDi9rIFlQj for ; Wed, 25 Nov 2009 02:00:25 -0800 (PST) Received: from gw1.webex.com (gw1.webex.com [64.68.122.208]) by core3.amsl.com (Postfix) with SMTP id 3C0DC3A694F for ; Wed, 25 Nov 2009 02:00:25 -0800 (PST) Received: from SRV-EXSC03.webex.local ([192.168.252.197]) by gw1.webex.com with Microsoft SMTPSVC(6.0.3790.3959); Wed, 25 Nov 2009 02:00:20 -0800 Received: from 10.21.85.147 ([10.21.85.147]) by SRV-EXSC03.webex.local ([192.168.252.200]) with Microsoft Exchange Server HTTP-DAV ; Wed, 25 Nov 2009 10:00:03 +0000 User-Agent: Microsoft-Entourage/12.20.0.090605 Date: Wed, 25 Nov 2009 03:00:03 -0700 From: Joe Hildebrand To: Peter Saint-Andre , XMPP Message-ID: Thread-Topic: [xmpp] 3920bis: service name registration Thread-Index: Acpttg6bUE17U0noGEusfnJLKurDPw== In-Reply-To: <4B0CA5AC.1080401@stpeter.im> IM-ID: xmpp:jhildebrand@corp.jabber.com Presence-ID: xmpp:jhildebrand@corp.jabber.com Jabber-ID: jhildebrand@corp.jabber.com Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit X-OriginalArrivalTime: 25 Nov 2009 10:00:20.0341 (UTC) FILETIME=[18F11A50:01CA6DB6] Subject: Re: [xmpp] 3920bis: service name registration X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Nov 2009 10:00:26 -0000 I would suggest waiting until draft-ietf-tsvwg-iana-ports is done before wading too far in on this. It's almost done, and changes how SRV registrations are done; we may also get them grandfathered in due to our port registrations. On 11/24/09 8:34 PM, "Peter Saint-Andre" wrote: > Despite the fact that RFC 3920 mentions _xmpp-client._tcp and > _xmpp-server._tcp DNS SRV records, it did not request registration of > any service names with the IANA in accordance with RFC 952, for > inclusion in the following registry: > > http://www.iana.org/assignments/service-names > > I shall follow up with the IANA about this to see if we need to update > the IANA Considerations of draft-ietf-xmpp-3920bis... > > Peter -- Joe Hildebrand From alexey.melnikov@isode.com Wed Nov 25 02:02:52 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8AEBD3A68E2 for ; Wed, 25 Nov 2009 02:02:52 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.351 X-Spam-Level: X-Spam-Status: No, score=-2.351 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cV1ObLVtfVcc for ; Wed, 25 Nov 2009 02:02:51 -0800 (PST) Received: from rufus.isode.com (rufus.isode.com [62.3.217.251]) by core3.amsl.com (Postfix) with ESMTP id 4DE1F3A68A6 for ; Wed, 25 Nov 2009 02:02:51 -0800 (PST) Received: from [94.197.197.47] (94.197.197.47.threembb.co.uk [94.197.197.47]) by rufus.isode.com (submission channel) via TCP with ESMTPA id ; Wed, 25 Nov 2009 10:02:44 +0000 Message-ID: <4B0D00B1.2040709@isode.com> Date: Wed, 25 Nov 2009 10:02:25 +0000 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 X-Accept-Language: en-us, en To: Joe Hildebrand , Peter Saint-Andre References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] 3920bis: service name registration X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Nov 2009 10:02:52 -0000 Joe Hildebrand wrote: >I would suggest waiting until draft-ietf-tsvwg-iana-ports is done before >wading too far in on this. It's almost done, and changes how SRV >registrations are done; we may also get them grandfathered in due to our >port registrations. > > I was just about to suggest the same. Note that I will be the sponsoring AD for draft-ietf-tsvwg-iana-ports, so please ping me if you need more information. >On 11/24/09 8:34 PM, "Peter Saint-Andre" wrote: > > >>Despite the fact that RFC 3920 mentions _xmpp-client._tcp and >>_xmpp-server._tcp DNS SRV records, it did not request registration of >>any service names with the IANA in accordance with RFC 952, for >>inclusion in the following registry: >> >>http://www.iana.org/assignments/service-names >> >>I shall follow up with the IANA about this to see if we need to update >>the IANA Considerations of draft-ietf-xmpp-3920bis... >> >>Peter >> >> From stpeter@stpeter.im Wed Nov 25 07:54:48 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9F42C3A6AAA for ; Wed, 25 Nov 2009 07:54:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.585 X-Spam-Level: X-Spam-Status: No, score=-2.585 tagged_above=-999 required=5 tests=[AWL=0.014, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kwEJQHWR6Wac for ; Wed, 25 Nov 2009 07:54:47 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id C34CA28C0E7 for ; Wed, 25 Nov 2009 07:54:47 -0800 (PST) Received: from squire.local (dsl-175-187.dynamic-dsl.frii.net [216.17.175.187]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 5A84740D02; Wed, 25 Nov 2009 08:54:40 -0700 (MST) Message-ID: <4B0D533F.5060008@stpeter.im> Date: Wed, 25 Nov 2009 08:54:39 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: Alexey Melnikov References: <4B0D00B1.2040709@isode.com> In-Reply-To: <4B0D00B1.2040709@isode.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms030809050207080307030906" Cc: Joe Hildebrand , XMPP Subject: Re: [xmpp] 3920bis: service name registration X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Nov 2009 15:54:48 -0000 This is a cryptographically signed message in MIME format. --------------ms030809050207080307030906 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 11/25/09 3:02 AM, Alexey Melnikov wrote: > Joe Hildebrand wrote: > >> I would suggest waiting until draft-ietf-tsvwg-iana-ports is done before >> wading too far in on this. It's almost done, and changes how SRV >> registrations are done; we may also get them grandfathered in due to our >> port registrations. >> >> > I was just about to suggest the same. Oh yes, I was definitely going to wait until there was consensus on the go-forward approach to registration. I just didn't want to forget about this issue. :) > Note that I will be the sponsoring AD for draft-ietf-tsvwg-iana-ports, > so please ping me if you need more information. Will do. Peter -- Peter Saint-Andre https://stpeter.im/ --------------ms030809050207080307030906 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTEyNTE1NTQzOVowIwYJKoZIhvcNAQkEMRYEFIwuaL6pz4Ggfb/oyndV hFp+k+Z6MF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAhnI9zL0Otn3cdAQlejURNu5RNJ79J/5GhvBNnzff J2G/YJBDkgkIkpKE2cuSAmlAFRWxSzDREzFckxLJSwlaKl2rXfB5xe8FkE3V8FnVJLCCkKUw A/ACe6Eprxf4bEuEpHlAsa86qOVzDDO/D9wxD1XzfBhwU/YWNqu9xqL0JjnmTRQcq+idmUTs MgVZNDEhClCW33SYtwg96H9iO/WHRuR+bnacWxoD5xfm57U4DnqX3567y5lt794zS+jkLSUq zQ721esmzq8SJTe10zPidr5C6CB5tIivRuVCvIipIz2Zn5DVmC5kfe85CEmzcvvi1AlmcDb/ jWlrewMM4geZpgAAAAAAAA== --------------ms030809050207080307030906-- From jonasl@google.com Wed Nov 25 08:38:40 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3D39B3A6A00 for ; Wed, 25 Nov 2009 08:38:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.977 X-Spam-Level: X-Spam-Status: No, score=-105.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LNl3U3FUD4ja for ; Wed, 25 Nov 2009 08:38:39 -0800 (PST) Received: from smtp-out.google.com (smtp-out.google.com [216.239.45.13]) by core3.amsl.com (Postfix) with ESMTP id 68CD23A6893 for ; Wed, 25 Nov 2009 08:38:39 -0800 (PST) Received: from wpaz29.hot.corp.google.com (wpaz29.hot.corp.google.com [172.24.198.93]) by smtp-out.google.com with ESMTP id nAPGcX7K025965 for ; Wed, 25 Nov 2009 08:38:34 -0800 DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1259167114; bh=STLjNZLUz5PqJLd+odlVLUuPF2Y=; h=MIME-Version:From:Date:Message-ID:Subject:To:Content-Type; b=UCcUvASgY4D8mFXF4LOd5CNS7tGbV7gPk1ETAPgk6oFwnRa4Y2pZOVbrhpfrRUZT9 pQTh6Hl4GiGIhCuigRfFw== DomainKey-Signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=mime-version:from:date:message-id:subject:to:content-type:x-system-of-record; b=SF20bqQhMS2nCpVqxaa/RMP0S31N2ZGbIzK3OHuRikTJjsbt/z48g+BBNwYNynpS6 uvw6FRBt5ELnbIYmv59iQ== Received: from gxk1 (gxk1.prod.google.com [10.202.11.1]) by wpaz29.hot.corp.google.com with ESMTP id nAPGbu3j015841 for ; Wed, 25 Nov 2009 08:38:31 -0800 Received: by gxk1 with SMTP id 1so7907474gxk.16 for ; Wed, 25 Nov 2009 08:38:30 -0800 (PST) MIME-Version: 1.0 Received: by 10.150.251.27 with SMTP id y27mr13925845ybh.227.1259167110677; Wed, 25 Nov 2009 08:38:30 -0800 (PST) From: Jonas Lindberg Date: Wed, 25 Nov 2009 17:38:10 +0100 Message-ID: To: xmpp@ietf.org Content-Type: text/plain; charset=ISO-8859-1 X-System-Of-Record: true Subject: [xmpp] draft-hildebrand-dna-00 review X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Nov 2009 16:38:40 -0000 A few comments on http://tools.ietf.org/html/draft-hildebrand-dna-00 : --- 4.2. Validation Assumption: not all service administrators will provide an attribute certificate proof for their domain. Given assumption above, a feature that may be useful for a large hosting providers is allowing domain administrators to choose their policy for what is an acceptable proof. Some domain administrators may require strong evidence like attribute certificates proofs. Others administrators may be OK with some weaker proof (e.g. SRV record lookup) if that enables their users to chat with with more domains. Implementing per domain proof policies using the current draft protocol would be a bit clunky, since for a given stream a remote domain is either valid on invalid as far as all local domains are concerned. One possible solution is to do assertions on domain pair basis, adding a from attribute to the valid stanza and so on: This requires sending significantly more assert/valid stanzas, but if done on demand this setup overhead would hopefully be small on average compared to subsequent traffic between the domains. Thoughts? --- 4.3. Invalidation Here or elsewhere, suggest saying that a server SHOULD send an impossible element when it is no longer authoritative for a given domain that it previously validated. The remote server should re-resolve SRV record when receiving the 'impossible' to see if service moved. Servers may also want to periodically resolve SRV and redo validation of remote domains, just in case the remote service fails to notify that it no longer authoritative for a domain. --- 4.4: < type='http://example.com/proof/custom'/> Why not: ? --- 6.4: Once an originating server completes this first validation it signals that it is willing and able to participate in bi-directional XMPP federation traffic, as long as all of the domains required have been asserted and validated at least once on this stream. At Google, we run one set of servers for inbound s2s traffic and one set for outbound for reasons that have to do with our production setup. Changing this to accommodate bi-directional traffic should be doable, but if others have similar setups then it may make sense to consider a one-way traffic option. --- 6.7: If the server receiving a proactive validation is no long authoritative for a given domain, it MUST send an "impossible" element, at which point the sender MUST remove the receiver from any cache and not send any stanzas on this stream to the given domain." s/long/longer --- 6.9 Ensure that only one challenge is outstanding on a given connection for a given domain. Ensure that only one assertion or one proof is outstanding on a given connection for a given domain. Assume 'for a given domain' means 'for a given local domain/remote domain pair'? Seems useful for two big hosting providers to validate many domain pairs in parallel when setting up a connection. From remko.troncon@gmail.com Fri Nov 27 03:14:41 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0AD6A3A6A19 for ; Fri, 27 Nov 2009 03:14:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.677 X-Spam-Level: X-Spam-Status: No, score=-1.677 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oZ2MsUIqN2Q8 for ; Fri, 27 Nov 2009 03:14:40 -0800 (PST) Received: from mail-ew0-f214.google.com (mail-ew0-f214.google.com [209.85.219.214]) by core3.amsl.com (Postfix) with ESMTP id 15B0A3A6A29 for ; Fri, 27 Nov 2009 03:14:39 -0800 (PST) Received: by ewy6 with SMTP id 6so468716ewy.29 for ; Fri, 27 Nov 2009 03:14:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:date:x-google-sender-auth:message-id:subject:from:to:cc :content-type; bh=hr1yEVX5Cfijuj9KPJMbRlGNSdIs9fBDw8Dkr5GAI98=; b=mlpawfB3pbtGn7xn8ljqFTlZooEXUdATUM7IxAGUxAdZ9E0eJ56JZQ4hoCwvPrCAHv PXlpvIa6pns4jU75Wqo7exxZ8Pd5nvl+d7FjY0mggKjbzFl+ohmEn/jOYYj1ul3OD+gA hUULnIHH1aNyl6l2b054sS+UUEZAq7vxwytY4= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; b=AvQPH9oKciqWspfANs0xbqoIBjdU1jrMqfyXhM/SOhvo6+BK/xzgq7zl0BfNiLwLhQ ZFV11ayrCpzQ62KHY3h/I1ZPwDzjNu2t+gFsq0G6KVuZwyOex7DpwJRmjNrNV6OLMy/G xBLis3rA0FM6NOIZtu4t5n5Uf2LZszdrPd/Es= MIME-Version: 1.0 Sender: remko.troncon@gmail.com Received: by 10.213.23.151 with SMTP id r23mr1013464ebb.63.1259320464044; Fri, 27 Nov 2009 03:14:24 -0800 (PST) In-Reply-To: <4B03252A.5000409@stpeter.im> References: <4B03252A.5000409@stpeter.im> Date: Fri, 27 Nov 2009 12:14:24 +0100 X-Google-Sender-Auth: 9301285b945c7a63 Message-ID: <133fd4c60911270314m1e21f551n92ac799d52a3e3b2@mail.gmail.com> From: =?UTF-8?Q?Remko_Tron=C3=A7on?= To: Peter Saint-Andre Content-Type: text/plain; charset=UTF-8 Cc: XMPP Subject: Re: [xmpp] 3920bis: stream features X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Nov 2009 11:14:41 -0000 > However, the desire to have this method needs to > be balanced against complexity (perhaps it's really not a big deal to > close the old stream and start a new one). Given that setting up a new stream isn't much work, I would suggest to leave this as it is. I think allowing renegotiation of stream features introduces quite a few code changes. Unless we can think of situations where setting up a new stream is very costly. cheers, Remko From bernard.aboba@gmail.com Sat Nov 28 03:20:06 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F17F3A63EC for ; Sat, 28 Nov 2009 03:20:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eJuXTKv1UVAY for ; Sat, 28 Nov 2009 03:20:01 -0800 (PST) Received: from mail-pz0-f176.google.com (mail-pz0-f176.google.com [209.85.222.176]) by core3.amsl.com (Postfix) with ESMTP id 58B413A692A for ; Sat, 28 Nov 2009 03:20:01 -0800 (PST) Received: by pzk6 with SMTP id 6so1504029pzk.29 for ; Sat, 28 Nov 2009 03:19:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:from:date:message-id :subject:to:content-type; bh=nbqFOpgsVBlt474fARpQgVVlmtK2/Ma6MKK81BNxi/g=; b=aeSZ8necnnWcO3z7HqjTYCDO/1Mf1PUk5kKUCvu/PYTUS52hBo6mrqDkNTyZlFRH3r 1TNroLwuL5HVHAt3rVo/LDCRewtrdhkN/K2PFzEp2m+SJWehVzeZK6aN5o5E4d48uF5a Y/z4Mpe4+mYoszZDexP/Zoq1aGTlTKPiyeGjk= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=A/NoqtTSwYo+BjaOycsD5Yh4qNsfZNJGmQB/7cRTrZ2Kp/ny8o0PqzRcvkJndWL0Rt ET+trfomfr+JNBLfX3QSiAP+bHKwjxW8At3bgDWRub3oDFu3d83nWJ7q4Fx7gJSUxgDX XLTX7hKk7iOLkVTg/7H8w+QGEkh9++wIDPwKM= MIME-Version: 1.0 Received: by 10.142.118.10 with SMTP id q10mr209496wfc.4.1259407192083; Sat, 28 Nov 2009 03:19:52 -0800 (PST) From: Bernard Aboba Date: Sat, 28 Nov 2009 03:19:32 -0800 Message-ID: <223709240911280319m167d45j285361fcc4c09be9@mail.gmail.com> To: xmpp@ietf.org Content-Type: multipart/alternative; boundary=001636e0b8924fcd7a04796c9618 Subject: [xmpp] Review of draft-ietf-xmpp-e2e-requirements-00 X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Nov 2009 11:20:06 -0000 --001636e0b8924fcd7a04796c9618 Content-Type: text/plain; charset=ISO-8859-1 Overview The IETF has attempted (and failed) several times its efforts to specify e2e security for a number of protocols that make use of intermediaries. These include SIP (S/MIME not implemented, SIP Identity not widely deployed), Diameter (CMS not implemented), RADIUS (Kerb-RADIUS not widely deployed) and XMPP (RFC 3923 not widely deployed). If there's anything we've learned from all of this, it is to think very carefully about the role and responsibilities of the intermediaries as well as the endpoint pre-requisites and usage scenarios What has made e2e security so hard to get right in many of the previous cases is that: 1. The "tussle" between endpoints and intermediaries that we see on the Internet at large ends up getting replicated on a smaller scale in the e2e security design, without the rights and responsibilities of the parties ever being clearly defined; 2. The supported endpoint credentials and the pre-requisites for the e2e conversation are not well matched to the relationship between the endpoints. To address issue #1, "Tussle in Cyberspace" suggests going beyond arguments about the proper role of intermediaries to recognize the importance of providing flexibility to the domain administrators to express their preferences. In this particular case, this would involve recognizing that not all domains allow their users to set up e2e security, so that domain administrators require the flexibility to express their preferences on this (and potentially other) aspects. So if the Capulets and Montagues don't want Juliet and Romeo setting up an e2e secure session, the design should allow them to express that prohibition. To address issue #2, it's helpful to think through the scenarios leading up to establishment of an e2e secure session. For example: a. Romeo and Juliet's conversation is fully supported by the Montagues and Capulets (yeah, right) so that they each have a public key certificate provided by the domain CA. b. Romeo and Juliet are able to exchange a (weak? strong?) shared secret out-of-band prior to attempting to set up an e2e security association. c. Romeo and Juliet meet by accident (perhaps in MUC?), and go off for the first (of many?) private chats. Since they don't have an out-of-band mechanism for establishing credentials, they instead only seek the assurance that they are communicating with the same (user? device?) that they contacted initially. So in reviewing this document, I looked for details relating to issues #1 and #2. Detailed Review Section 2 This section seems to define the right scope. Section 3 I'd suggest that you are going to take a position in this section about the acceptability of "leap of faith" (e.g. scenario c above). It is one thing to be vulnerable to a MiTM or Deletion attack on a first encounter; it is another thing to have this vulnerability on every encounter. Elsewhere in the document, it suggests that scenario c is a valid use case, so I'd suggest that it might be worthwhile clarifying this in Section 3. Section 4 Within Confidentiality, the definition of "only to the extent required to route them" requires more clarification. Keep in mind that the Capulets and Montagues may have somewhat differing ideas about what information they "require" prior to agreeing to route a message than Romeo and Juliet do. For example, Financial institutions have logging requirements. As an example, is it sufficient to only make the domain of the destination visible to the originating server, but not the destination username? This would allow the House of Capulet to know that one of their members was communicating with the House of Montague, but perhaps not that Juliet was communicating with Romeo. PKI Independence: Rather than talking about what credentials are *not* required, it might be useful to go through what set of credentials you envisage supporting. In particular, the variation in credentials is important. For example, will you need to support weak passwords as a credential, or is it possible to assume a pre-shared key? Authentication: Do you really want to require that authentication prove the precise identities of the parties, or merely that it prove the possession of a credential (which might have been established in-band at a first meeting)? Given the objection to mandating PKI, requiring a definitive identity proof is somewhat of a contradiction. Identity protection: I think we need to define what "no other entity" means here. The server run by the Capulets authenticates Juliet and the server run by the Montagues authenticates Romeo, so surely these servers can identify them also. To route messages between the servers, it would seem that the destination JIDs also need to be visible. Given this, it would seem that "no other entity" refers to entities other than the servers run by the Capulets and Montagues. Is that right? Or are we trying to keep the identity of the originator from the destination server? Robustness: Is this trying to capture the ability to negotiate key-strength, or is it expressing a potential need for multiple factor authentication or key generation? I wasn't sure on reading it. Certainly, it's a good idea for keys to be generated based on contributions from more than one party, in case one of the parties has a poor quality random number generator. Upgradeability: Are you referring to crypto-agility here (e.g. the ability to negotiate ciphersuites, including key management algorithms)? If so, it might be helpful to clarify exactly what is required to be negotiable and what doesn't. Section 5 Implementability. While it's hard to argue with this paragraph, depending on the definition of "robustness" it is possible that a different *version* of TLS might be required for e2e than might be acceptable for transmission-layer security (e.g. TLS 1.2 vs. 1.0 or 1.1). So you might want to think about whether you're willing to require that an e2e secure implementation have the "latest and greatest" TLS and SASL implementations. Usability. As with the "no PKI requirement" statements earlier, I'd like to see the potential scenarios defined somewhat more. Efficiency. Reading this, I'm not clear how I would apply it to judging whether a particular scheme is efficient or not. For example, there are tables describing how long certain cryptographic operations take on various processors -- but this by itself won't rule almost anything out. For example, TLS only utilizes public key operations during key exchange, and the keys can be reused across sessions via session resume. Given this, even fairly large RSA key sizes could be considered efficient. Flexibility. How is this different from upgradeability? Is this another reference to crypto-agility? Or is this more about credential types? One thing I don't see here is the expression of a preference with respect to encumbrance or key strength. For example, must the mandatory-to-implement algorithms be unencumbered? What key strengths need to be supported? Is there a preference for support of FIPS certified algorithms? (e.g. no use of SHA-1 in signatures). --001636e0b8924fcd7a04796c9618 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Overview

The IETF has attempted (and failed) several times its effor= ts to specify e2e security for a number of protocols that make use of inter= mediaries.=A0 These include SIP (S/MIME not implemented, SIP Identity not w= idely deployed), Diameter (CMS not implemented), RADIUS (Kerb-RADIUS not wi= dely deployed) and XMPP (RFC 3923 not widely deployed).=A0

If there's anything we've learned from all of this, it is to th= ink very carefully about the role and responsibilities of the intermediarie= s as well as the endpoint pre-requisites and usage scenarios

What h= as made e2e security so hard to get right in many of the previous cases is = that:

1. The "tussle" between endpoints and intermediaries that we = see on the Internet at large ends up getting replicated on a smaller scale = in the e2e security design, without the rights and responsibilities of the = parties ever being clearly defined;

2. The supported endpoint credentials and the pre-requisites for the e2= e conversation are not well matched to the relationship between the endpoin= ts.

To address issue #1, "Tussle in Cyberspace" suggests = going beyond arguments about the proper role of intermediaries to recognize= the importance of providing flexibility to the domain administrators to ex= press their preferences.=A0 In this particular case, this would involve rec= ognizing that not all domains allow their users to set up e2e security, so = that domain administrators require the flexibility to express their prefere= nces on this (and potentially other) aspects.=A0 So if the Capulets and Mon= tagues don't want Juliet and Romeo setting up an e2e secure session, th= e design should allow them to express that prohibition.

To address issue #2, it's helpful to think through the scenarios le= ading up to establishment of an e2e secure session.=A0 For example:
a.= =A0 Romeo and Juliet's conversation is fully supported by the Montagues= and Capulets (yeah, right) so that they each have a public key certificate= provided by the domain CA.
b.=A0 Romeo and Juliet are able to exchange a (weak? strong?) shared secret= out-of-band prior to attempting to set up an e2e security association. c.=A0 Romeo and Juliet meet by accident (perhaps in MUC?), and go off for = the first (of many?) private chats.=A0 Since they don't have an out-of-= band mechanism for establishing credentials, they instead only seek the ass= urance that they are communicating with the same (user? device?) that they = contacted initially.=A0

So in reviewing this document, I looked for details relating to issues = #1 and #2.=A0

Detailed Review

Section 2

This section = seems to define the right scope.

Section 3

I'd suggest t= hat you are going to take a position in this section about the acceptabilit= y of "leap of faith"=A0 (e.g. scenario c above).=A0=A0 It is one = thing to be vulnerable to a MiTM or Deletion attack on a first encounter;= =A0 it is another thing to have this vulnerability on every encounter.=A0= =A0 Elsewhere in the document, it suggests that scenario c is a valid use c= ase, so I'd suggest that it might be worthwhile clarifying this in Sect= ion 3.

Section 4

Within Confidentiality, the definition of "only t= o the extent required to route them" requires more clarification.=A0 K= eep in mind that the Capulets and Montagues may have somewhat differing ide= as about what information they "require" prior to agreeing to rou= te a message than Romeo and Juliet do.=A0 For example, Financial institutio= ns have logging requirements.=A0 As an example, is it sufficient to only ma= ke the domain of the destination visible to the originating server, but not= the destination username? This would allow the House of Capulet to know th= at one of their members was communicating with the House of Montague, but p= erhaps not that Juliet was communicating with Romeo.

PKI Independence:=A0 Rather than talking about what credentials are *no= t* required, it might be useful to go through what set of credentials you e= nvisage supporting.=A0 In particular, the variation in credentials is impor= tant.=A0 For example, will you need to support weak passwords as a credenti= al, or is it possible to assume a pre-shared key?=A0

Authentication:=A0 Do you really want to require that authentication pr= ove the precise identities of the parties, or merely that it prove the poss= ession of a credential (which might have been established in-band at a firs= t meeting)?=A0 Given the objection to mandating PKI, requiring a definitive= identity proof is somewhat of a contradiction.=A0

Identity protection:=A0 I think we need to define what "no other e= ntity" means here.=A0 The server run by the Capulets authenticates Jul= iet and the server run by the Montagues authenticates Romeo, so surely thes= e servers can identify them also.=A0 To route messages between the servers,= it would seem that the destination JIDs also need to be visible.=A0 Given = this, it would seem that "no other entity" refers to entities oth= er than the servers run by the Capulets and Montagues.=A0 Is that right?=A0= Or are we trying to keep the identity of the originator from the destinati= on server?

Robustness: Is this trying to capture the ability to negotiate key-stre= ngth, or is it expressing a potential need for multiple factor authenticati= on or key generation?=A0 I wasn't sure on reading it.=A0 Certainly, it&= #39;s a good idea for keys to be generated based on contributions from more= than one party, in case one of the parties has a poor quality random numbe= r generator.

Upgradeability:=A0 Are you referring to crypto-agility here (e.g. the a= bility to negotiate ciphersuites, including key management algorithms)? If so, it might be helpful to clarify exactly what is required to be negot= iable and what doesn't.

Section 5

Implementability.=A0 While it's hard to argue with= this paragraph, depending on the definition of "robustness" it i= s possible that a different *version* of TLS might be required for e2e than= might be acceptable for transmission-layer security (e.g. TLS 1.2 vs. 1.0 = or 1.1).=A0 So you might want to think about whether you're willing to = require that an e2e secure implementation have the "latest and greates= t" TLS and SASL implementations.=A0

Usability.=A0 As with the "no PKI requirement" statements ear= lier, I'd like to see the potential scenarios defined somewhat more.
Efficiency.=A0 Reading this, I'm not clear how I would apply it t= o judging whether a particular scheme is efficient or not.=A0 For example, = there are tables describing how long certain cryptographic operations take = on various processors -- but this by itself won't rule almost anything = out.=A0 For example,=A0 TLS only utilizes public key operations during key = exchange, and the keys can be reused across sessions via session resume.=A0= Given this, even fairly large RSA key sizes could be considered efficient.= =A0

Flexibility.=A0 How is this different from upgradeability?=A0 Is this a= nother reference to crypto-agility?=A0 Or is this more about credential typ= es?=A0

One thing I don't see here is the expression of a prefer= ence with respect to encumbrance or key strength.=A0 For example, must the = mandatory-to-implement algorithms be unencumbered?=A0=A0 What key strengths= need to be supported?=A0 Is there a preference for support of FIPS certifi= ed algorithms? (e.g. no use of SHA-1 in signatures). =A0

--001636e0b8924fcd7a04796c9618-- From stpeter@stpeter.im Mon Nov 30 09:57:53 2009 Return-Path: X-Original-To: xmpp@core3.amsl.com Delivered-To: xmpp@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1221B28C0D0 for ; Mon, 30 Nov 2009 09:57:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.705 X-Spam-Level: X-Spam-Status: No, score=-1.705 tagged_above=-999 required=5 tests=[AWL=-0.895, BAYES_05=-1.11, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nD09a-C42-bQ for ; Mon, 30 Nov 2009 09:57:52 -0800 (PST) Received: from stpeter.im (stpeter.im [207.210.219.233]) by core3.amsl.com (Postfix) with ESMTP id 317593A68A0 for ; Mon, 30 Nov 2009 09:57:52 -0800 (PST) Received: from dhcp-64-101-72-196.cisco.com (dhcp-64-101-72-196.cisco.com [64.101.72.196]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 9D13B40D26; Mon, 30 Nov 2009 10:57:44 -0700 (MST) Message-ID: <4B140797.8050102@stpeter.im> Date: Mon, 30 Nov 2009 10:57:43 -0700 From: Peter Saint-Andre User-Agent: Thunderbird 2.0.0.23 (Macintosh/20090812) MIME-Version: 1.0 To: =?UTF-8?B?UmVta28gVHJvbsOnb24=?= References: <4B03252A.5000409@stpeter.im> <133fd4c60911270314m1e21f551n92ac799d52a3e3b2@mail.gmail.com> In-Reply-To: <133fd4c60911270314m1e21f551n92ac799d52a3e3b2@mail.gmail.com> X-Enigmail-Version: 0.96.0 OpenPGP: url=http://www.saint-andre.com/me/stpeter.asc Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms030804060509060702070103" Cc: XMPP Subject: Re: [xmpp] 3920bis: stream features X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Nov 2009 17:57:53 -0000 This is a cryptographically signed message in MIME format. --------------ms030804060509060702070103 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 11/27/09 4:14 AM, Remko Tron=C3=A7on wrote: >> However, the desire to have this method needs to >> be balanced against complexity (perhaps it's really not a big deal to >> close the old stream and start a new one). >=20 > Given that setting up a new stream isn't much work, I would suggest to > leave this as it is. I think allowing renegotiation of stream features > introduces quite a few code changes. Unless we can think of situations > where setting up a new stream is very costly. I tend to agree. Peter --=20 Peter Saint-Andre https://stpeter.im/ --------------ms030804060509060702070103 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIWnDCC B1cwggY/oAMCAQICAVUwDQYJKoZIhvcNAQEFBQAwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBT aWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRl IENsaWVudCBDQTAeFw0wOTA3MDYwMDAwMDFaFw0xMDA3MDYyMzU5NTlaMIHCMQswCQYDVQQG EwJVUzERMA8GA1UECBMIQ29sb3JhZG8xDzANBgNVBAcTBkRlbnZlcjEiMCAGA1UEChMZWE1Q UCBTdGFuZGFyZHMgRm91bmRhdGlvbjEsMCoGA1UECxMjU3RhcnRDb20gVHJ1c3RlZCBDZXJ0 aWZpY2F0ZSBNZW1iZXIxGjAYBgNVBAMTEVBldGVyIFNhaW50LUFuZHJlMSEwHwYJKoZIhvcN AQkBFhJzdHBldGVyQHN0cGV0ZXIuaW0wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQCas7Mrnh02GakN8sft+HJpU4MwBxEgrGDZ2ZzUxDDt2sEhM+9Q74h955MtgMhK3TeBf6Hs hDh/8Z9G//k2qNA0M2S5rejTqrmW0Jabca/L7BUZ0GhnU2N/2zeciFUmuZ4A2l1T5IMX2ZVP XnNIaefBtbImJAbDz3T0vxkzTtcqgW3wL83PMDiqiuM+e1k+VPvOW4f5ZSGkPIhYCDpWqNE5 wZvjrLNMc8jZOPs9DrsYuIVwU72Vhy1tkEh+w6YpYHrdEUAe+eKe6TuxqZ60e9z3O36uiV// Ms274iD6PbA/IGazJgaAdg6tvPehwTYGJAGmv3PsJKkLGjgoh+RrrM1LAgMBAAGjggOKMIID hjAJBgNVHRMEAjAAMAsGA1UdDwQEAwIEsDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH AwQwHQYDVR0OBBYEFOyws3XWgIY9FP1POVqjdZP9Lu38MB0GA1UdEQQWMBSBEnN0cGV0ZXJA c3RwZXRlci5pbTCBqAYDVR0jBIGgMIGdgBR7iZySlyShhEcCy3T8LvSs3DLl86GBgaR/MH0x CzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUg RGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZp Y2F0aW9uIEF1dGhvcml0eYIBDzCCAUcGA1UdIASCAT4wggE6MIIBNgYLKwYBBAGBtTcBAgAw ggElMC4GCCsGAQUFBwIBFiJodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9wb2xpY3kucGRmMDQG CCsGAQUFBwIBFihodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9pbnRlcm1lZGlhdGUucGRmMIG8 BggrBgEFBQcCAjCBrzAUFg1TdGFydENvbSBMdGQuMAMCAQEagZZMaW1pdGVkIExpYWJpbGl0 eSwgcmVhZCB0aGUgc2VjdGlvbiAqTGVnYWwgTGltaXRhdGlvbnMqIG9mIHRoZSBTdGFydENv bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBQb2xpY3kgYXZhaWxhYmxlIGF0IGh0dHA6Ly93 d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwYwYDVR0fBFwwWjAroCmgJ4YlaHR0cDovL3d3 dy5zdGFydHNzbC5jb20vY3J0dTMtY3JsLmNybDAroCmgJ4YlaHR0cDovL2NybC5zdGFydHNz bC5jb20vY3J0dTMtY3JsLmNybDCBjgYIKwYBBQUHAQEEgYEwfzA5BggrBgEFBQcwAYYtaHR0 cDovL29jc3Auc3RhcnRzc2wuY29tL3N1Yi9jbGFzczMvY2xpZW50L2NhMEIGCCsGAQUFBzAC hjZodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS9jZXJ0cy9zdWIuY2xhc3MzLmNsaWVudC5jYS5j cnQwIwYDVR0SBBwwGoYYaHR0cDovL3d3dy5zdGFydHNzbC5jb20vMA0GCSqGSIb3DQEBBQUA A4IBAQBgv4xFXZqDKSOtnPOVbqOh1brj7oxRaVYk7N0MJG7x9Y/wkO3iwRwizVLcC1bA+D/R gyFilXx6IQWE63Ge2tu+Y4w5QoHYwuUFQuBZuxvZpOa3ykdgPlBQaBM8m+Ien0skwNggaizA X9Pc/sMLpP3jkO1iSF4agy4r5Ed+4G10mP5X0zO3gQwq9Uj4F9tX+58kU+fM1P8Sh+BYR4r/ kSbKE3tWcMaKblWPGwX0nYD26Je7Qb+uX/J5lCgozBrHXQWq8N98iklASf2pv+32Oi1dEjmM UgAm/J2+YmxaI02+c+H6QH8+F3RUjCiRg9XqUNjcrNrnTFnm/iMMZADktsXPMIIHVzCCBj+g AwIBAgIBVTANBgkqhkiG9w0BAQUFADCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBMB4XDTA5MDcwNjAwMDAwMVoXDTEwMDcwNjIzNTk1OVowgcIxCzAJBgNVBAYTAlVTMREw DwYDVQQIEwhDb2xvcmFkbzEPMA0GA1UEBxMGRGVudmVyMSIwIAYDVQQKExlYTVBQIFN0YW5k YXJkcyBGb3VuZGF0aW9uMSwwKgYDVQQLEyNTdGFydENvbSBUcnVzdGVkIENlcnRpZmljYXRl IE1lbWJlcjEaMBgGA1UEAxMRUGV0ZXIgU2FpbnQtQW5kcmUxITAfBgkqhkiG9w0BCQEWEnN0 cGV0ZXJAc3RwZXRlci5pbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqzsyue HTYZqQ3yx+34cmlTgzAHESCsYNnZnNTEMO3awSEz71DviH3nky2AyErdN4F/oeyEOH/xn0b/ +Tao0DQzZLmt6NOquZbQlptxr8vsFRnQaGdTY3/bN5yIVSa5ngDaXVPkgxfZlU9ec0hp58G1 siYkBsPPdPS/GTNO1yqBbfAvzc8wOKqK4z57WT5U+85bh/llIaQ8iFgIOlao0TnBm+Oss0xz yNk4+z0Ouxi4hXBTvZWHLW2QSH7Dpilget0RQB754p7pO7GpnrR73Pc7fq6JX/8yzbviIPo9 sD8gZrMmBoB2Dq2896HBNgYkAaa/c+wkqQsaOCiH5GuszUsCAwEAAaOCA4owggOGMAkGA1Ud EwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNV HQ4EFgQU7LCzddaAhj0U/U85WqN1k/0u7fwwHQYDVR0RBBYwFIESc3RwZXRlckBzdHBldGVy LmltMIGoBgNVHSMEgaAwgZ2AFHuJnJKXJKGERwLLdPwu9KzcMuXzoYGBpH8wfTELMAkGA1UE BhMCSUwxFjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFs IENlcnRpZmljYXRlIFNpZ25pbmcxKTAnBgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5ggEPMIIBRwYDVR0gBIIBPjCCATowggE2BgsrBgEEAYG1NwECADCCASUwLgYI KwYBBQUHAgEWImh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUH AgEWKGh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwgbwGCCsGAQUF BwICMIGvMBQWDVN0YXJ0Q29tIEx0ZC4wAwIBARqBlkxpbWl0ZWQgTGlhYmlsaXR5LCByZWFk IHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENlcnRp ZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL3d3dy5zdGFy dHNzbC5jb20vcG9saWN5LnBkZjBjBgNVHR8EXDBaMCugKaAnhiVodHRwOi8vd3d3LnN0YXJ0 c3NsLmNvbS9jcnR1My1jcmwuY3JsMCugKaAnhiVodHRwOi8vY3JsLnN0YXJ0c3NsLmNvbS9j cnR1My1jcmwuY3JsMIGOBggrBgEFBQcBAQSBgTB/MDkGCCsGAQUFBzABhi1odHRwOi8vb2Nz cC5zdGFydHNzbC5jb20vc3ViL2NsYXNzMy9jbGllbnQvY2EwQgYIKwYBBQUHMAKGNmh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL2NlcnRzL3N1Yi5jbGFzczMuY2xpZW50LmNhLmNydDAjBgNV HRIEHDAahhhodHRwOi8vd3d3LnN0YXJ0c3NsLmNvbS8wDQYJKoZIhvcNAQEFBQADggEBAGC/ jEVdmoMpI62c85Vuo6HVuuPujFFpViTs3QwkbvH1j/CQ7eLBHCLNUtwLVsD4P9GDIWKVfHoh BYTrcZ7a275jjDlCgdjC5QVC4Fm7G9mk5rfKR2A+UFBoEzyb4h6fSyTA2CBqLMBf09z+wwuk /eOQ7WJIXhqDLivkR37gbXSY/lfTM7eBDCr1SPgX21f7nyRT58zU/xKH4FhHiv+RJsoTe1Zw xopuVY8bBfSdgPbol7tBv65f8nmUKCjMGsddBarw33yKSUBJ/am/7fY6LV0SOYxSACb8nb5i bFojTb5z4fpAfz4XdFSMKJGD1epQ2Nys2udMWeb+IwxkAOS2xc8wggfiMIIFyqADAgECAgEP MA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQu MSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQD EyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wNzEwMjQyMTAzMzJaFw0x MjEwMjIyMTAzMzJaMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEr MCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMv U3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwggEiMA0G CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC5o0luEj4gypQIp71Xi2TlXyLYrj9WkRy+d9BO 0FHPYnAsC99/jx/ibNRwIfAoFhZd+LDscdRSckvwuFSz0bKg3z+9o7cwlVAC9AwMWe8IM0Lx c+8etYxsX4WIamG9fjzzi5GAW5ESKzzIN3SxHSplyGCWFwx/pgf1f4y6O9/ym+4f6zaDYP6B x0r+SaJcr6eSGNm7X3EwX1v7XpRBY+aw019o7k72d0IX910F+XGt0OwNdM61Ff3FiTiexeUZ bWxCGm6GZl+SQVG9xYVIgHQaLXoQF+g2wzrmKCbVcZhqH+hrlRnD6PfCuEyX/BR6PlAPRDlQ 6f1u3wqik+LF5P15AgMBAAGjggNbMIIDVzAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBpjAd BgNVHQ4EFgQUe4mckpckoYRHAst0/C70rNwy5fMwgagGA1UdIwSBoDCBnYAUTgvvGqRAW6UX aYcwyjRoQ9BBrvKhgYGkfzB9MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzEpMCcGA1UE AxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHmCAQEwCQYDVR0SBAIwADA9Bggr BgEFBQcBAQQxMC8wLQYIKwYBBQUHMAKGIWh0dHA6Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2Nh LmNydDBgBgNVHR8EWTBXMCygKqAohiZodHRwOi8vY2VydC5zdGFydGNvbS5vcmcvc2ZzY2Et Y3JsLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2EuY3JsMIIBXQYD VR0gBIIBVDCCAVAwggFMBgsrBgEEAYG1NwEBBDCCATswLwYIKwYBBQUHAgEWI2h0dHA6Ly9j ZXJ0LnN0YXJ0Y29tLm9yZy9wb2xpY3kucGRmMDUGCCsGAQUFBwIBFilodHRwOi8vY2VydC5z dGFydGNvbS5vcmcvaW50ZXJtZWRpYXRlLnBkZjCB0AYIKwYBBQUHAgIwgcMwJxYgU3RhcnQg Q29tbWVyY2lhbCAoU3RhcnRDb20pIEx0ZC4wAwIBARqBl0xpbWl0ZWQgTGlhYmlsaXR5LCBy ZWFkIHRoZSBzZWN0aW9uICpMZWdhbCBMaW1pdGF0aW9ucyogb2YgdGhlIFN0YXJ0Q29tIENl cnRpZmljYXRpb24gQXV0aG9yaXR5IFBvbGljeSBhdmFpbGFibGUgYXQgaHR0cDovL2NlcnQu c3RhcnRjb20ub3JnL3BvbGljeS5wZGYwEQYJYIZIAYb4QgEBBAQDAgAHMFAGCWCGSAGG+EIB DQRDFkFTdGFydENvbSBDbGFzcyAzIFByaW1hcnkgSW50ZXJtZWRpYXRlIEZyZWUgU1NMIEVt YWlsIENlcnRpZmljYXRlczANBgkqhkiG9w0BAQUFAAOCAgEAUpcEDdsKFRCxFBxcSm+8oMTT fpS7fbZkxWHx5fHDjvAgaBQ+oY0tk4xtbD6VxeHYjxI63+hj8jICnqeVXPe34Bu+XzekIn2T lrnPCQobKdQF2p52QgUvIxSURed0jcBaCBV22DSKaUqDOzD/Tx6VQy78zpblXjRH7OALE/+H jzJVmspdnBUUtQOLYgPo924xkxR25VDdgtEE5vAXa/g2oCeZhy0ZEO4NbgIayAYCJcJRDz0h dD2Ahec65Kw6LB3N7VXEjiRR5/WoKwH/QteRzPJbFDc1somrApjm2cyg+5nbm1RHeFIz+GxX luRrPztvhNcby0PtAjqwY1txi4sW0R6ZJPuZ2DZ1/dzckoFhyZgFyOX3SEkNXVLldjTzneFJ FnVSzDbc720vq184jR7pYoI9+f5QJ96a0iLxEAG8SJ5auBwXI/w2FmKmwmdMvJ8/17+B4sMC IRrXrDQl2xzpVXh/Qcmk5nf+w8HFmqATGy1OUAQbXga7AySAUaYhvvFk50u0bO5DiUGwzrJO 3TrwvaC2Ei4EFaBmIVgG7TfU5TaaY9IcJSCQ7AGUYE3RFSRpsLOoA3DsxP42YERgS/Nxw29+ YqZtPoO2QPbNpI7xnHVCfNBabx3oDIf438nFfv8spw5BQqBSbEF1izJA57eE64CzHnt7lB20 OFD11avYopwxggPKMIIDxgIBATCBkjCBjDELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcx ODA2BgNVBAMTL1N0YXJ0Q29tIENsYXNzIDMgUHJpbWFyeSBJbnRlcm1lZGlhdGUgQ2xpZW50 IENBAgFVMAkGBSsOAwIaBQCgggIMMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI hvcNAQkFMQ8XDTA5MTEzMDE3NTc0M1owIwYJKoZIhvcNAQkEMRYEFB3WGE7uuyxnZR2jFkUM aBj3MuU8MF8GCSqGSIb3DQEJDzFSMFAwCwYJYIZIAWUDBAECMAoGCCqGSIb3DQMHMA4GCCqG SIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUrDgMCBzANBggqhkiG9w0DAgIBKDCBowYJ KwYBBAGCNxAEMYGVMIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRk LjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UE AxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAVUw gaUGCyqGSIb3DQEJEAILMYGVoIGSMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4 MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3MgMyBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQg Q0ECAVUwDQYJKoZIhvcNAQEBBQAEggEAlkI5qwzrTPCQ0sOVyn5reVOw3IPdMrt9bcGJOGOH o2oYY8OoyE1h4x4PCY9nYM37dTZhobeQ4wXo4TARh873DGwQOnz/5bOIxCRJA4fpmq+3xRvi yO3/dWjbSsok69nrSG2nOACeEJJKzRWU3tFpzvHW544XJhVEVBJelGn1i64i5GRwwUxsYIE6 uvfq9cse0BY7B6TfKngQLGxwN3kqH2gxKwPkcjzrQvMQJjJ4tNmc57fgYLpbV3Frw/YB9l4R TAjRpELKg6Tc/XhFdu5tg3Swr1FdSLgyR2chhm4CNUP9wYZ1t60Zoz8Bym3xLxqZBq/YW690 vwfBBrJWysvwDAAAAAAAAA== --------------ms030804060509060702070103--