From ben@nostrum.com Tue Sep 6 14:18:40 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E313721F8E8E for ; Tue, 6 Sep 2011 14:18:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.482 X-Spam-Level: X-Spam-Status: No, score=-102.482 tagged_above=-999 required=5 tests=[AWL=0.118, BAYES_00=-2.599, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6hfaQFkFfgH4 for ; Tue, 6 Sep 2011 14:18:40 -0700 (PDT) Received: from nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by ietfa.amsl.com (Postfix) with ESMTP id 591D921F8E8A for ; Tue, 6 Sep 2011 14:18:40 -0700 (PDT) Received: from dn3-227.estacado.net (vicuna-alt.estacado.net [75.53.54.121]) (authenticated bits=0) by nostrum.com (8.14.3/8.14.3) with ESMTP id p86LKQGp018572 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO); Tue, 6 Sep 2011 16:20:27 -0500 (CDT) (envelope-from ben@nostrum.com) From: Ben Campbell Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Tue, 6 Sep 2011 16:20:30 -0500 Message-Id: <55D78412-91F2-4352-A0A2-3011E27D429D@nostrum.com> To: XMPP Group Mime-Version: 1.0 (Apple Message framework v1244.3) X-Mailer: Apple Mail (2.1244.3) Received-SPF: pass (nostrum.com: 75.53.54.121 is authenticated by a trusted mechanism) Cc: Joe Hildebrand Subject: [xmpp] Taipei Meeting X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Sep 2011 21:18:41 -0000 Hi, The IETF is in the process of planning work group meetings for IETF82 in = Taipei this November. The co-chairs are of the opinion that we do not need a formal XMPP = meeting this time around. Much of our remaining work has dependencies on = work from other areas, and we believe the remaining work can progress = without a face to face meeting this time around.=20 Does anyone feel differently? If so, please let us know as soon as = possible. The cutoff for us to request a meeting if we need one is = September 26, but if we know we are not going to meet, we should inform = the secretariat as soon as possible. We encourage XMPP participants to attend IETF82 whether or not there is = an XMPP meeting, and to continue to participate in the remaining XMPP = milestone work on the work group list, as well as participate in those = other groups we depend on, such as PRECIS and potentially JOSE, assuming = that group is approved. Thanks! Ben.= From holler@ahsoftware.de Fri Sep 9 02:10:18 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFBEC21F8B22 for ; Fri, 9 Sep 2011 02:10:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.49 X-Spam-Level: X-Spam-Status: No, score=-0.49 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A4ItWcy7sON8 for ; Fri, 9 Sep 2011 02:10:18 -0700 (PDT) Received: from mail.ahsoftware.de (h1446028.stratoserver.net [85.214.92.142]) by ietfa.amsl.com (Postfix) with ESMTP id 41F1A21F899F for ; Fri, 9 Sep 2011 02:10:17 -0700 (PDT) Received: by mail.ahsoftware.de (Postfix, from userid 65534) id A8D01434243; Fri, 9 Sep 2011 11:11:53 +0200 (CEST) Received: from eiche.ahsoftware (p57B20226.dip0.t-ipconnect.de [87.178.2.38]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.ahsoftware.de (Postfix) with ESMTPSA id 0560F434061 for ; Fri, 9 Sep 2011 11:11:49 +0200 (CEST) Received: by eiche.ahsoftware (Postfix, from userid 65534) id 8FC313FCA2; Fri, 9 Sep 2011 11:11:48 +0200 (CEST) Received: from krabat.ahsoftware (unknown [192.168.207.2]) by eiche.ahsoftware (Postfix) with ESMTP id 947063FCA2; Fri, 9 Sep 2011 09:10:26 +0000 (UTC) Message-ID: <4E69D7FF.7030409@ahsoftware.de> Date: Fri, 09 Sep 2011 11:10:23 +0200 From: Alexander Holler User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc13 Lightning/1.0b3pre Thunderbird/3.1.10 MIME-Version: 1.0 To: Dave Cridland References: <9841FBF8-11D1-4A81-953E-920EEDA00208@bbn.com> <9031.1310985132.470776@puncture> In-Reply-To: <9031.1310985132.470776@puncture> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: XMPP Working Group Subject: Re: [xmpp] DNA/S2S Part 2: Authentication X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Sep 2011 09:10:18 -0000 Am 18.07.2011 12:32, schrieb Dave Cridland: > I wouldn't want to abandon DNSSEC entirely - I think it's a sensible > direction, and although "CA's are free these days", there is a certain > degree of getting what one pays for, and it seems to me that DNSSEC > should dilute in this manner to a lesser degree. Regarding the current mess with CAs I would prefer every solution which doesn't need a certificate. It looks like that "CA's are free these days" has had some impact on the QA of them. Nobody asked me directly, but I think I should throw in my general dislike of certificates you can't control yourself into this discussion. ;) Regards, Alexander From holler@ahsoftware.de Fri Sep 9 06:43:59 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE87721F8AE6 for ; Fri, 9 Sep 2011 06:43:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.49 X-Spam-Level: X-Spam-Status: No, score=-0.49 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kfyHBOpzYjGK for ; Fri, 9 Sep 2011 06:43:59 -0700 (PDT) Received: from mail.ahsoftware.de (h1446028.stratoserver.net [85.214.92.142]) by ietfa.amsl.com (Postfix) with ESMTP id 6DC2C21F8AB8 for ; Fri, 9 Sep 2011 06:43:59 -0700 (PDT) Received: by mail.ahsoftware.de (Postfix, from userid 65534) id 41C3D434615; Fri, 9 Sep 2011 15:45:52 +0200 (CEST) Received: from eiche.ahsoftware (p57B20226.dip0.t-ipconnect.de [87.178.2.38]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.ahsoftware.de (Postfix) with ESMTPSA id 7C709434615 for ; Fri, 9 Sep 2011 15:45:49 +0200 (CEST) Received: by eiche.ahsoftware (Postfix, from userid 65534) id 6C34B3FD2C; Fri, 9 Sep 2011 15:45:34 +0200 (CEST) Received: from krabat.ahsoftware (unknown [192.168.207.2]) by eiche.ahsoftware (Postfix) with ESMTP id ECD4A3FD21 for ; Fri, 9 Sep 2011 13:44:48 +0000 (UTC) Message-ID: <4E6A184F.6000107@ahsoftware.de> Date: Fri, 09 Sep 2011 15:44:47 +0200 From: Alexander Holler User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc13 Lightning/1.0b3pre Thunderbird/3.1.10 MIME-Version: 1.0 To: xmpp@ietf.org Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Subject: [xmpp] RFC 6120 4.9.1.2 and stream errors _before_ the initial header was send X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Sep 2011 13:44:00 -0000 Hello, I think the wording in RFC 6120 4.9.1.2 should be changed from 'If the error is triggered by the initial stream header, ...' to 'If the error is triggered before or by the initial stream header, ...' The following case just happened here: Client sends a after SSL negotiaton but with without sending an initial (for the restarted stream). If the server wants to send back an informational and correct error message, it should have to send an . This just would leave open the question which data the stream tag should have, maybe just the 'from' and 'xmls' attributes (because it doesn't know what it should use as 'to'. Regards, Alexander From stpeter@stpeter.im Mon Sep 12 14:41:48 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29DBE21F8D21 for ; Mon, 12 Sep 2011 14:41:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.545 X-Spam-Level: X-Spam-Status: No, score=-102.545 tagged_above=-999 required=5 tests=[AWL=0.054, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MBfuMuXugiz1 for ; Mon, 12 Sep 2011 14:41:47 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 8A97B21F8A7B for ; Mon, 12 Sep 2011 14:41:47 -0700 (PDT) Received: from dhcp-64-101-72-178.cisco.com (unknown [64.101.72.178]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 2BC35419E0; Mon, 12 Sep 2011 15:47:03 -0600 (MDT) Message-ID: <4E6E7D16.7040205@stpeter.im> Date: Mon, 12 Sep 2011 15:43:50 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:6.0.2) Gecko/20110902 Thunderbird/6.0.2 MIME-Version: 1.0 To: Alexander Holler References: <9841FBF8-11D1-4A81-953E-920EEDA00208@bbn.com> <9031.1310985132.470776@puncture> <4E69D7FF.7030409@ahsoftware.de> In-Reply-To: <4E69D7FF.7030409@ahsoftware.de> X-Enigmail-Version: 1.3.1 OpenPGP: url=https://stpeter.im/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: XMPP Working Group Subject: Re: [xmpp] DNA/S2S Part 2: Authentication X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Sep 2011 21:41:48 -0000 On 9/9/11 3:10 AM, Alexander Holler wrote: > Am 18.07.2011 12:32, schrieb Dave Cridland: > >> I wouldn't want to abandon DNSSEC entirely - I think it's a sensible >> direction, and although "CA's are free these days", there is a certain >> degree of getting what one pays for, and it seems to me that DNSSEC >> should dilute in this manner to a lesser degree. > > Regarding the current mess with CAs I would prefer every solution which > doesn't need a certificate. Not every certificate is CA-issued. > It looks like that "CA's are free these days" has had some impact on the > QA of them. That depends on the CA. Peter -- Peter Saint-Andre https://stpeter.im/ From stpeter@stpeter.im Mon Sep 12 15:08:48 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2181221F8E9A for ; Mon, 12 Sep 2011 15:08:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.548 X-Spam-Level: X-Spam-Status: No, score=-102.548 tagged_above=-999 required=5 tests=[AWL=0.051, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TnTgEORymtqn for ; Mon, 12 Sep 2011 15:08:47 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 4587721F8E98 for ; Mon, 12 Sep 2011 15:08:47 -0700 (PDT) Received: from dhcp-64-101-72-178.cisco.com (unknown [64.101.72.178]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 15FB1419E8; Mon, 12 Sep 2011 16:14:02 -0600 (MDT) Message-ID: <4E6E836A.30703@stpeter.im> Date: Mon, 12 Sep 2011 16:10:50 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:6.0.2) Gecko/20110902 Thunderbird/6.0.2 MIME-Version: 1.0 To: Alexander Holler References: <4E6A184F.6000107@ahsoftware.de> In-Reply-To: <4E6A184F.6000107@ahsoftware.de> X-Enigmail-Version: 1.3.1 OpenPGP: url=https://stpeter.im/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: xmpp@ietf.org Subject: Re: [xmpp] RFC 6120 4.9.1.2 and stream errors _before_ the initial header was send X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Sep 2011 22:08:48 -0000 On 9/9/11 7:44 AM, Alexander Holler wrote: > Hello, > > I think the wording in RFC 6120 4.9.1.2 should be changed from > > 'If the error is triggered by the initial stream header, ...' > > to > > 'If the error is triggered before or by the initial stream header, ...' > > The following case just happened here: > > Client sends a after SSL negotiaton but with without > sending an initial (for the restarted stream). > > If the server wants to send back an informational and correct error > message, it should have to send an > . > > This just would leave open the question which data the stream tag should > have, maybe just the 'from' and 'xmls' attributes (because it doesn't > know what it should use as 'to'. Thanks, I'll take this under advisement when we revise RFC 6120. Peter -- Peter Saint-Andre https://stpeter.im/ From holler@ahsoftware.de Mon Sep 12 21:40:13 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6340921F8C2B for ; Mon, 12 Sep 2011 21:40:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.49 X-Spam-Level: X-Spam-Status: No, score=-0.49 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1X+xC09+HjvN for ; Mon, 12 Sep 2011 21:40:13 -0700 (PDT) Received: from mail.ahsoftware.de (h1446028.stratoserver.net [85.214.92.142]) by ietfa.amsl.com (Postfix) with ESMTP id A0B2921F8C28 for ; Mon, 12 Sep 2011 21:40:12 -0700 (PDT) Received: by mail.ahsoftware.de (Postfix, from userid 65534) id 17042434A4D; Tue, 13 Sep 2011 06:42:16 +0200 (CEST) Received: from eiche.ahsoftware (p57B206AE.dip0.t-ipconnect.de [87.178.6.174]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.ahsoftware.de (Postfix) with ESMTPSA id 4D5504348C0 for ; Tue, 13 Sep 2011 06:42:13 +0200 (CEST) Received: by eiche.ahsoftware (Postfix, from userid 65534) id 858833FD4A; Tue, 13 Sep 2011 06:42:12 +0200 (CEST) Received: from krabat.ahsoftware (unknown [192.168.207.2]) by eiche.ahsoftware (Postfix) with ESMTP id 5F7F33FCD4; Tue, 13 Sep 2011 04:41:17 +0000 (UTC) Message-ID: <4E6EDEE9.40109@ahsoftware.de> Date: Tue, 13 Sep 2011 06:41:13 +0200 From: Alexander Holler User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc13 Lightning/1.0b3pre Thunderbird/3.1.10 MIME-Version: 1.0 To: Peter Saint-Andre References: <9841FBF8-11D1-4A81-953E-920EEDA00208@bbn.com> <9031.1310985132.470776@puncture> <4E69D7FF.7030409@ahsoftware.de> <4E6E7D16.7040205@stpeter.im> In-Reply-To: <4E6E7D16.7040205@stpeter.im> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: XMPP Working Group Subject: Re: [xmpp] DNA/S2S Part 2: Authentication X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Sep 2011 04:40:13 -0000 Am 12.09.2011 23:43, schrieb Peter Saint-Andre: > On 9/9/11 3:10 AM, Alexander Holler wrote: >> Am 18.07.2011 12:32, schrieb Dave Cridland: >> >>> I wouldn't want to abandon DNSSEC entirely - I think it's a sensible >>> direction, and although "CA's are free these days", there is a certain >>> degree of getting what one pays for, and it seems to me that DNSSEC >>> should dilute in this manner to a lesser degree. >> >> Regarding the current mess with CAs I would prefer every solution which >> doesn't need a certificate. > > Not every certificate is CA-issued. Yes, therefore I've written that in last sentence you haven't quoted "certificates you can't control yourself". ;) > >> It looks like that "CA's are free these days" has had some impact on the >> QA of them. > > That depends on the CA. Sure, but the problem with the system used for SSL is that one untrusted (or hacked) CA is enough to disable the whole system. E.g. take two CAs from two countries which doesn't like each other. How should a third party handle that case? To make both countries happy you would have to disable certificates for domains (and more) from country A issued by the CA in country B (and vice versa). And that doesn't only affect the two countries, every third party can't trust certificates for domains in country A issued by the CA in country B. Regards, Alexander From stpeter@stpeter.im Tue Sep 13 08:28:44 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 619A721F8AAC for ; Tue, 13 Sep 2011 08:28:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.549 X-Spam-Level: X-Spam-Status: No, score=-102.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cUkiXWOjPuUe for ; Tue, 13 Sep 2011 08:28:39 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id BDAA721F87FA for ; Tue, 13 Sep 2011 08:28:39 -0700 (PDT) Received: from dhcp-64-101-72-178.cisco.com (unknown [64.101.72.178]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 3B392419E5; Tue, 13 Sep 2011 09:33:59 -0600 (MDT) Message-ID: <4E6F7722.4020403@stpeter.im> Date: Tue, 13 Sep 2011 09:30:42 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:6.0.2) Gecko/20110902 Thunderbird/6.0.2 MIME-Version: 1.0 To: Alexander Holler References: <9841FBF8-11D1-4A81-953E-920EEDA00208@bbn.com> <9031.1310985132.470776@puncture> <4E69D7FF.7030409@ahsoftware.de> <4E6E7D16.7040205@stpeter.im> <4E6EDEE9.40109@ahsoftware.de> In-Reply-To: <4E6EDEE9.40109@ahsoftware.de> X-Enigmail-Version: 1.3.1 OpenPGP: url=https://stpeter.im/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: XMPP Working Group Subject: Re: [xmpp] DNA/S2S Part 2: Authentication X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Sep 2011 15:28:44 -0000 On 9/12/11 10:41 PM, Alexander Holler wrote: > Am 12.09.2011 23:43, schrieb Peter Saint-Andre: >> On 9/9/11 3:10 AM, Alexander Holler wrote: >>> Am 18.07.2011 12:32, schrieb Dave Cridland: >>> >>>> I wouldn't want to abandon DNSSEC entirely - I think it's a sensible >>>> direction, and although "CA's are free these days", there is a certain >>>> degree of getting what one pays for, and it seems to me that DNSSEC >>>> should dilute in this manner to a lesser degree. >>> >>> Regarding the current mess with CAs I would prefer every solution which >>> doesn't need a certificate. >> >> Not every certificate is CA-issued. > > Yes, therefore I've written that in last sentence you haven't quoted > "certificates you can't control yourself". ;) > >> >>> It looks like that "CA's are free these days" has had some impact on the >>> QA of them. >> >> That depends on the CA. > > Sure, but the problem with the system used for SSL is that one untrusted > (or hacked) CA is enough to disable the whole system. > > E.g. take two CAs from two countries which doesn't like each other. How > should a third party handle that case? To make both countries happy you > would have to disable certificates for domains (and more) from country A > issued by the CA in country B (and vice versa). And that doesn't only > affect the two countries, every third party can't trust certificates for > domains in country A issued by the CA in country B. This is an interesting discussion, but off-topic for the XMPP WG. Here's a list where such things are on-topic and actively being discussed: http://lists.randombit.net/mailman/listinfo/cryptography Peter -- Peter Saint-Andre https://stpeter.im/ From holler@ahsoftware.de Tue Sep 13 12:18:19 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8364111E80BB for ; Tue, 13 Sep 2011 12:18:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.49 X-Spam-Level: X-Spam-Status: No, score=-0.49 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HELO_EQ_DE=0.35, HELO_MISMATCH_DE=1.448, HOST_MISMATCH_NET=0.311] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7pxjSORKURxU for ; Tue, 13 Sep 2011 12:18:19 -0700 (PDT) Received: from mail.ahsoftware.de (h1446028.stratoserver.net [85.214.92.142]) by ietfa.amsl.com (Postfix) with ESMTP id BC93611E80BA for ; Tue, 13 Sep 2011 12:18:18 -0700 (PDT) Received: by mail.ahsoftware.de (Postfix, from userid 65534) id 8E017434B61; Tue, 13 Sep 2011 21:20:22 +0200 (CEST) Received: from eiche.ahsoftware (p57B206AE.dip0.t-ipconnect.de [87.178.6.174]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.ahsoftware.de (Postfix) with ESMTPSA id 9D894434B5F for ; Tue, 13 Sep 2011 21:20:18 +0200 (CEST) Received: by eiche.ahsoftware (Postfix, from userid 65534) id 50DEC41AA2; Tue, 13 Sep 2011 21:20:10 +0200 (CEST) Received: from krabat.ahsoftware (unknown [192.168.207.2]) by eiche.ahsoftware (Postfix) with ESMTP id C207B3FD81 for ; Tue, 13 Sep 2011 13:19:54 +0000 (UTC) Message-ID: <4E6F5879.6000106@ahsoftware.de> Date: Tue, 13 Sep 2011 15:19:53 +0200 From: Alexander Holler User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.17) Gecko/20110428 Fedora/3.1.10-1.fc13 Lightning/1.0b3pre Thunderbird/3.1.10 MIME-Version: 1.0 To: xmpp@ietf.org References: <9841FBF8-11D1-4A81-953E-920EEDA00208@bbn.com> <9031.1310985132.470776@puncture> <4E69D7FF.7030409@ahsoftware.de> <4E6E7D16.7040205@stpeter.im> <4E6EDEE9.40109@ahsoftware.de> In-Reply-To: <4E6EDEE9.40109@ahsoftware.de> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [xmpp] DNA/S2S Part 2: Authentication X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Sep 2011 19:18:19 -0000 Am 13.09.2011 06:41, schrieb Alexander Holler: > Am 12.09.2011 23:43, schrieb Peter Saint-Andre: >> On 9/9/11 3:10 AM, Alexander Holler wrote: >>> Am 18.07.2011 12:32, schrieb Dave Cridland: >>> >>>> I wouldn't want to abandon DNSSEC entirely - I think it's a sensible >>>> direction, and although "CA's are free these days", there is a certain >>>> degree of getting what one pays for, and it seems to me that DNSSEC >>>> should dilute in this manner to a lesser degree. >>> >>> Regarding the current mess with CAs I would prefer every solution which >>> doesn't need a certificate. >> >> Not every certificate is CA-issued. > > Yes, therefore I've written that in last sentence you haven't quoted > "certificates you can't control yourself". ;) > >> >>> It looks like that "CA's are free these days" has had some impact on the >>> QA of them. >> >> That depends on the CA. > > Sure, but the problem with the system used for SSL is that one untrusted > (or hacked) CA is enough to disable the whole system. > > E.g. take two CAs from two countries which doesn't like each other. How > should a third party handle that case? To make both countries happy you > would have to disable certificates for domains (and more) from country A > issued by the CA in country B (and vice versa). And that doesn't only > affect the two countries, every third party can't trust certificates for > domains in country A issued by the CA in country B. Just to make that clear: It doesn't have to be a problem of the CAs and I didn't want to say that most CAs are having bad QA. In fact I think and hope most CAs are trustworthy. But e.g. in the case with the two countries, both CAs are operating under the laws of their country. And almost any country has some laws which gives the government some rights to do things people outside (or even inside) that country don't necessarily like. And SSL just misses a link from service providers to CAs (or) certificates. How to know which CAs or certificates are trusted by the service you want to reach? I know it's (currently) a difficult question and I don't expect an answer. To get to the roots, I think a solution might be to use the DNS to solve that problem. You have to trust the DNS, otherwise you can't reach the remote service (at least not when operating with domain names). So if you (have to) trust whatever you get through the DNS ... But I don't want to elaborate this here more. ;) Regards, Alexander From 5xi0uj@nottheoilrig.com Mon Sep 19 10:35:24 2011 Return-Path: <5xi0uj@nottheoilrig.com> X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B02221F8C4E for ; Mon, 19 Sep 2011 10:35:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.855 X-Spam-Level: X-Spam-Status: No, score=-2.855 tagged_above=-999 required=5 tests=[AWL=0.255, BAYES_05=-1.11, GB_I_LETTER=-2] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z9ZAs2J3eE0K for ; Mon, 19 Sep 2011 10:35:24 -0700 (PDT) Received: from mail.nottheoilrig.com (mail.nottheoilrig.com [50.16.249.74]) by ietfa.amsl.com (Postfix) with ESMTP id E135A21F8C4F for ; Mon, 19 Sep 2011 10:35:23 -0700 (PDT) Received: from mail.nottheoilrig.com (localhost [127.0.0.1]) by mail.nottheoilrig.com (Postfix) with ESMTP id 2C98A40ACF for ; Mon, 19 Sep 2011 17:37:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nottheoilrig.com; s=mail; t=1316453864; bh=MTYXaE84zoHqdItiE9TC4xXGIQwKo9SeHykNaCPHals=; h=Date:From:To:Subject:Message-ID:MIME-Version:Content-Type; b=xWwjhrihbeDf3ik0x4rHNZwGu8Q2QEUfuZqmN1Hek/lpjdgMj1XGNBjGSV7J16vIU virgKKMtlsgImHUWMtbZjQWTgMyg4fSX6lJg7AvPdTeowBeZILp9Q++UxvZFB8kSBy x+meEsNvlQ2oXpOIdEjHaoTLulr6hkl2LQ/fVNYw= Received: from selene (unknown [184.66.112.45]) by mail.nottheoilrig.com (Postfix) with ESMTPSA for ; Mon, 19 Sep 2011 17:37:43 +0000 (UTC) Received: from jablko by selene with local (Exim 4.76) (envelope-from ) id 1R5hmo-0003hD-WB for xmpp@ietf.org; Mon, 19 Sep 2011 10:37:43 -0700 Date: Mon, 19 Sep 2011 10:37:42 -0700 From: Jack Bates <5xi0uj@nottheoilrig.com> To: xmpp@ietf.org Message-ID: <20110919173741.GA27339@selene> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) Subject: [xmpp] RFC 6122 ABNF ambiguity? X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Sep 2011 17:35:24 -0000 Hi, I think there's an ambiguity in the RFC 6122 ABNF? ifqdn = 1*(namepoint) ; ; a "namepoint" is a UTF-8 encoded Unicode ; code point that satisfies the Nameprep ; profile of stringprep I think it should specify "with the UseSTD3ASCIIRules flag set (thus forbidding ASCII code points other than letters, digits, and hyphens)", like it does elsewhere in the RFC. Otherwise I think slash ("/") "satisfies the Nameprep profile of stringprep"? So it's ambiguous whether the ABNF, when applied to the JID "example.com/blah", yields: domainpart="example.com" resourcepart="blah" - or - domainpart="example.com/blah" However if it *does* specify "with the UseSTD3ASCIIRules flag set (thus forbidding ASCII code points other than letters, digits, and hyphens)", then it will fail to match the JID "example.com/blah" because dot (".") is an "ASCII code point other than letters, digits, and hyphens"? From stpeter@stpeter.im Mon Sep 19 10:44:29 2011 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9D1B21F8C8B for ; Mon, 19 Sep 2011 10:44:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -103.599 X-Spam-Level: X-Spam-Status: No, score=-103.599 tagged_above=-999 required=5 tests=[AWL=1.000, BAYES_00=-2.599, GB_I_LETTER=-2, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K5HgbH0NWhRu for ; Mon, 19 Sep 2011 10:44:29 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 1756221F8C8A for ; Mon, 19 Sep 2011 10:44:28 -0700 (PDT) Received: from dhcp-64-101-72-178.cisco.com (unknown [64.101.72.178]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id E52CC418BB; Mon, 19 Sep 2011 11:50:22 -0600 (MDT) Message-ID: <4E77800A.3030209@stpeter.im> Date: Mon, 19 Sep 2011 11:46:50 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.5; rv:6.0.2) Gecko/20110902 Thunderbird/6.0.2 MIME-Version: 1.0 To: Jack Bates <5xi0uj@nottheoilrig.com> References: <20110919173741.GA27339@selene> In-Reply-To: <20110919173741.GA27339@selene> X-Enigmail-Version: 1.3.1 OpenPGP: url=https://stpeter.im/stpeter.asc Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: xmpp@ietf.org Subject: Re: [xmpp] RFC 6122 ABNF ambiguity? X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Sep 2011 17:44:29 -0000 On 9/19/11 11:37 AM, Jack Bates wrote: > Hi, I think there's an ambiguity in the RFC 6122 ABNF? > > ifqdn = 1*(namepoint) > ; > ; a "namepoint" is a UTF-8 encoded Unicode > ; code point that satisfies the Nameprep > ; profile of stringprep > > I think it should specify "with the UseSTD3ASCIIRules flag set (thus forbidding > ASCII code points other than letters, digits, and hyphens)", like it does > elsewhere in the RFC. Otherwise I think slash ("/") "satisfies the Nameprep > profile of stringprep"? So it's ambiguous whether the ABNF, when applied to > the JID "example.com/blah", yields: > > domainpart="example.com" > resourcepart="blah" > > - or - > > domainpart="example.com/blah" > > However if it *does* specify "with the UseSTD3ASCIIRules flag set (thus > forbidding ASCII code points other than letters, digits, and hyphens)", then it > will fail to match the JID "example.com/blah" because dot (".") is an "ASCII > code point other than letters, digits, and hyphens"? The intent is to obsolete RFC 6122 using a non-stringprep approach, so I think it would be more constructive to receive feedback on 6122bis: http://tools.ietf.org/html/draft-saintandre-xmpp-6122bis-02 Peter -- Peter Saint-Andre https://stpeter.im/