From ben@nostrum.com Tue Sep 3 08:12:06 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7932D21F9F6C for ; Tue, 3 Sep 2013 08:12:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.559 X-Spam-Level: X-Spam-Status: No, score=-102.559 tagged_above=-999 required=5 tests=[AWL=0.041, BAYES_00=-2.599, SPF_PASS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f9RuyOHEJ+o8 for ; Tue, 3 Sep 2013 08:12:06 -0700 (PDT) Received: from shaman.nostrum.com (nostrum-pt.tunnel.tserv2.fmt.ipv6.he.net [IPv6:2001:470:1f03:267::2]) by ietfa.amsl.com (Postfix) with ESMTP id 2E04121F9E3A for ; Tue, 3 Sep 2013 08:12:04 -0700 (PDT) Received: from [10.0.1.9] (cpe-76-187-89-238.tx.res.rr.com [76.187.89.238]) (authenticated bits=0) by shaman.nostrum.com (8.14.3/8.14.3) with ESMTP id r83FBucX054310 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NO) for ; Tue, 3 Sep 2013 10:11:57 -0500 (CDT) (envelope-from ben@nostrum.com) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Ben Campbell In-Reply-To: <03C5234F-7DEE-4EFD-AFDF-C2CBF53BD099@nostrum.com> Date: Tue, 3 Sep 2013 10:11:57 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <8C7CAD90-B5DA-40D0-933C-93E0A409DDA3@nostrum.com> References: <03C5234F-7DEE-4EFD-AFDF-C2CBF53BD099@nostrum.com> To: XMPP Group X-Mailer: Apple Mail (2.1508) Received-SPF: pass (shaman.nostrum.com: 76.187.89.238 is authenticated by a trusted mechanism) Subject: Re: [xmpp] Consensus Call : Adoption of draft-moffitt-xmpp-over-websocket X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Sep 2013 15:12:06 -0000 (as chair) The chairs have seen several statements of support, and no objections. = Please consider the draft adopted as an XMPP working group item. Lance, please resubmit as a "draft-ietf-xmpp-..." draft at your = convenience. Thanks! Ben. On Aug 20, 2013, at 5:05 PM, Ben Campbell wrote: > (as chair) >=20 > Hi, >=20 > The XMPP working group has a chartered work item to define a WebSocket = subprotocol for XMPP. (Please ignore the lack of an actual = milestone--the chairs have been remiss on updating those. But it's in = the charter text, really! ) >=20 > Lance recently submitted draft-moffitt-xmpp-over-websocket-04. We've = had a fair amount of discussion of previous versions on the XMPP list. >=20 > Should the XMPP work group accept draft-moffitt-xmpp-over-websocket-04 = as a work group item in support of the chartered work? Keep in mind that = acceptance does not mean the work group thinks the draft is absolutely = correct or complete. It merely means that we think that the draft is a = good start towards the milestone. >=20 > Please send your opinions to the XMPP working group by the end of next = week (31 Aug 2013.) >=20 > Thanks! >=20 > Ben. > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp From internet-drafts@ietf.org Thu Sep 5 20:37:50 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A59D21E81B8; Thu, 5 Sep 2013 20:37:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.559 X-Spam-Level: X-Spam-Status: No, score=-102.559 tagged_above=-999 required=5 tests=[AWL=0.041, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id evMy+7OZU6XQ; Thu, 5 Sep 2013 20:37:49 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E773321E81A0; Thu, 5 Sep 2013 20:37:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.70.p1 Message-ID: <20130906033744.19075.31391.idtracker@ietfa.amsl.com> Date: Thu, 05 Sep 2013 20:37:44 -0700 Cc: xmpp@ietf.org Subject: [xmpp] I-D Action: draft-ietf-xmpp-websocket-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Sep 2013 03:37:50 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Extensible Messaging and Presence Protoco= l Working Group of the IETF. Title : An XMPP Sub-protocol for WebSocket Author(s) : Lance Stout Jack Moffitt Eric Cestari Filename : draft-ietf-xmpp-websocket-00.txt Pages : 10 Date : 2013-09-05 Abstract: This document defines a binding for the XMPP protocol over a WebSocket transport layer. A WebSocket binding for XMPP provides higher performance than the current HTTP binding for XMPP. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-xmpp-websocket There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-xmpp-websocket-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From mamille2@cisco.com Fri Sep 6 15:19:07 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7FCC21F9E89 for ; Fri, 6 Sep 2013 15:19:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qnz1GhcDirqQ for ; Fri, 6 Sep 2013 15:19:03 -0700 (PDT) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by ietfa.amsl.com (Postfix) with ESMTP id EBCCC11E8101 for ; Fri, 6 Sep 2013 15:19:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9211; q=dns/txt; s=iport; t=1378505943; x=1379715543; h=from:to:subject:date:message-id:references:mime-version; bh=uB9ecGxr8LbBkIonASQ02ONzTCYREWJuAyFUwyKuJus=; b=C9gPgFsTGaKJO3y4yZCTXvigbWkznCTjRn5xXU9XSdFECz9JAQ/H0UJ/ XyZR334a5gGi7aI1S3PypKl2Yf12EkkPo66/DGwzJtuMqsnUi0snb2jWi rE1ghZkLHnDi7o1NUH5VJAFRO5rHfKlqlTC6YCBsLfj/9ZgMz4w4BE8tn E=; X-Files: smime.p7s : 4136 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AhYFAKRUKlKtJXHA/2dsb2JhbABRAQmDBzVLBsFggSYWdIIkAQEBAwEBAQFrEAsCARkDAQILJAIlCxQHAggCBBECCAEFh24GBwW/V44zBgGBERYKEwuDF4EAA5AjgS6HU4sLhSyDIECBMTk X-IronPort-AV: E=Sophos;i="4.90,857,1371081600"; d="p7s'?scan'208";a="253672739" Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by rcdn-iport-9.cisco.com with ESMTP; 06 Sep 2013 22:18:41 +0000 Received: from xhc-rcd-x14.cisco.com (xhc-rcd-x14.cisco.com [173.37.183.88]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id r86MIdJ9002299 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Fri, 6 Sep 2013 22:18:39 GMT Received: from xmb-aln-x11.cisco.com ([169.254.6.124]) by xhc-rcd-x14.cisco.com ([173.37.183.88]) with mapi id 14.02.0318.004; Fri, 6 Sep 2013 17:18:38 -0500 From: "Matt Miller (mamille2)" To: XMPP Group Thread-Topic: I-D Action: draft-miller-posh-01.txt Thread-Index: AQHOq06BqiOzv4jP10izJJwc3Z9dDA== Date: Fri, 6 Sep 2013 22:18:38 +0000 Message-ID: References: <20130906221429.28168.74635.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.129.24.123] Content-Type: multipart/signed; boundary="Apple-Mail=_3074D667-49C8-4AE2-A675-2EC5B3191F52"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Subject: [xmpp] Fwd: I-D Action: draft-miller-posh-01.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Sep 2013 22:19:08 -0000 --Apple-Mail=_3074D667-49C8-4AE2-A675-2EC5B3191F52 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii FYI, the latest draft incorporates just about all of the feedback we = received as a result of the BoF, minus ASCII art; we'll see about that = for the next version! - m&m Matt Miller < mamille2@cisco.com > Cisco Systems, Inc. Begin forwarded message: > From: > Subject: I-D Action: draft-miller-posh-01.txt > Date: September 6, 2013 4:14:29 PM MDT > To: > Reply-To: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. >=20 >=20 > Title : PKIX over Secure HTTP (POSH) > Author(s) : Matthew Miller > Peter Saint-Andre > Filename : draft-miller-posh-01.txt > Pages : 15 > Date : 2013-09-06 >=20 > Abstract: > Experience has shown that it is extremely difficult to deploy proper > PKIX certificates for TLS in multi-tenanted environments, since > certification authorities will not issue certificates for hosted > domains to hosting services, hosted domains do not want hosting > services to hold their private keys, and hosting services wish to > avoid liability for holding those keys. As a result, domains hosted > in multi-tenanted environments often deploy non-HTTP applications > such as email and instant messaging using certificates that identify > the hosting service, not the hosted domain. Such deployments force > end users and peer services to accept a certificate with an improper > identifier, resulting in obvious security implications. This > document defines two methods that make it easier to deploy > certificates for proper server identity checking in non-HTTP > application protocols. The first method enables the TLS client > associated with a user agent or peer application server to obtain = the > end-entity certificate of a hosted domain over secure HTTP as an > alternative to standard PKIX techniques. The second method enables = a > hosted domain to securely delegate a non-HTTP application to a > hosting service using redirects provided by HTTPS itself or by a > pointer in a file served over HTTPS at the hosted domain. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-miller-posh >=20 > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-miller-posh-01 >=20 > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=3Ddraft-miller-posh-01 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt --Apple-Mail=_3074D667-49C8-4AE2-A675-2EC5B3191F52 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMezCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIGPzCCBSeg AwIBAgIDBoRIMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTMwNDMwMjE1NDQyWhcNMTQwNTAyMDUzOTA0WjBbMRkwFwYDVQQNExBiN2F6NndOY0t0R3JtMEpF MRswGQYDVQQDDBJtYW1pbGxlMkBjaXNjby5jb20xITAfBgkqhkiG9w0BCQEWEm1hbWlsbGUyQGNp c2NvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJbKBMsG+9UFTx9uq/bhhXgu vJvO8z7cwKaqqwZhVf5z/kHFyCNijtmTOE+YXjA8mWR4aoBwB5SvGypI/cJUofJ+AlBTC4g+RMx/ K0Ab4/jQqTQz9CDzMOB+Wm+rt8ZJ7A8ZzOJmNDAsf/VvB8l2A1SQz1UsAixgH16NTr8SlblAXEKk 4hwpCudUiNjjQokqJ0H686UBKVorcZSgXaza8XMqGtJF/8mNhR9GQYi7Xht1ky+9LFOrto2daZto KJRwMeVusVdHUeKEQSu7jztw8HchH3KEb7Q+r5X+hhDZoddfKE8d5eyPuhiZdrzv7OlNZ0fSLdx7 3AE3nx9/R5YlXucCAwEAAaOCAtgwggLUMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQW MBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQUxGd+/qrdVudHrIKkw5xOMY7eaLUwHwYD VR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIwHQYDVR0RBBYwFIESbWFtaWxsZTJAY2lzY28u Y29tMIIBTAYDVR0gBIIBQzCCAT8wggE7BgsrBgEEAYG1NwECAzCCASowLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBp c3N1ZWQgYWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9m IHRoZSBTdGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBw dXJwb3NlIGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMDYG A1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4G CCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIv Y2xhc3MxL2NsaWVudC9jYTBCBggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2Vy dHMvc3ViLmNsYXNzMS5jbGllbnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRz c2wuY29tLzANBgkqhkiG9w0BAQUFAAOCAQEAlDhXbGEI7lbqUcu5r2JHZaMsbRZda/99ZqODzWGX 0llou9jGccsAWDPPwRRe2+ROpXfH4cuJZElTcLDeZSp/qpXKhjYieFSX8+Ml9sKEj5UOSqQLyoLk PtrIJV12Jk3nuG2Jc0UeEnGwK/aqtzy7+bfEVI0ziyVM2gChHh0RH74KyiwYWknbOTRIkZcz/ulE DVFQp63uj6wfmDNvAUHBAdhKVqA1S/rfP1KcDZpf1NfvwXJibiqTRA6K1EOxTJOP41n/XdvHqHXL RWL2xrOUI9/URANr/ok3OrsuZEMFnAAGefS1bWS/hFtUGVkHGiKEBbyDW7da2ULXbuC7umrQnzGC A28wggNrAgEBMIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkG A1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRD b20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwaESDAJBgUrDgMCGgUA oIIBrzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzA5MDYyMjE4 MzhaMCMGCSqGSIb3DQEJBDEWBBRA9Vl1q8oWAR+xsAwBbtHFuiua4zCBpQYJKwYBBAGCNxAEMYGX MIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2Vj dXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3Mg MSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwaESDCBpwYLKoZIhvcNAQkQAgsxgZeg gZQwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1 cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAx IFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQIDBoRIMA0GCSqGSIb3DQEBAQUABIIBAFs4 tEH+2WyAgqmfRtZruc7Pd+7KPhrsp7nkVkQuEbuzk0iUYr8PHlvUwt+XOjRoQqlPmANK7QsSmqsy ENSqyjzB2tlQk53aEDWi+mvVPGXouUH01/UzIXXzw9IsLUZg1GJ3ErbBPHZX2EY0nT4j32AzIsFl uYOVC5bHXCE64htT34zabwpLETVOmKBUACHno09SDitzd13x9LDoUX3KMihdH0Zs4Uf8FO3lyUQy ZlgfyTTWeSjutZVA/V+t9uIV9n5rXTq9f05iSE5aYvClDz7N/yB0sRMQAjfe3KvBSpnaC3H0uq01 S30pEifz3O7cgN1GrGuHfuS8kgskjgRiJLYAAAAAAAA= --Apple-Mail=_3074D667-49C8-4AE2-A675-2EC5B3191F52-- From internet-drafts@ietf.org Fri Sep 6 15:33:17 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFD9E11E80FC; Fri, 6 Sep 2013 15:33:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.559 X-Spam-Level: X-Spam-Status: No, score=-102.559 tagged_above=-999 required=5 tests=[AWL=0.041, BAYES_00=-2.599, NO_RELAYS=-0.001, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oMp+p00yJmvU; Fri, 6 Sep 2013 15:33:17 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E5D7A21E80B5; Fri, 6 Sep 2013 15:33:13 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 4.70.p1 Message-ID: <20130906223313.28724.64500.idtracker@ietfa.amsl.com> Date: Fri, 06 Sep 2013 15:33:13 -0700 Cc: xmpp@ietf.org Subject: [xmpp] I-D Action: draft-ietf-xmpp-dna-03.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Sep 2013 22:33:17 -0000 A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Extensible Messaging and Presence Protoco= l Working Group of the IETF. Title : Domain Name Associations (DNA) in the Extensible Messagi= ng and Presence Protocol (XMPP) Author(s) : Peter Saint-Andre Matthew Miller Filename : draft-ietf-xmpp-dna-03.txt Pages : 15 Date : 2013-09-06 Abstract: This document improves the security of the Extensible Messaging and Presence Protocol (XMPP) in two ways. First, it specifies how "prooftypes" can establish a strong association between a domain name and an XML stream. Second, it describes how to securely delegate a source domain to a derived domain, which is especially important in virtual hosting environments. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-xmpp-dna There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-xmpp-dna-03 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-xmpp-dna-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From stpeter@stpeter.im Fri Sep 6 15:34:11 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3771021E8054; Fri, 6 Sep 2013 15:34:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.448 X-Spam-Level: X-Spam-Status: No, score=-102.448 tagged_above=-999 required=5 tests=[AWL=0.151, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jtdXs8XZ8dMN; Fri, 6 Sep 2013 15:34:07 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 843E611E80FC; Fri, 6 Sep 2013 15:34:06 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 615A4414D0; Fri, 6 Sep 2013 16:38:08 -0600 (MDT) Message-ID: <522A5851.3070503@stpeter.im> Date: Fri, 06 Sep 2013 16:33:53 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: internet-drafts@ietf.org References: <20130906223313.28724.64500.idtracker@ietfa.amsl.com> In-Reply-To: <20130906223313.28724.64500.idtracker@ietfa.amsl.com> X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: xmpp@ietf.org, i-d-announce@ietf.org Subject: Re: [xmpp] I-D Action: draft-ietf-xmpp-dna-03.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Sep 2013 22:34:11 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Updated to track the POSH spec... On 9/6/13 4:33 PM, internet-drafts@ietf.org wrote: > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. This draft is a work item of the Extensible Messaging > and Presence Protocol Working Group of the IETF. > > Title : Domain Name Associations (DNA) in the Extensible > Messaging and Presence Protocol (XMPP) Author(s) : Peter > Saint-Andre Matthew Miller Filename : > draft-ietf-xmpp-dna-03.txt Pages : 15 Date : > 2013-09-06 > > Abstract: This document improves the security of the Extensible > Messaging and Presence Protocol (XMPP) in two ways. First, it > specifies how "prooftypes" can establish a strong association > between a domain name and an XML stream. Second, it describes how > to securely delegate a source domain to a derived domain, which is > especially important in virtual hosting environments. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-ietf-xmpp-dna > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-ietf-xmpp-dna-03 > > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=draft-ietf-xmpp-dna-03 > > > Please note that it may take a couple of minutes from the time of > submission until the htmlized version and diff are available at > tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ xmpp mailing list > xmpp@ietf.org https://www.ietf.org/mailman/listinfo/xmpp > - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSKlhRAAoJEOoGpJErxa2pOsAP/1aOHg0BKg+uWdGAhp8uBMUh iuEyZg6x/2ZA6/DIhLnr8YHoS626bFjkmT6YPGDGLJ84e6k3xQHdQu+iZkePyfIj RGHOYQGliXYT0H2JMNBNzM8d+lch371niNYItglZfU9m6xM/ahIckB1+2lU4HuB5 3ssTLvRpa6rYUcONoUFFfEzT5kOylxuVG3nVxzZT9IAdzjCE8mqivxUOlLk39hHa 4rvQk8sBrboBlNg8/0oZBMvpwZ66/FWZNQZwCu7oaGogxbme1OjYqZPpXXR7M53K +m49Ewcaw9gXkR1gvHPxYzTc2SBdd6j3IEG4cvFzFwLdj9/uOIZuqrt7xDnMW32U 7yZC8MsTz6Y6UwiOcXdxkHW8yQoQSw9TZwAKW30efS+KqpvqndwbXEKxzuRCYTcA u/L4kHgffw4mXnAab9b3WpeNImPx3442u2kpv36EOyHVSTIoChzZ2swro8ihuTa+ RlR6wyq6DQzyXE3o+3LZxpPEPthdTKe/pMikus6oTWEhdVS7Zqs8JfhKoJLKRwSA zEHhjTacqX3tJXw4i+DQNH/j5foCOZx0tlyHL3uavpv1pFHuxgxqq22egsgwpBnH xSDpdJoYyGrRwQOtVy6jardxPU/LdTWiQERz5Q9IYKm1yKpsfce/Dk4Bftq4hyn6 Eq/pXT+vpNEvCwQ6ady+ =1kWE -----END PGP SIGNATURE----- From stpeter@stpeter.im Mon Sep 9 09:35:31 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DC9D11E8121 for ; Mon, 9 Sep 2013 09:35:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hwlAHZt1h+u9 for ; Mon, 9 Sep 2013 09:35:26 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id E095F21F9FBC for ; Mon, 9 Sep 2013 09:35:16 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 5AC90414CF; Mon, 9 Sep 2013 10:39:33 -0600 (MDT) Message-ID: <522DF8BC.7040701@stpeter.im> Date: Mon, 09 Sep 2013 10:35:08 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: XMPP References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> In-Reply-To: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> X-Enigmail-Version: 1.5.2 X-Forwarded-Message-Id: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 16:35:31 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 FYI. - -------- Original Message -------- Subject: I-D Action: draft-saintandre-xmpp-tls-00.txt Date: Mon, 09 Sep 2013 09:32:08 -0700 From: internet-drafts@ietf.org Reply-To: internet-drafts@ietf.org To: i-d-announce@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP) Author(s) : Peter Saint-Andre Filename : draft-saintandre-xmpp-tls-00.txt Pages : 6 Date : 2013-09-09 Abstract: This document provides recommendations for the use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP). This document updates RFC 6120. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls There's also a htmlized version available at: http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSLfi8AAoJEOoGpJErxa2pTBwP/2wai24XXThd0la48PuZMKP1 DYCClQzjvm/TOBdSk/EQxQlq50B3KEH3AN2WFN5a7f22GXT/44kZzMCi+maEiz+X FyazwluRPisP/LHcg+CIDZxcj0RJFVbBAClLUCYTNukmmd9gegCZnPRgWyDnOs7E Kus7OLp8FcKPIpq7dHB95Ya2jmGTNmC7VAk0ckPthuBy1Lg48LPfGL2olUckqT7c snRL8eCNvvGp2/QK3yvLcoUWnk/8IBDLoGvS1Yi/jEWrVGjVzAzl+zZK+g/7H0Bo pMYPwplFeIWmmTTf+sjTKJo1RzFtlaob86xA7ybuD+RpELgqHvM8MvS8rai/QmQL dElBQSd8SqoElmuJzT61R0A70JMmcnzLMC1H/3+J0Pbafy4c1H/WKghSH1+XAKVv mcRLuyFTi2heuXBVWcRr4rqL4mr9lrsztdFE7m5HEx6I7mTnLwFxgcdzLh+WPAkv wwP61eEU2w5kco/8yMM8d+iiyt9Q1rsz+YivG4a9Ilnq2Y2f/FLVu5ztAOesT2wS eEmNbKnFCzATwfj+h9x7BYVJdGdt3zR6iUwVuf7FBOjqN3Z2JXmC7KtQE4NUu4vd zcsAvACv5a+jpJd0/QNGiXXS8Fjn4LP/ols4n3AHScJPAjRmfVGqu2VkNRDxowYP 7Y++rCrAcvpGqarre6P0 =9WO8 -----END PGP SIGNATURE----- From stpeter@stpeter.im Mon Sep 9 09:42:27 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D95E21E8094 for ; Mon, 9 Sep 2013 09:42:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MYlK1vocWBwv for ; Mon, 9 Sep 2013 09:42:21 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id EDDFC21F9E63 for ; Mon, 9 Sep 2013 09:42:20 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.234]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id C8CF8414CF; Mon, 9 Sep 2013 10:46:41 -0600 (MDT) Message-ID: <522DFA69.2020101@stpeter.im> Date: Mon, 09 Sep 2013 10:42:17 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: XMPP References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> In-Reply-To: <522DF8BC.7040701@stpeter.im> X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 16:42:27 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oh, I just thought of another open issue: we might want to say something about TLS session resumption. On 9/9/13 10:35 AM, Peter Saint-Andre wrote: > FYI. > > > -------- Original Message -------- Subject: I-D Action: > draft-saintandre-xmpp-tls-00.txt Date: Mon, 09 Sep 2013 09:32:08 > -0700 From: internet-drafts@ietf.org Reply-To: > internet-drafts@ietf.org To: i-d-announce@ietf.org > > > A New Internet-Draft is available from the on-line Internet-Drafts > directories. > > > Title : Use of Transport Layer Security (TLS) in the > Extensible Messaging and Presence Protocol (XMPP) Author(s) : > Peter Saint-Andre Filename : > draft-saintandre-xmpp-tls-00.txt Pages : 6 Date > : 2013-09-09 > > Abstract: This document provides recommendations for the use of > Transport Layer Security (TLS) in the Extensible Messaging and > Presence Protocol (XMPP). This document updates RFC 6120. > > > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 > > > Please note that it may take a couple of minutes from the time of > submission until the htmlized version and diff are available at > tools.ietf.org. > > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ > > _______________________________________________ I-D-Announce > mailing list I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft > directories: http://www.ietf.org/shadow.html or > ftp://ftp.ietf.org/ietf/1shadow-sites.txt > > > _______________________________________________ xmpp mailing list > xmpp@ietf.org https://www.ietf.org/mailman/listinfo/xmpp > - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSLfppAAoJEOoGpJErxa2pT7UQAIPcg6lmhdCJxoUuQilk5iFv DyxhX4UNWIkPCLEBWncjzA31vaihOWzdnS5KEqrtXWTWx4UTbe8PNMW+je3/sw9z FxKNLEC0k/DMq+KQ5503UnCT3TPToo3+WkCCjmpjBEEbaWkgJOm2Xow8mkU9n1+U +q6akKYbIBezZhKdYl5LKbLqff4U3Q/QWlBI/oAr8JgEckZgV8lJ9VZw4cQsSqa/ HFmEwRghWEY75Wosj8mHvuD4GkBvWEx/fqI6wjCfTyLllM25mgATp/KonMuKJ1jC Sk57GVh8Zhlwjgu2Dem8OTL9BiVPrPJ+l+uMmK6ZMUcztxN0VL+Mwx3RXZxiX6Ho ZQXGWgXnk7/hcXak91qINl363ys+XayR4QtUJEIeB47tklI6Xlswy4+GsHzx69p7 m3u7SV6i3dhWKYgvdksbLYjxBKSz0QUYMgmiZR+GjMj3j+KrSSerNx6yx9QkjtcM spWxRWzJN6j54BSw9hZpl9rTutVZNFaXGYdCUTI36awer4orzD4SXdsp4azZvbBT djSpGXEzd1ScHmaQnZ59slVOcDAZOkl3Ws+hWUZ+A6rFkeumzuo4V1vMbHQATa50 xcE/jaDj0FcA9lzdMSNxs72YOo6e1swhbQ+fTTWkDwM6dRV949cHAOpeVwIUnYcQ KAAlZGZswWwG//t+GdyK =oufx -----END PGP SIGNATURE----- From dave@cridland.net Mon Sep 9 09:51:53 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0485B11E8113 for ; Mon, 9 Sep 2013 09:51:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 64CnftAihxqC for ; Mon, 9 Sep 2013 09:51:46 -0700 (PDT) Received: from mail-ob0-x22f.google.com (mail-ob0-x22f.google.com [IPv6:2607:f8b0:4003:c01::22f]) by ietfa.amsl.com (Postfix) with ESMTP id 1D00D21F9E9A for ; Mon, 9 Sep 2013 09:51:45 -0700 (PDT) Received: by mail-ob0-f175.google.com with SMTP id xn12so6189184obc.34 for ; Mon, 09 Sep 2013 09:51:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cridland.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=gbgdnJzxKbttWnhv8TbTHrgEnWXx4hVeCXm2fb39fCw=; b=MPuCDhNMdCVwGnn7v3hQqT3gY62Lpx7iEVpVR4bUFGA/mPRHk/EnA2otIpgYcZJAO4 7iPdPSd2frvC/ZXkQIt4qrbrZduNxYHvQdWl0O9gDKzNzfwue/OBK+maeBmlsQkn9l9A cX3RAHX4bBBfb1wHVBJDlngEVJmMlwINTxOxE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=gbgdnJzxKbttWnhv8TbTHrgEnWXx4hVeCXm2fb39fCw=; b=ECZ5aSuhmAhV7LPePns4SzKtQnBAVaL5xYt4mmOIYpmVhSM+sHWb0g9gy56UaxKpha XNzE4yHe91xBM4Mj/BSOfvYPI6ththLNjT7cBVn5V4cbAtEgJoGAeboiecjt3uVFtlsY KiRSKXFSaC/ZautVIj3M6Pw77BM/jNCM2Gmn4LP8o5cNB9kni2AijofCt2XDZ+6flH73 IHRtPcqj/uzGg5eLPP7F/f9CkwByVZJ9x1D8cxA5b8BMMf2X8iqi72LAUBJc6zAawizD sCyXsQS7lAD5D1yZoL7kbhEFzq8dvDUsgE+c5SwUq+1reXX5l41Da1Emi0Zy92StqcLQ FkaQ== X-Gm-Message-State: ALoCoQl9Xcdvs9BjvEcncIukxVxSGmeHR+kYPtUlX+iXYrBDwUeEj3Q8Wm44eNtXEhIavZPCC5AI MIME-Version: 1.0 X-Received: by 10.182.237.14 with SMTP id uy14mr11845571obc.102.1378745504647; Mon, 09 Sep 2013 09:51:44 -0700 (PDT) Received: by 10.60.121.97 with HTTP; Mon, 9 Sep 2013 09:51:44 -0700 (PDT) In-Reply-To: <522DF8BC.7040701@stpeter.im> References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> Date: Mon, 9 Sep 2013 17:51:44 +0100 Message-ID: From: Dave Cridland To: Peter Saint-Andre Content-Type: multipart/alternative; boundary=e89a8ff1c9ae0a5c3904e5f634d9 Cc: XMPP Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 16:51:53 -0000 --e89a8ff1c9ae0a5c3904e5f634d9 Content-Type: text/plain; charset=ISO-8859-1 On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre wrote: > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 Thanks for writing this, it looks like an excellent start. o Add information about the rationale for each recommendation, perhaps in an appendix. That seems reasonable, but I don't think there's a need to describe each recommendation individually. o Recommend a specific ciphersuite or a small number of ciphersuites? Picking a small selection of SHOULD or MUST implement seems fair. o Provide recommendations regarding key lengths? I think you already do for ephemeral keys, but public key lengths yes. o Discuss TLS compression vs. application-layer compression? It's not obvious it's a security issue, but yes. The issue remains that compressing streams takes a serious wodge of data, but it's desirable. Also, I think we should discuss the use of anonymous (or unauthenticated in general) TLS; I've been convinced recently that using even a non-channel-binding authentication and unauthenticated TLS is substantially better than nothing. It's also what the deployed base actually does. Finally, I'd be keen to see this adopted by the working group if that's on the table. Dave. --e89a8ff1c9ae0a5c3904e5f634d9 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre <stpet= er@stpeter.im> wrote:
There's also a htmlized version available at:
http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00

Thanks for writing this, it looks like an exce= llent start.

=A0 =A0 o =A0Add information about the rationale for ea= ch recommendation,
=A0 =A0 =A0 perhaps in an appendix.
=
That seems reasonable, but I don't think there's a n= eed to describe each recommendation individually.

=A0 =A0o =A0Recommend a specific ciphersuite or a small= number of
=A0 =A0 =A0 ciphersuites?

Pic= king a small selection of SHOULD or MUST implement seems fair.
=A0 =A0o =A0Provide recommendations regarding key lengths?
<= br>
I think you already do for ephemeral keys, but public key len= gths yes.

=A0 =A0o =A0Discuss TLS compression vs. = application-layer compression?

It's not obvious it's a security issue, but yes= . The issue remains that compressing streams takes a serious wodge of data,= but it's desirable.

Also, I think we should d= iscuss the use of anonymous (or unauthenticated in general) TLS; I've b= een convinced recently that using even a non-channel-binding authentication= and unauthenticated TLS is substantially better than nothing. It's als= o what the deployed base actually does.

Finally, I'd be keen to see this adopted by the wor= king group if that's on the table.

Dave.
=
--e89a8ff1c9ae0a5c3904e5f634d9-- From stpeter@stpeter.im Mon Sep 9 10:08:13 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DD3011E8201 for ; Mon, 9 Sep 2013 10:08:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JEAIU+Jd0rMb for ; Mon, 9 Sep 2013 10:08:08 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 4EC8211E81FA for ; Mon, 9 Sep 2013 10:08:08 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 1113F414CF; Mon, 9 Sep 2013 11:12:29 -0600 (MDT) Message-ID: <522E0075.1010109@stpeter.im> Date: Mon, 09 Sep 2013 11:08:05 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: Dave Cridland References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> In-Reply-To: X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:08:13 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/9/13 10:51 AM, Dave Cridland wrote: > On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre > > wrote: > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 > > > Thanks for writing this, it looks like an excellent start. You inspired it because as I recall you suggested that we pull some of the security recommendations out of draft-ietf-xmpp-3920bis and into a separate spec that we could update more readily. :-) > o Add information about the rationale for each recommendation, > perhaps in an appendix. > > That seems reasonable, but I don't think there's a need to describe > each recommendation individually. Agreed, and the justification for some of them is already available elsewhere. It seems that draft-sheffer-tls-bcp might evolve in that direction, too. > o Recommend a specific ciphersuite or a small number of > ciphersuites? > > Picking a small selection of SHOULD or MUST implement seems fair. > > o Provide recommendations regarding key lengths? > > I think you already do for ephemeral keys, but public key lengths > yes. I'm thinking of the discussion here: http://www.ietf.org/mail-archive/web/perpass/current/msg00062.html > o Discuss TLS compression vs. application-layer compression? > > It's not obvious it's a security issue, but yes. Well, there is the CRIME attack against some technologies that use TLS compression, however it's not clear to me if that applies to XMPP. > The issue remains that compressing streams takes a serious wodge of > data, but it's desirable. > > Also, I think we should discuss the use of anonymous (or > unauthenticated in general) TLS; I've been convinced recently that > using even a non-channel-binding authentication and unauthenticated > TLS is substantially better than nothing. It's also what the > deployed base actually does. Could you explain a bit more what you mean by unauthenticated TLS? > Finally, I'd be keen to see this adopted by the working group if > that's on the table. I leave that up to the chairs. :-) Depending on how you read the charter, it might or might not be in scope. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSLgB1AAoJEOoGpJErxa2pL5IP/j6S7Akfij35ZoZnm8GQrw+t J/sEKsZjRmICAu0hXUfhTPl2cZKcYF874M8WlypnzD4noA+UzHwvKWBjN2m/1Lwa xCHeVWmwO88fG6xQC5cZxycUlyvdDb2foho672OsFXk58qIOVoBSs74YPANQbfKB 7396vlwHtqnygI1FEqyQYjdBtZztlceRHJ7G0DUGxpjoEG2UMGIQVLVMrqLUIeVE YLIFVYtd6P+uKAIqwFOt4LjbCbozAX5jSr2W1lUUz7bo3sOrB1TpWeuyOpvHZulm Kp7qhxsZDrQWeupbbtXP4rwnOXipVfUCY7mBpdRl0FIdKV5xqrdyBzNGwvY8sVxX OmVeF1+53Sm2hftUoxbDWoFcoI3CoqzeXSS+ayz6L+FW+Jj3aEmzp/caJNNsjHM9 3In5IxOl4IwHRKL/IhRWZRN9vfETBa5ncb4EbLvhr0tzFCnXK2E5nb3bpUBTVTB6 Jlqv8dmiAeJFGESz3R1RYr6uelpC+WgTGMXP1Oz8uSlZxNnhSIeaqqLXkzYz0hmN ZjpL2X+J9kldwUflBF5ARkakvbo1LCPxFZdoEd+dixiYO7YN6OAn4ZK6vzTvJiOa RblKSM8HVBcBID1B3cnQiStfqUYsEGtonKwV7LKJ0Pem/tzoT7jgZkAhiLDR0wzf Q/ASo78kt3ZeamgXjqHe =wM8x -----END PGP SIGNATURE----- From mamille2@cisco.com Mon Sep 9 10:08:49 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12D6011E81FA for ; Mon, 9 Sep 2013 10:08:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V2+a62uPZ4hH for ; Mon, 9 Sep 2013 10:08:44 -0700 (PDT) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by ietfa.amsl.com (Postfix) with ESMTP id 639E411E80D7 for ; Mon, 9 Sep 2013 10:08:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=10353; q=dns/txt; s=iport; t=1378746524; x=1379956124; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=K7QYePJuTfU6zp9S86DqEtqkoUron6nJ9EKsB9D35oY=; b=VDMVd0zREU0J8Q70duriR9gfWJ29SYyMrsb9k5siFqtlSe/iGEhxHvBo NwyUAWbt1A6TgFkyLBDVY75oGxN9AveYOeLdICiNv2AFr5ar/Pg6wmbPT JVvyMVTy0cgavJsgw8AbrU3DYZTpJcjVmXhGIdlEPid4uJWgRVhnM8x/B k=; X-Files: smime.p7s : 4136 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgQFAFL/LVKtJXG9/2dsb2JhbABbgwc4UcIXgSQWdIIlAQEBBAEBAWsLDAQCAQgRAwECCyQCJQsUCQgCBA4FCAEFh3QMw3qPTxYKEQIFBgODFIEAA5AjgS6HU4sLhSyDIIIq X-IronPort-AV: E=Sophos;i="4.90,872,1371081600"; d="p7s'?scan'208";a="257505223" Received: from rcdn-core2-2.cisco.com ([173.37.113.189]) by rcdn-iport-4.cisco.com with ESMTP; 09 Sep 2013 17:08:44 +0000 Received: from xhc-aln-x08.cisco.com (xhc-aln-x08.cisco.com [173.36.12.82]) by rcdn-core2-2.cisco.com (8.14.5/8.14.5) with ESMTP id r89H8hsc026331 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 9 Sep 2013 17:08:43 GMT Received: from xmb-aln-x11.cisco.com ([169.254.6.124]) by xhc-aln-x08.cisco.com ([173.36.12.82]) with mapi id 14.02.0318.004; Mon, 9 Sep 2013 12:08:43 -0500 From: "Matt Miller (mamille2)" To: Peter Saint-Andre Thread-Topic: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt Thread-Index: AQHOrXptos1t2HkMsUWBYWj3F0vcaZm97fQAgAAJYoA= Date: Mon, 9 Sep 2013 17:08:43 +0000 Message-ID: References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> In-Reply-To: <522DF8BC.7040701@stpeter.im> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [10.129.24.123] Content-Type: multipart/signed; boundary="Apple-Mail=_758CE825-6F2E-4764-99E6-E897D32C6F94"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Cc: XMPP Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:08:49 -0000 --Apple-Mail=_758CE825-6F2E-4764-99E6-E897D32C6F94 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Some initial feedback: * Very nice start, and "YAY" for short and to-the-point drafts! (-: * This document needs to include recommendations for STARTTLS. Maybe = start with something like "initiating entities MUST expect = in the receiving entity's , and MUST reject the = connection if missing". * In 4.1. Protocol Versions -- ought the document to also recommend that = implementations support the latest version of TLS (which is currently = 1.2)? That might seem obvious ... * In 4.2. Ciphersuites -- this ought to explicitly disallow the NULL = ciphersuites. Again, this might seem obvious ... * Also in 4.2. Ciphersuites -- maybe include something about preferring = suites that utilize authenticated encryption (e.g., AES-GCM). On "Open Issues": * Including rationales would be very helpful, and I think it best to = include them as close to the recommendation text as possible. * I think recommending a particular set of ciphersuites would be = worthwhile. * A minimum key length for public keys is definitely necessary. It = looks like the ephemeral keys already have minimum length = recommendations. * I think a discussion of TLS- versus application-layer compression is = worthwhile. - m&m Matt Miller < mamille2@cisco.com > Cisco Systems, Inc. On Sep 9, 2013, at 10:35 AM, Peter Saint-Andre wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 >=20 > FYI. >=20 >=20 > - -------- Original Message -------- > Subject: I-D Action: draft-saintandre-xmpp-tls-00.txt > Date: Mon, 09 Sep 2013 09:32:08 -0700 > From: internet-drafts@ietf.org > Reply-To: internet-drafts@ietf.org > To: i-d-announce@ietf.org >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts > directories. >=20 >=20 > Title : Use of Transport Layer Security (TLS) in the > Extensible Messaging and Presence Protocol (XMPP) > Author(s) : Peter Saint-Andre > Filename : draft-saintandre-xmpp-tls-00.txt > Pages : 6 > Date : 2013-09-09 >=20 > Abstract: > This document provides recommendations for the use of Transport = Layer > Security (TLS) in the Extensible Messaging and Presence Protocol > (XMPP). This document updates RFC 6120. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls >=20 > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 >=20 >=20 > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt >=20 >=20 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.19 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ >=20 > iQIcBAEBAgAGBQJSLfi8AAoJEOoGpJErxa2pTBwP/2wai24XXThd0la48PuZMKP1 > DYCClQzjvm/TOBdSk/EQxQlq50B3KEH3AN2WFN5a7f22GXT/44kZzMCi+maEiz+X > FyazwluRPisP/LHcg+CIDZxcj0RJFVbBAClLUCYTNukmmd9gegCZnPRgWyDnOs7E > Kus7OLp8FcKPIpq7dHB95Ya2jmGTNmC7VAk0ckPthuBy1Lg48LPfGL2olUckqT7c > snRL8eCNvvGp2/QK3yvLcoUWnk/8IBDLoGvS1Yi/jEWrVGjVzAzl+zZK+g/7H0Bo > pMYPwplFeIWmmTTf+sjTKJo1RzFtlaob86xA7ybuD+RpELgqHvM8MvS8rai/QmQL > dElBQSd8SqoElmuJzT61R0A70JMmcnzLMC1H/3+J0Pbafy4c1H/WKghSH1+XAKVv > mcRLuyFTi2heuXBVWcRr4rqL4mr9lrsztdFE7m5HEx6I7mTnLwFxgcdzLh+WPAkv > wwP61eEU2w5kco/8yMM8d+iiyt9Q1rsz+YivG4a9Ilnq2Y2f/FLVu5ztAOesT2wS > eEmNbKnFCzATwfj+h9x7BYVJdGdt3zR6iUwVuf7FBOjqN3Z2JXmC7KtQE4NUu4vd > zcsAvACv5a+jpJd0/QNGiXXS8Fjn4LP/ols4n3AHScJPAjRmfVGqu2VkNRDxowYP > 7Y++rCrAcvpGqarre6P0 > =3D9WO8 > -----END PGP SIGNATURE----- > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp --Apple-Mail=_758CE825-6F2E-4764-99E6-E897D32C6F94 Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMezCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIGPzCCBSeg AwIBAgIDBoRIMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTMwNDMwMjE1NDQyWhcNMTQwNTAyMDUzOTA0WjBbMRkwFwYDVQQNExBiN2F6NndOY0t0R3JtMEpF MRswGQYDVQQDDBJtYW1pbGxlMkBjaXNjby5jb20xITAfBgkqhkiG9w0BCQEWEm1hbWlsbGUyQGNp c2NvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJbKBMsG+9UFTx9uq/bhhXgu vJvO8z7cwKaqqwZhVf5z/kHFyCNijtmTOE+YXjA8mWR4aoBwB5SvGypI/cJUofJ+AlBTC4g+RMx/ K0Ab4/jQqTQz9CDzMOB+Wm+rt8ZJ7A8ZzOJmNDAsf/VvB8l2A1SQz1UsAixgH16NTr8SlblAXEKk 4hwpCudUiNjjQokqJ0H686UBKVorcZSgXaza8XMqGtJF/8mNhR9GQYi7Xht1ky+9LFOrto2daZto KJRwMeVusVdHUeKEQSu7jztw8HchH3KEb7Q+r5X+hhDZoddfKE8d5eyPuhiZdrzv7OlNZ0fSLdx7 3AE3nx9/R5YlXucCAwEAAaOCAtgwggLUMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQW MBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQUxGd+/qrdVudHrIKkw5xOMY7eaLUwHwYD VR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIwHQYDVR0RBBYwFIESbWFtaWxsZTJAY2lzY28u Y29tMIIBTAYDVR0gBIIBQzCCAT8wggE7BgsrBgEEAYG1NwECAzCCASowLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBp c3N1ZWQgYWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9m IHRoZSBTdGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBw dXJwb3NlIGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMDYG A1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4G CCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIv Y2xhc3MxL2NsaWVudC9jYTBCBggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2Vy dHMvc3ViLmNsYXNzMS5jbGllbnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRz c2wuY29tLzANBgkqhkiG9w0BAQUFAAOCAQEAlDhXbGEI7lbqUcu5r2JHZaMsbRZda/99ZqODzWGX 0llou9jGccsAWDPPwRRe2+ROpXfH4cuJZElTcLDeZSp/qpXKhjYieFSX8+Ml9sKEj5UOSqQLyoLk PtrIJV12Jk3nuG2Jc0UeEnGwK/aqtzy7+bfEVI0ziyVM2gChHh0RH74KyiwYWknbOTRIkZcz/ulE DVFQp63uj6wfmDNvAUHBAdhKVqA1S/rfP1KcDZpf1NfvwXJibiqTRA6K1EOxTJOP41n/XdvHqHXL RWL2xrOUI9/URANr/ok3OrsuZEMFnAAGefS1bWS/hFtUGVkHGiKEBbyDW7da2ULXbuC7umrQnzGC A28wggNrAgEBMIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkG A1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRD b20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwaESDAJBgUrDgMCGgUA oIIBrzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzA5MDkxNzA4 NDNaMCMGCSqGSIb3DQEJBDEWBBSx9L6R/hjR+IZbSQ4PeRZflqUFQDCBpQYJKwYBBAGCNxAEMYGX MIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2Vj dXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3Mg MSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwaESDCBpwYLKoZIhvcNAQkQAgsxgZeg gZQwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1 cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAx IFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQIDBoRIMA0GCSqGSIb3DQEBAQUABIIBACky tMcSlyAe+6ou6S8OdL1Oj2FWWIa5eJCISuTBMo5onFgKypM4JUa2XOZBLosp3lvBu0oMXwGjAkDq e1m0tPmmOJYBXL1oSaYFQGweJLbZJsGvAsMzlA+3AVeOD0Mb4Vwu2j2YWTfBwvm1YoPYnnUeE6Hf rgCEhEwPY7mO+THnQILrIFYEMXkoy//iPYD7JrdssRSuciv9V1H6oYMPGJyTs72wmp7m5pKTRPdh +fS/XWhnme7xueuKvQ7ax5mUJcSFmxtHVjceSnA2R5xxxjXp+Ccj8KZPA91Keb9h2yVc9TOn0jRm WQ9Ee6VYe5Q3ShcVg9AAzHbmIpyR3POj2ogAAAAAAAA= --Apple-Mail=_758CE825-6F2E-4764-99E6-E897D32C6F94-- From fippo@goodadvice.pages.de Mon Sep 9 10:12:54 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9204911E821C for ; Mon, 9 Sep 2013 10:12:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iGKc1w90CuU4 for ; Mon, 9 Sep 2013 10:12:48 -0700 (PDT) Received: from lo.psyced.org (lost.IN.psyced.org [188.40.42.221]) by ietfa.amsl.com (Postfix) with ESMTP id 5674A11E8217 for ; Mon, 9 Sep 2013 10:12:48 -0700 (PDT) Received: from [192.168.2.100] (p54972CEB.dip0.t-ipconnect.de [84.151.44.235]) (authenticated bits=0) by lo.psyced.org (8.14.3/8.14.3/Debian-9.4) with ESMTP id r89HCjLI002025 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Mon, 9 Sep 2013 19:12:46 +0200 Message-ID: <522E0188.1060407@goodadvice.pages.de> Date: Mon, 09 Sep 2013 19:12:40 +0200 From: Philipp Hancke User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130804 Thunderbird/17.0.8 MIME-Version: 1.0 To: XMPP Working Group References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <522E0075.1010109@stpeter.im> In-Reply-To: <522E0075.1010109@stpeter.im> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:12:54 -0000 Am 09.09.2013 19:08, schrieb Peter Saint-Andre: >> Also, I think we should discuss the use of anonymous (or >> unauthenticated in general) TLS; I've been convinced recently that >> using even a non-channel-binding authentication and unauthenticated >> TLS is substantially better than nothing. It's also what the >> deployed base actually does. > > Could you explain a bit more what you mean by unauthenticated TLS? Using TLS without checking certificates. Think of the starttls+dialback stuff that some people have done for years. From stpeter@stpeter.im Mon Sep 9 10:17:18 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBA4A21E8050 for ; Mon, 9 Sep 2013 10:17:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Uqe0mJAd7ZaP for ; Mon, 9 Sep 2013 10:17:13 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 21BE211E811B for ; Mon, 9 Sep 2013 10:17:13 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 54C2C414CF; Mon, 9 Sep 2013 11:21:31 -0600 (MDT) Message-ID: <522E0293.40404@stpeter.im> Date: Mon, 09 Sep 2013 11:17:07 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: Philipp Hancke References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <522E0075.1010109@stpeter.im> <522E0188.1060407@goodadvice.pages.de> In-Reply-To: <522E0188.1060407@goodadvice.pages.de> X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: XMPP Working Group Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:17:19 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/9/13 11:12 AM, Philipp Hancke wrote: > Am 09.09.2013 19:08, schrieb Peter Saint-Andre: >>> Also, I think we should discuss the use of anonymous (or >>> unauthenticated in general) TLS; I've been convinced recently >>> that using even a non-channel-binding authentication and >>> unauthenticated TLS is substantially better than nothing. It's >>> also what the deployed base actually does. >> >> Could you explain a bit more what you mean by unauthenticated >> TLS? > > Using TLS without checking certificates. Think of the > starttls+dialback stuff that some people have done for years. OK, just checking so that it's in the archives. It's basically the same concept as "better than nothing security", right? https://datatracker.ietf.org/doc/rfc5386/ Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSLgKSAAoJEOoGpJErxa2pMd8P/2nIYaoOpBcs2sReFUvcOL0c PKOdZPKKRXHpxoq/jDoL7sqr8APUJNuxOOJE6rYpQKEF5LuOWbRBklJy7Q+NmppL iSITxnd5bisw5ibyHb4dO/7EfbhF0KKC0uMlwnXSFDIPUAN6us4ejFxpRW+CSceM zzEQZ/BHA645l/F4+asO3lrJj0g61E80TD75pnWgRp3I5kw/wN1IIDj4VdQ4Y7AH Ah8litwqeQ7QeXDlkcaTVXTkREK0xiBaBgP66qulFoMfR6/sleFD/woAX5wPiKTq oztJX/MO4zAlrrrby4JCm+GyFE6PN1891FfiJDcjjJy7IzsXqxcf/RdtxMdmu//t EBiSls9aCuB7KM4UZW8JV2xSCqkZHCQ9Y1H+X1FkJ8vkU44R/VK7it8aVbEgot79 pjFfar+BMuRa3dPv5V32pXC7YcfL/mo8c7cKPJ2/n0B9MvNkW+tNVSSvj5LyXd4K l37KWOl3x8l/MD3fND5zRmcoYlEUpE7TcNK9gpq0U9rvayHqBJU/N+9xkX5DIgbB 5vn2GzrcSVbuYvS3/1wrF/eqIzUEUfH9Bb1I36di0BxNZsni7mqRtNW4XRrHf23g lARbkqKysGBxo1yO3B/Y2LTACC7Gg+0n8LSNp+CV292gMaGAZyjUEAV0YtTySAdy /ymtlko6AIm/avBXqZn3 =D5XJ -----END PGP SIGNATURE----- From stpeter@stpeter.im Mon Sep 9 10:22:00 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F3E921F9DDE for ; Mon, 9 Sep 2013 10:22:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8OmBTJGtxz8L for ; Mon, 9 Sep 2013 10:21:56 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 1E59C21F9A05 for ; Mon, 9 Sep 2013 10:21:56 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 2E53C414CF; Mon, 9 Sep 2013 11:26:18 -0600 (MDT) Message-ID: <522E03B2.4090601@stpeter.im> Date: Mon, 09 Sep 2013 11:21:54 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: Dave Cridland References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> In-Reply-To: X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:22:00 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/9/13 10:51 AM, Dave Cridland wrote: > On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre > > wrote: > > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 > > > Thanks for writing this, it looks like an excellent start. > > o Add information about the rationale for each recommendation, > perhaps in an appendix. > > That seems reasonable, but I don't think there's a need to describe > each recommendation individually. > > o Recommend a specific ciphersuite or a small number of > ciphersuites? > > Picking a small selection of SHOULD or MUST implement seems fair. BTW, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 seems to be something that folks prefer for TLS 1.2, but we'll want to recommend something for earlier versions of TLS, too. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSLgOyAAoJEOoGpJErxa2pV7AP/1PdLbgnZQ/a+Zv+5sgU17u7 5/dr9zjH7H5lhzvI0p3c4MdBm0RwqvCfkg/j3UqcyPpBGNnVyR2Rd1YXUf2R/IAy BACWIplXND/ieAW4KSxsBg7T7lOdbRzQ/ABtcc41cWkT1BteFNeWA5BsgSMrzuML Rc+3h+LT+AUZ1sgdCXWog+erZE2dcvR+BJ0BO6or8cjFr/0ImjhPShANndAGLAXW J5V+f3HO2cqTjAilOA0Bn8CPi2Zl0Usg8CBGoW65xRV/n/ho9tjEUp0Qe1zdHuuV hs14lUYBuawOtaR8c6PmZyl8IDC9xsePx4CYvFDEbmKarnCUdq3yZMgCg/I/FFe8 gfZKHVb7SeGQP8/THdJiwUudkCXLJ22uFb3I/LKgV7PU97eDWa/WbMvm7yU96IY9 Rca/OxbscTeD6FBIe0OehTkUivp9yGdCpBZtd80WkD0CUmU52AQ+cYtmaCdCLDu4 X+NC4I/sSiE7GML0GbvenTpz5uPEOjFAHhpqLXsX8TKQKFWPzyZUrGO5DeMnDLy6 FBpwhsvBqtU7gxh5N65qstOgh4Yx/vwc6PGlVszT2COaOV1JgYU3i0h4yfFeYKW8 Y/8w6AM3o2qVKEzuEP9A0tocVsiYVb4Od22NxH5nQIXLy1e2Fjn3iVCBCjnyjMcG SgzWZ80efe7A35e6Zd9F =KGqJ -----END PGP SIGNATURE----- From stpeter@stpeter.im Mon Sep 9 10:30:51 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F1E021F9D96 for ; Mon, 9 Sep 2013 10:30:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a0riidUuBgDD for ; Mon, 9 Sep 2013 10:30:47 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 2ED7721E8097 for ; Mon, 9 Sep 2013 10:30:47 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.234]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id DB624414CF; Mon, 9 Sep 2013 11:35:08 -0600 (MDT) Message-ID: <522E05C4.7040502@stpeter.im> Date: Mon, 09 Sep 2013 11:30:44 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: "Matt Miller (mamille2)" References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> In-Reply-To: X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:30:51 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/9/13 11:08 AM, Matt Miller (mamille2) wrote: > Some initial feedback: > > * Very nice start, and "YAY" for short and to-the-point drafts! > (-: Thanks! > * This document needs to include recommendations for STARTTLS. > Maybe start with something like "initiating entities MUST expect > in the receiving entity's , and MUST > reject the connection if missing". Yes, there's been related discussion on the DANE list recently (in relation to IMAP). > * In 4.1. Protocol Versions -- ought the document to also > recommend that implementations support the latest version of TLS > (which is currently 1.2)? That might seem obvious ... Good point. Work has started on TLS 1.3, although there's no I-D for it AFAIK. If we publish a spec like this, I'd expect it to be updated on a somewhat regular basis. But pointing to 1.2+ seems sensible. > * In 4.2. Ciphersuites -- this ought to explicitly disallow the > NULL ciphersuites. Again, this might seem obvious ... Nothing is obvious. :-) Will add. > * Also in 4.2. Ciphersuites -- maybe include something about > preferring suites that utilize authenticated encryption (e.g., > AES-GCM). Another good point. > On "Open Issues": > > * Including rationales would be very helpful, and I think it best > to include them as close to the recommendation text as possible. As long as the text doesn't get too wordy. Will experiment with that in the nexst version. > * I think recommending a particular set of ciphersuites would be > worthwhile. > > * A minimum key length for public keys is definitely necessary. > It looks like the ephemeral keys already have minimum length > recommendations. > > * I think a discussion of TLS- versus application-layer > compression is worthwhile. Yep, agreed on those. Thanks for the feedback. I expect to be submitting a revised I-D by the end of the week. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSLgXEAAoJEOoGpJErxa2pwHgP/3+aUEoTzcFmQlIuJ8wGB4k6 uFWJKzklOVLUezOQF3kn6lwVfoVnI1eRNttX5smLfLVo8jDbscUR5N6SFPz+qcL3 qexGiFqB+s2mIlPGLHiD4T7gQR8dTnLQ7fLtxiyrMNDRylLJt63mUthlxjDgm7Ya HveDNKXgzcnONGTZYZ/yf7H0omPKNZ0Ynhu9ykilkFxMqdc8WbfA61ddhZqHEmiM HpqbLz5yHwjGQFA+bRiV+mr0fN/VXq2uqg/Kgl9Mg96vlOVgNHi0wAqj5sK2BXES r9Zrj+fR9IxAkflepw92r8wWGRoKb+GXMPxymaiW8lnFEJ58BzvRFj3gwwrxfrjc AbTj69w7ggqNnXdXz2RAHICsJO6Lf5P7INVwLX31nUqb0Q7fipr8OEEfU61m+2D4 iR+oEfcLQHMuhZdo02j3n/xqeCNynZedkyzr/+/Z/G26Mrcxwd9katRFSkFOqeWw 7Iu4VydYfVS6CWseSrerpVg/yX13OZ+z8Sgxhsu300+8ewnbRgkzIBE/cdHk7bON kJZ9f8HtpEi/B6JoRoQnqo8aQew/fVqQYQ3xhUrUOL7+65Sx/oT1fTPkuuUyCiQv oXkj3s/zhXBnZm1p6TE71VuZ0rxYCSrMrjFULZaw1emVUr3pAb8GLPRUh9nBevFP i1VVV/ixwF32Y8fD6TGl =KUZs -----END PGP SIGNATURE----- From dave@cridland.net Mon Sep 9 10:33:56 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3947321E8097 for ; Mon, 9 Sep 2013 10:33:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.977 X-Spam-Level: X-Spam-Status: No, score=-1.977 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h0M-8bPWdWDC for ; Mon, 9 Sep 2013 10:33:55 -0700 (PDT) Received: from mail-ob0-x232.google.com (mail-ob0-x232.google.com [IPv6:2607:f8b0:4003:c01::232]) by ietfa.amsl.com (Postfix) with ESMTP id DF6FA21E809C for ; Mon, 9 Sep 2013 10:33:54 -0700 (PDT) Received: by mail-ob0-f178.google.com with SMTP id ef5so6263648obb.9 for ; Mon, 09 Sep 2013 10:33:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cridland.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=hwjI31VFfsDqrCDSwAp/YI2vAMqTvNE/XIud6HqM1Ew=; b=d+WDF9qg8iNrXqeEbtzSqKu/CMtujJI7tUon/vq60PaOshSRheHN1YCXhZ89TM40mH e/FZJpgkvPsX6xA/z485ki9nDrXranDbCpa48BVz/Vw71xKVbszixhgQGcMNQDxYbX9a M34nQ2/EAClfoCVLcIRk5lw6xHnvQVuk4hHh8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=hwjI31VFfsDqrCDSwAp/YI2vAMqTvNE/XIud6HqM1Ew=; b=QidGuypxNmREOjs8Y69F2Y0k2Q03Fzp3tpmGHPd6trvoIRSMXoFituD+/ppVMKvtuU v4pcjJN2OqG86AQpqsLI0kwhB/KdlPZXmDsHIJhoohMrgYex7/K61KY161QqcnU7Vf/J zxAxI2+0eCB21N8SvNwewPoub1/Cc9uKgta7nPlGElRug9xw7sJVRey3hwWagyxQO1NV yay3FSvxk68j9LcW+gKngy79H8rlEGT7sPwrrlhAoR/XZMVIpjt4MM5z0qoLI6gW0xw2 FfMdA432TXyyIt/JbZ8cgJut+KSJPIZD3VOR6QVrBEwfEuXzhmeRUyfjfcXOQM+wKJxL lvcA== X-Gm-Message-State: ALoCoQnQ4TXluXzME4x63gaYfBasEHatqPHkNglPtTlHcWZY8TCAu1eZfUApKEsADqTPnILD1oCs MIME-Version: 1.0 X-Received: by 10.60.45.65 with SMTP id k1mr1642158oem.48.1378748034403; Mon, 09 Sep 2013 10:33:54 -0700 (PDT) Received: by 10.60.121.97 with HTTP; Mon, 9 Sep 2013 10:33:54 -0700 (PDT) In-Reply-To: <522E0075.1010109@stpeter.im> References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <522E0075.1010109@stpeter.im> Date: Mon, 9 Sep 2013 18:33:54 +0100 Message-ID: From: Dave Cridland To: Peter Saint-Andre Content-Type: multipart/alternative; boundary=089e0141a79cd35e9004e5f6ca1c Cc: XMPP Subject: Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 09 Sep 2013 17:33:56 -0000 --089e0141a79cd35e9004e5f6ca1c Content-Type: text/plain; charset=ISO-8859-1 On Mon, Sep 9, 2013 at 6:08 PM, Peter Saint-Andre wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On 9/9/13 10:51 AM, Dave Cridland wrote: > > On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre > > > wrote: > > > > There's also a htmlized version available at: > > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 > > > > > > Thanks for writing this, it looks like an excellent start. > > You inspired it because as I recall you suggested that we pull some of > the security recommendations out of draft-ietf-xmpp-3920bis and into a > separate spec that we could update more readily. :-) > > OK, I could take credit. Though years of management have trained me to wait until I see a successful outcome first. > > o Discuss TLS compression vs. application-layer compression? > > > > It's not obvious it's a security issue, but yes. > > Well, there is the CRIME attack against some technologies that use TLS > compression, however it's not clear to me if that applies to XMPP. > > Ah, that. Right. > > The issue remains that compressing streams takes a serious wodge of > > data, but it's desirable. > > > > Also, I think we should discuss the use of anonymous (or > > unauthenticated in general) TLS; I've been convinced recently that > > using even a non-channel-binding authentication and unauthenticated > > TLS is substantially better than nothing. It's also what the > > deployed base actually does. > > Could you explain a bit more what you mean by unauthenticated TLS? > > Any TLS channel which is not authenticated; so ADH is anonymous, whereas self-signed cert usage is the (broader) unauthenticated TLS, as are various other cases. > > Finally, I'd be keen to see this adopted by the working group if > > that's on the table. > > I leave that up to the chairs. :-) Depending on how you read the > charter, it might or might not be in scope. > > Charters can be changed, of course. Dave. --089e0141a79cd35e9004e5f6ca1c Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable
On Mon, Sep 9, 2013 at 6:08 PM, Peter Saint-Andre <stpet= er@stpeter.im> wrote:
-----BEGIN PGP SIGNED MESS= AGE-----
Hash: SHA1

On 9/9/13 10:51 AM, Dave Cridland wrote:
> On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre
> <stpe= ter@stpeter.im <mailto:stpeter= @stpeter.im>> wrote:
>
> There's also a htmlized version available at:
> http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00=
>
>
> Thanks for writing this, it looks like an excellent start.

You inspired it because as I recall you suggested that we pull some o= f
the security recommendations out of draft-ietf-xmpp-3920bis and into a
separate spec that we could update more readily. :-)


OK, I could ta= ke credit. Though years of management have trained me to wait until I see a= successful outcome first.
=A0
> o =A0Discuss TLS compression vs. application-layer c= ompression?
>
> It's not obvious it's a security issue, but yes.

Well, there is the CRIME attack against some technologies that use TL= S
compression, however it's not clear to me if that applies to XMPP.


Ah, that. Righ= t.
=A0
> The issue remains that compressing streams takes a serious wodge of > data, but it's desirable.
>
> Also, I think we should discuss the use of anonymous (or
> unauthenticated in general) TLS; I've been convinced recently that=
> using even a non-channel-binding authentication and unauthenticated > TLS is substantially better than nothing. It's also what the
> deployed base actually does.

Could you explain a bit more what you mean by unauthenticated TLS?


Any TLS channe= l which is not authenticated; so ADH is anonymous, whereas self-signed cert= usage is the (broader) unauthenticated TLS, as are various other cases.
=A0
> Finally, I'd be keen to see this adopted by the working group if > that's on the table.

I leave that up to the chairs. :-) =A0Depending on how you read the charter, it might or might not be in scope.


Charters can be changed, of course.

Dave.
--089e0141a79cd35e9004e5f6ca1c-- From oej@edvina.net Wed Sep 11 00:37:43 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86E9511E8145 for ; Wed, 11 Sep 2013 00:37:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=-0.001, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 99lMneggVbTD for ; Wed, 11 Sep 2013 00:37:29 -0700 (PDT) Received: from smtp7.webway.se (smtp7.webway.se [IPv6:2a02:920:212e::205]) by ietfa.amsl.com (Postfix) with ESMTP id 0B03021F96EF for ; Wed, 11 Sep 2013 00:37:26 -0700 (PDT) Received: from [192.168.40.16] (h87-96-134-126.dynamic.se.alltele.net [87.96.134.126]) by smtp7.webway.se (Postfix) with ESMTPA id 5069E93C2A2; Wed, 11 Sep 2013 07:37:24 +0000 (UTC) Content-Type: multipart/alternative; boundary="Apple-Mail=_BCDC5209-CBDA-4DE2-AE69-C495B55392F7" Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: "Olle E. Johansson" In-Reply-To: <522DFA69.2020101@stpeter.im> Date: Wed, 11 Sep 2013 09:37:22 +0200 Message-Id: References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <522DFA69.2020101@stpeter.im> To: Peter Saint-Andre X-Mailer: Apple Mail (2.1508) Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 07:37:43 -0000 --Apple-Mail=_BCDC5209-CBDA-4DE2-AE69-C495B55392F7 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii This feels like a good move. I would like to steal these ideas for SIP. Now, the question is how we can get developers to listen? /O 9 sep 2013 kl. 18:42 skrev Peter Saint-Andre : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Oh, I just thought of another open issue: we might want to say > something about TLS session resumption. > > On 9/9/13 10:35 AM, Peter Saint-Andre wrote: >> FYI. >> >> >> -------- Original Message -------- Subject: I-D Action: >> draft-saintandre-xmpp-tls-00.txt Date: Mon, 09 Sep 2013 09:32:08 >> -0700 From: internet-drafts@ietf.org Reply-To: >> internet-drafts@ietf.org To: i-d-announce@ietf.org >> >> >> A New Internet-Draft is available from the on-line Internet-Drafts >> directories. >> >> >> Title : Use of Transport Layer Security (TLS) in the >> Extensible Messaging and Presence Protocol (XMPP) Author(s) : >> Peter Saint-Andre Filename : >> draft-saintandre-xmpp-tls-00.txt Pages : 6 Date >> : 2013-09-09 >> >> Abstract: This document provides recommendations for the use of >> Transport Layer Security (TLS) in the Extensible Messaging and >> Presence Protocol (XMPP). This document updates RFC 6120. >> >> >> The IETF datatracker status page for this draft is: >> https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls >> >> There's also a htmlized version available at: >> http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 >> >> >> Please note that it may take a couple of minutes from the time of >> submission until the htmlized version and diff are available at >> tools.ietf.org. >> >> Internet-Drafts are also available by anonymous FTP at: >> ftp://ftp.ietf.org/internet-drafts/ >> >> _______________________________________________ I-D-Announce >> mailing list I-D-Announce@ietf.org >> https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft >> directories: http://www.ietf.org/shadow.html or >> ftp://ftp.ietf.org/ietf/1shadow-sites.txt >> >> >> _______________________________________________ xmpp mailing list >> xmpp@ietf.org https://www.ietf.org/mailman/listinfo/xmpp >> > > - -- > Peter Saint-Andre > https://stpeter.im/ > > > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.19 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQIcBAEBAgAGBQJSLfppAAoJEOoGpJErxa2pT7UQAIPcg6lmhdCJxoUuQilk5iFv > DyxhX4UNWIkPCLEBWncjzA31vaihOWzdnS5KEqrtXWTWx4UTbe8PNMW+je3/sw9z > FxKNLEC0k/DMq+KQ5503UnCT3TPToo3+WkCCjmpjBEEbaWkgJOm2Xow8mkU9n1+U > +q6akKYbIBezZhKdYl5LKbLqff4U3Q/QWlBI/oAr8JgEckZgV8lJ9VZw4cQsSqa/ > HFmEwRghWEY75Wosj8mHvuD4GkBvWEx/fqI6wjCfTyLllM25mgATp/KonMuKJ1jC > Sk57GVh8Zhlwjgu2Dem8OTL9BiVPrPJ+l+uMmK6ZMUcztxN0VL+Mwx3RXZxiX6Ho > ZQXGWgXnk7/hcXak91qINl363ys+XayR4QtUJEIeB47tklI6Xlswy4+GsHzx69p7 > m3u7SV6i3dhWKYgvdksbLYjxBKSz0QUYMgmiZR+GjMj3j+KrSSerNx6yx9QkjtcM > spWxRWzJN6j54BSw9hZpl9rTutVZNFaXGYdCUTI36awer4orzD4SXdsp4azZvbBT > djSpGXEzd1ScHmaQnZ59slVOcDAZOkl3Ws+hWUZ+A6rFkeumzuo4V1vMbHQATa50 > xcE/jaDj0FcA9lzdMSNxs72YOo6e1swhbQ+fTTWkDwM6dRV949cHAOpeVwIUnYcQ > KAAlZGZswWwG//t+GdyK > =oufx > -----END PGP SIGNATURE----- > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp --- * Olle E Johansson - oej@edvina.net * Cell phone +46 70 593 68 51, Office +46 8 96 40 20, Sweden --Apple-Mail=_BCDC5209-CBDA-4DE2-AE69-C495B55392F7 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii This = feels like a good move. I would like to steal these ideas for = SIP.
Now, the question is how we can get developers to = listen?

/O

9 sep 2013 = kl. 18:42 skrev Peter Saint-Andre <stpeter@stpeter.im>:

-----BEGIN = PGP SIGNED MESSAGE-----
Hash: SHA1

Oh, I just thought of = another open issue: we might want to say
something about TLS session = resumption.

On 9/9/13 10:35 AM, Peter Saint-Andre = wrote:
FYI.


-------- Original = Message -------- Subject: I-D = Action:
draft-saintandre-xmpp-tls-00.txt Date: Mon, 09 Sep 2013 = 09:32:08
-0700 From: internet-drafts@ietf.org = Reply-To:
internet-drafts@ietf.org = To: i-d-announce@ietf.org

A New Internet-Draft is available from the on-line Internet-Drafts =
directories.


Title =           : Use of = Transport Layer Security (TLS) in the
Extensible Messaging and = Presence Protocol (XMPP) Author(s) =       :
Peter Saint-Andre Filename =        :
draft-saintandre-xmpp-tls-0= 0.txt Pages =           : 6 = Date
: 2013-09-09

Abstract: This document provides = recommendations for the use of
Transport Layer Security (TLS) in the = Extensible Messaging and
Presence Protocol (XMPP).  This = document updates RFC 6120.


The IETF datatracker status page = for this draft is:
https:= //datatracker.ietf.org/doc/draft-saintandre-xmpp-tls

There's = also a htmlized version available at: =
http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00


Ple= ase note that it may take a couple of minutes from the time of =
submission until the htmlized version and diff are available = at
tools.ietf.org.

Internet-Drafts are also available by = anonymous FTP at: =
ftp://ftp.ietf.org/internet-drafts/

___________________________= ____________________ I-D-Announce
mailing list I-D-Announce@ietf.org =
https://www.ietf.org/mailman/listinfo/i-d-announce = Internet-Draft
directories: http://www.ietf.org/shadow.html = or
ftp://ftp.ietf.org/ietf/1shadow-sites.txt


_______________= ________________________________ xmpp mailing list
xmpp@ietf.org = https://www.ietf.org/mailman/listinfo/xmpp


- -- =
Peter Saint-Andre
https://stpeter.im/


-----BEGIN= PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 = (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using = GnuPG with Thunderbird - = http://www.enigmail.net/

iQIcBAEBAgAGBQJSLfppAAoJEOoGpJErxa2pT7UQAI= Pcg6lmhdCJxoUuQilk5iFv
DyxhX4UNWIkPCLEBWncjzA31vaihOWzdnS5KEqrtXWTWx4UT= be8PNMW+je3/sw9z
FxKNLEC0k/DMq+KQ5503UnCT3TPToo3+WkCCjmpjBEEbaWkgJOm2Xo= w8mkU9n1+U
+q6akKYbIBezZhKdYl5LKbLqff4U3Q/QWlBI/oAr8JgEckZgV8lJ9VZw4cQs= Sqa/
HFmEwRghWEY75Wosj8mHvuD4GkBvWEx/fqI6wjCfTyLllM25mgATp/KonMuKJ1jCSk57GVh8Zhlwjgu2Dem8OTL9BiVPrPJ+l+uMmK6ZMUcztxN0VL+Mwx3RXZxiX6Ho
ZQXG= WgXnk7/hcXak91qINl363ys+XayR4QtUJEIeB47tklI6Xlswy4+GsHzx69p7
m3u7SV6i3d= hWKYgvdksbLYjxBKSz0QUYMgmiZR+GjMj3j+KrSSerNx6yx9QkjtcM
spWxRWzJN6j54BSw= 9hZpl9rTutVZNFaXGYdCUTI36awer4orzD4SXdsp4azZvbBT
djSpGXEzd1ScHmaQnZ59sl= VOcDAZOkl3Ws+hWUZ+A6rFkeumzuo4V1vMbHQATa50
xcE/jaDj0FcA9lzdMSNxs72YOo6e= 1swhbQ+fTTWkDwM6dRV949cHAOpeVwIUnYcQ
KAAlZGZswWwG//t+GdyK
=3Doufx-----END PGP = SIGNATURE-----
_______________________________________________
xmpp = mailing = list
xmpp@ietf.org
https://www.ietf.org/mailman/listinfo/xmpp

---
* Olle E = Johansson - oej@edvina.net
* Cell phone = +46 70 593 68 51, Office +46 8 96 40 20, Sweden



= --Apple-Mail=_BCDC5209-CBDA-4DE2-AE69-C495B55392F7-- From oej@edvina.net Wed Sep 11 00:41:21 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32D4121F949F for ; Wed, 11 Sep 2013 00:41:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Qs4tm4yCie2I for ; Wed, 11 Sep 2013 00:41:20 -0700 (PDT) Received: from smtp7.webway.se (smtp7.webway.se [IPv6:2a02:920:212e::205]) by ietfa.amsl.com (Postfix) with ESMTP id C240321F92E7 for ; Wed, 11 Sep 2013 00:41:19 -0700 (PDT) Received: from [192.168.40.16] (h87-96-134-126.dynamic.se.alltele.net [87.96.134.126]) by smtp7.webway.se (Postfix) with ESMTPA id 5694393C2A1; Wed, 11 Sep 2013 07:41:18 +0000 (UTC) Content-Type: multipart/alternative; boundary="Apple-Mail=_AF2EA451-753C-4B32-82FB-0951AEBBEFCE" Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: "Olle E. Johansson" In-Reply-To: <522DF8BC.7040701@stpeter.im> Date: Wed, 11 Sep 2013 09:41:17 +0200 Message-Id: <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> To: Peter Saint-Andre X-Mailer: Apple Mail (2.1508) Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 07:41:21 -0000 --Apple-Mail=_AF2EA451-753C-4B32-82FB-0951AEBBEFCE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I notice that you do not mention SNI. Should that be added to server = requirements. If not, why? /O 9 sep 2013 kl. 18:35 skrev Peter Saint-Andre : > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 >=20 > FYI. >=20 >=20 > - -------- Original Message -------- > Subject: I-D Action: draft-saintandre-xmpp-tls-00.txt > Date: Mon, 09 Sep 2013 09:32:08 -0700 > From: internet-drafts@ietf.org > Reply-To: internet-drafts@ietf.org > To: i-d-announce@ietf.org >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts > directories. >=20 >=20 > Title : Use of Transport Layer Security (TLS) in the > Extensible Messaging and Presence Protocol (XMPP) > Author(s) : Peter Saint-Andre > Filename : draft-saintandre-xmpp-tls-00.txt > Pages : 6 > Date : 2013-09-09 >=20 > Abstract: > This document provides recommendations for the use of Transport = Layer > Security (TLS) in the Extensible Messaging and Presence Protocol > (XMPP). This document updates RFC 6120. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls >=20 > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00 >=20 >=20 > Please note that it may take a couple of minutes from the time of > submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt >=20 >=20 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.19 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ >=20 > iQIcBAEBAgAGBQJSLfi8AAoJEOoGpJErxa2pTBwP/2wai24XXThd0la48PuZMKP1 > DYCClQzjvm/TOBdSk/EQxQlq50B3KEH3AN2WFN5a7f22GXT/44kZzMCi+maEiz+X > FyazwluRPisP/LHcg+CIDZxcj0RJFVbBAClLUCYTNukmmd9gegCZnPRgWyDnOs7E > Kus7OLp8FcKPIpq7dHB95Ya2jmGTNmC7VAk0ckPthuBy1Lg48LPfGL2olUckqT7c > snRL8eCNvvGp2/QK3yvLcoUWnk/8IBDLoGvS1Yi/jEWrVGjVzAzl+zZK+g/7H0Bo > pMYPwplFeIWmmTTf+sjTKJo1RzFtlaob86xA7ybuD+RpELgqHvM8MvS8rai/QmQL > dElBQSd8SqoElmuJzT61R0A70JMmcnzLMC1H/3+J0Pbafy4c1H/WKghSH1+XAKVv > mcRLuyFTi2heuXBVWcRr4rqL4mr9lrsztdFE7m5HEx6I7mTnLwFxgcdzLh+WPAkv > wwP61eEU2w5kco/8yMM8d+iiyt9Q1rsz+YivG4a9Ilnq2Y2f/FLVu5ztAOesT2wS > eEmNbKnFCzATwfj+h9x7BYVJdGdt3zR6iUwVuf7FBOjqN3Z2JXmC7KtQE4NUu4vd > zcsAvACv5a+jpJd0/QNGiXXS8Fjn4LP/ols4n3AHScJPAjRmfVGqu2VkNRDxowYP > 7Y++rCrAcvpGqarre6P0 > =3D9WO8 > -----END PGP SIGNATURE----- > _______________________________________________ > xmpp mailing list > xmpp@ietf.org > https://www.ietf.org/mailman/listinfo/xmpp --- * Olle E Johansson - oej@edvina.net * Cell phone +46 70 593 68 51, Office +46 8 96 40 20, Sweden --Apple-Mail=_AF2EA451-753C-4B32-82FB-0951AEBBEFCE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii I = notice that you do not mention SNI. Should that be added to server = requirements. If not, = why?

/O

9 sep 2013 kl. 18:35 = skrev Peter Saint-Andre <stpeter@stpeter.im>:

-----BEGIN = PGP SIGNED MESSAGE-----
Hash: SHA1

FYI.


- -------- = Original Message --------
Subject: I-D Action: = draft-saintandre-xmpp-tls-00.txt
Date: Mon, 09 Sep 2013 09:32:08 = -0700
From: internet-drafts@ietf.org
R= eply-To: internet-drafts@ietf.org
T= o: i-d-announce@ietf.org

A New Internet-Draft is available from the on-line = Internet-Drafts
directories.


Title =           : Use of = Transport Layer Security (TLS) in the
Extensible Messaging and = Presence Protocol (XMPP)
Author(s) =       : Peter Saint-Andre
Filename =        : = draft-saintandre-xmpp-tls-00.txt
Pages =           : 6
Date =            : = 2013-09-09

Abstract:
  This document provides = recommendations for the use of Transport Layer
  Security = (TLS) in the Extensible Messaging and Presence Protocol
=   (XMPP).  This document updates RFC 6120.


The = IETF datatracker status page for this draft is:
https:= //datatracker.ietf.org/doc/draft-saintandre-xmpp-tls

There's = also a htmlized version available = at:
http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00


= Please note that it may take a couple of minutes from the time = of
submission
until the htmlized version and diff are available at = tools.ietf.org.

Internet-Drafts are also available by anonymous = FTP = at:
ftp://ftp.ietf.org/internet-drafts/

________________________= _______________________
I-D-Announce mailing = list
I-D-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/i-d= -announce
Internet-Draft directories: = http://www.ietf.org/shadow.html
or = ftp://ftp.ietf.org/ietf/1shadow-sites.txt


-----BEGIN PGP = SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.19 (Darwin)
Comment: = GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird = - = http://www.enigmail.net/

iQIcBAEBAgAGBQJSLfi8AAoJEOoGpJErxa2pTBwP/2= wai24XXThd0la48PuZMKP1
DYCClQzjvm/TOBdSk/EQxQlq50B3KEH3AN2WFN5a7f22GXT/= 44kZzMCi+maEiz+X
FyazwluRPisP/LHcg+CIDZxcj0RJFVbBAClLUCYTNukmmd9gegCZnP= RgWyDnOs7E
Kus7OLp8FcKPIpq7dHB95Ya2jmGTNmC7VAk0ckPthuBy1Lg48LPfGL2olUck= qT7c
snRL8eCNvvGp2/QK3yvLcoUWnk/8IBDLoGvS1Yi/jEWrVGjVzAzl+zZK+g/7H0BopMYPwplFeIWmmTTf+sjTKJo1RzFtlaob86xA7ybuD+RpELgqHvM8MvS8rai/QmQL
dElB= QSd8SqoElmuJzT61R0A70JMmcnzLMC1H/3+J0Pbafy4c1H/WKghSH1+XAKVv
mcRLuyFTi2= heuXBVWcRr4rqL4mr9lrsztdFE7m5HEx6I7mTnLwFxgcdzLh+WPAkv
wwP61eEU2w5kco/8= yMM8d+iiyt9Q1rsz+YivG4a9Ilnq2Y2f/FLVu5ztAOesT2wS
eEmNbKnFCzATwfj+h9x7BY= VJdGdt3zR6iUwVuf7FBOjqN3Z2JXmC7KtQE4NUu4vd
zcsAvACv5a+jpJd0/QNGiXXS8Fjn= 4LP/ols4n3AHScJPAjRmfVGqu2VkNRDxowYP
7Y++rCrAcvpGqarre6P0
=3D9WO8-----END PGP = SIGNATURE-----
_______________________________________________
xmpp = mailing = list
xmpp@ietf.org
https://www.ietf.org/mailman/listinfo/xmpp

---
* Olle E = Johansson - oej@edvina.net
* Cell phone = +46 70 593 68 51, Office +46 8 96 40 20, Sweden



= --Apple-Mail=_AF2EA451-753C-4B32-82FB-0951AEBBEFCE-- From tmarkmann@googlemail.com Wed Sep 11 00:51:52 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7944F21E805F for ; Wed, 11 Sep 2013 00:51:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.685 X-Spam-Level: X-Spam-Status: No, score=-0.685 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, MISSING_HEADERS=1.292, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IYQS6SgpHwR9 for ; Wed, 11 Sep 2013 00:51:51 -0700 (PDT) Received: from mail-wi0-x236.google.com (mail-wi0-x236.google.com [IPv6:2a00:1450:400c:c05::236]) by ietfa.amsl.com (Postfix) with ESMTP id 9DE3A11E81F0 for ; Wed, 11 Sep 2013 00:51:51 -0700 (PDT) Received: by mail-wi0-f182.google.com with SMTP id ez12so1788252wid.9 for ; Wed, 11 Sep 2013 00:51:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:cc :content-type; bh=yQq/KXnUUVKZTnqY+VotJ5kZna5Xj89lBXH8JN8tH/Q=; b=fQDSh3uve50g4hbuyg2eVYrwpvasTFK6bwjaIayXk+FflU36TZ1X0obMNI5I3D+5kf eHYpUt232w82BQ2x9QdmYVjtEJ2SgZaA5g3JlT+FLUOYriIKsSrwicHlRCbskeJL//Mg gWl71di7ysQXR6jSHIG1u29CO1O3R/B1lCaCQ6giSK/fQc/CxECXHQWKromh2ebpHAYx o7lYXR6+a7OTPHKyc+lOcH6HfyKgB5dMPEgPIr7FC8iUpeZkVfXjlUqOJpgR9csQRc4I RvxXnUfdAmghMd2QPdjBZEzbNy00QuONpFNcYxTOB/OF5YPKD+uXJZvlXLx9bnHglJaB N36Q== X-Received: by 10.180.182.15 with SMTP id ea15mt19136918wic.16.1378885909516; Wed, 11 Sep 2013 00:51:49 -0700 (PDT) MIME-Version: 1.0 Received: by 10.227.200.71 with HTTP; Wed, 11 Sep 2013 00:51:29 -0700 (PDT) In-Reply-To: <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> From: Tobias Markmann Date: Wed, 11 Sep 2013 09:51:29 +0200 Message-ID: Content-Type: multipart/alternative; boundary=047d7b62535ad2e08104e616e4ed Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 07:51:52 -0000 --047d7b62535ad2e08104e616e4ed Content-Type: text/plain; charset=UTF-8 Fwd. Forgot to hit Reply-All. On Wed, Sep 11, 2013 at 9:41 AM, Olle E. Johansson wrote: > I notice that you do not mention SNI. Should that be added to server > requirements. If not, why? > SNI = Server Name Indication? If so, it isn't used by XMPP due to its use of STARTTLS and by that servers knowing beforehand for what domain they need to provide the certificate. Would it provide any value in STARTTLS scenarios? Cheers, Tobi --047d7b62535ad2e08104e616e4ed Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Fwd. Forgot to hit= Reply-All.

On Wed, Sep = 11, 2013 at 9:41 AM, Olle E. Johansson=C2=A0<oej@edvina.net>= =C2=A0wrote:
I notice that you do not mention SNI. Should that be added to server requir= ements. If not, why?

SNI =3D Server Name Indication? If so, it isn't= used by XMPP due to its use of STARTTLS and by that servers knowing before= hand for what domain they need to provide the certificate. Would it provide= any value in STARTTLS scenarios?

Cheers,
Tobi
--047d7b62535ad2e08104e616e4ed-- From oej@edvina.net Wed Sep 11 00:55:54 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F01FE21E8096 for ; Wed, 11 Sep 2013 00:55:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.598 X-Spam-Level: X-Spam-Status: No, score=-2.598 tagged_above=-999 required=5 tests=[AWL=-0.000, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E0TvVn9R-PZV for ; Wed, 11 Sep 2013 00:55:38 -0700 (PDT) Received: from smtp7.webway.se (smtp7.webway.se [IPv6:2a02:920:212e::205]) by ietfa.amsl.com (Postfix) with ESMTP id 5275711E81FB for ; Wed, 11 Sep 2013 00:55:26 -0700 (PDT) Received: from [192.168.40.16] (h87-96-134-126.dynamic.se.alltele.net [87.96.134.126]) by smtp7.webway.se (Postfix) with ESMTPA id 6C8F093C2A2; Wed, 11 Sep 2013 07:55:25 +0000 (UTC) Content-Type: multipart/alternative; boundary="Apple-Mail=_4A0F7ED5-B2AB-4913-A702-A1AF6C6F4D25" Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: "Olle E. Johansson" In-Reply-To: Date: Wed, 11 Sep 2013 09:55:24 +0200 Message-Id: <423CD7F5-9FC5-4B46-B340-F30DC5D1F8AD@edvina.net> References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> To: Tobias Markmann X-Mailer: Apple Mail (2.1508) Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 07:55:55 -0000 --Apple-Mail=_4A0F7ED5-B2AB-4913-A702-A1AF6C6F4D25 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii 11 sep 2013 kl. 09:51 skrev Tobias Markmann : >=20 > On Wed, Sep 11, 2013 at 9:41 AM, Olle E. Johansson = wrote: > I notice that you do not mention SNI. Should that be added to server = requirements. If not, why? >=20 > SNI =3D Server Name Indication? If so, it isn't used by XMPP due to = its use of STARTTLS and by that servers knowing beforehand for what = domain they need to provide the certificate. Would it provide any value = in STARTTLS scenarios? >=20 Right. Thanks for the response. Personally I don't see any benefit of SNI in the case of STARTTLS. = Anyone else? /O= --Apple-Mail=_4A0F7ED5-B2AB-4913-A702-A1AF6C6F4D25 Content-Transfer-Encoding: 7bit Content-Type: text/html; charset=us-ascii
11 sep 2013 kl. 09:51 skrev Tobias Markmann <tmarkmann@googlemail.com>:


On Wed, Sep 11, 2013 at 9:41 AM, Olle E. Johansson <oej@edvina.net> wrote:
I notice that you do not mention SNI. Should that be added to server requirements. If not, why?

SNI = Server Name Indication? If so, it isn't used by XMPP due to its use of STARTTLS and by that servers knowing beforehand for what domain they need to provide the certificate. Would it provide any value in STARTTLS scenarios?

Right. Thanks for the response.

Personally I don't see any benefit of SNI in the case of STARTTLS. Anyone else?

/O
--Apple-Mail=_4A0F7ED5-B2AB-4913-A702-A1AF6C6F4D25-- From fippo@goodadvice.pages.de Wed Sep 11 01:02:01 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAEE311E81F0 for ; Wed, 11 Sep 2013 01:02:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nx+OrtcBspMv for ; Wed, 11 Sep 2013 01:01:56 -0700 (PDT) Received: from lo.psyced.org (lost.IN.psyced.org [188.40.42.221]) by ietfa.amsl.com (Postfix) with ESMTP id 6CF0A11E81FB for ; Wed, 11 Sep 2013 01:01:56 -0700 (PDT) Received: from lo.psyced.org (localhost [127.0.0.1]) by lo.psyced.org (8.14.3/8.14.3/Debian-9.4) with ESMTP id r8B81R6g007511 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 11 Sep 2013 10:01:27 +0200 Received: from localhost (fippo@localhost) by lo.psyced.org (8.14.3/8.14.3/Submit) with ESMTP id r8B81QZD007507; Wed, 11 Sep 2013 10:01:26 +0200 X-Authentication-Warning: lo.psyced.org: fippo owned process doing -bs Date: Wed, 11 Sep 2013 10:01:26 +0200 (CEST) From: Philipp Hancke X-X-Sender: fippo@lo.psyced.org To: "Olle E. Johansson" In-Reply-To: <423CD7F5-9FC5-4B46-B340-F30DC5D1F8AD@edvina.net> Message-ID: References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> <423CD7F5-9FC5-4B46-B340-F30DC5D1F8AD@edvina.net> User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 08:02:01 -0000 On Wed, 11 Sep 2013, Olle E. Johansson wrote: > Right. Thanks for the response. > Personally I don't see any benefit of SNI in the case of STARTTLS. Anyone else? No, and ISTR that it was removed in a late 3920bis draft for that reason. From stpeter@stpeter.im Wed Sep 11 05:24:45 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54F6D11E8229 for ; Wed, 11 Sep 2013 05:24:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TKD0pxszK-bb for ; Wed, 11 Sep 2013 05:24:40 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id EA7A311E810B for ; Wed, 11 Sep 2013 05:24:39 -0700 (PDT) Received: from ergon.local (unknown [71.237.13.154]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 08140414BB; Wed, 11 Sep 2013 06:29:06 -0600 (MDT) Message-ID: <52306106.7010002@stpeter.im> Date: Wed, 11 Sep 2013 06:24:38 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: Tobias Markmann References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> In-Reply-To: X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 12:24:46 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 9/11/13 1:51 AM, Tobias Markmann wrote: > Fwd. Forgot to hit Reply-All. > > On Wed, Sep 11, 2013 at 9:41 AM, Olle E. Johansson > wrote: > > I notice that you do not mention SNI. Should that be added to > server requirements. If not, why? > > > SNI = Server Name Indication? If so, it isn't used by XMPP due to > its use of STARTTLS and by that servers knowing beforehand for what > domain they need to provide the certificate. Would it provide any > value in STARTTLS scenarios? Right, we use the 'to' address of the initial stream header as equivalent to SNI. This is mentioned in Section 4.7.2 of RFC 6120. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSMGEGAAoJEOoGpJErxa2p7skP/AtJxN84S9MXl96Wg9Ng7iF/ tsP1gTSRj4knTlwEwo4tQpbmdsEXzkwDPWXeZ161R8lzl7+bLmiyx353wbA3Cm1l QDBOg/2AxjqyByiWnoYuwUECwKlPVE0uwCWZpZ/NUTYhrfIljqy3A52mwDeJdlMk Qt/X6PuEMJSx9jtgfDNiEtAvFcl+0ab6lAeeCbP0qlLsaht9yMmSjTXek3sP/KCt L8hKGGdSI4umL0TMtXnL0HXoivWNIg2C1RcrxqqOdQw8mUh+5rvWnICk0Y1WG2d2 8zjl4rfP/7bS5yyitJsmmGHzLgLPbUDuT4Fkx1A/71PIUXqx0ZNUkG8Ah3IoUJSr Glwe2ZNxrURaKMxRsVfk4fso3QDqUJ1yjjB2Pbifr0WqWUHFqauCCWEhX9aKSiSC wFXeeILW1pFHYIP67z4v/JGC2m5iHt4+M6LOKWISoMlnf/6RdZUQgdQcYWWa2BGo ch9jypHeyrn4kHHeaXVJlRc67eRNzP5/eZReBr7Xut/Ay5n4Ysu1bQih+0VGN4oK 8LuAjGP1Dw2pK7JMtE3zGgf9lWmUccG9qal3zi+k2LzXZ6X41aX50bMfo149g3SQ G50WclgRAyrdSRW0oCX2c2UUl3NYVzPuF8N+8K/L9LfCSeFaRbthphI0f0D3gv+g QMIyFR0MgdoqaEQCup8k =PyX0 -----END PGP SIGNATURE----- From thijs@xnyhps.nl Wed Sep 11 05:47:31 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA17321E80AA for ; Wed, 11 Sep 2013 05:47:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.504 X-Spam-Level: X-Spam-Status: No, score=-0.504 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HELO_EQ_NL=0.55, HOST_EQ_NL=1.545] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PzQxqrVGatZ3 for ; Wed, 11 Sep 2013 05:47:26 -0700 (PDT) Received: from s.xnyhps.nl (s.xnyhps.nl [46.19.32.61]) by ietfa.amsl.com (Postfix) with ESMTP id B6F0A21E80E3 for ; Wed, 11 Sep 2013 05:47:26 -0700 (PDT) Received: from [192.168.1.11] (196pc201.sshunet.nl [145.97.201.196]) by s.xnyhps.nl (Postfix) with ESMTPSA id 8F5BC1FE5C; Wed, 11 Sep 2013 14:47:23 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=xnyhps.nl; s=mail; t=1378903643; bh=fStZbndH7tARvkXIqSPIyCg1XAFmMqNLTwzh6L/HOAE=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=ORqQL1ms86HXKHHXgaZUvATjlW/awF+rqPJS9AUL8iCWcgR7HY8fdUqrnS0DL+DyQ H30PQ+9gEhlNhy5/lkNBrFiPm1+8KHE+FTjkpyUxdg+G2wkqWX4amByZ0g6FOBZKT3 AkmX2lMTXrB7nEcdYVo78liRx91mXQw+cSVezHBg= Content-Type: multipart/signed; boundary="Apple-Mail=_7B60C23F-9A7B-4880-81AC-BA6B38147ED3"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 6.5 \(1508\)) From: Thijs Alkemade In-Reply-To: <52306106.7010002@stpeter.im> Date: Wed, 11 Sep 2013 14:47:20 +0200 Message-Id: <632BDE78-5A3D-45C7-A580-57714136772E@xnyhps.nl> References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> <52306106.7010002@stpeter.im> To: Peter Saint-Andre X-Mailer: Apple Mail (2.1508) Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 12:47:31 -0000 --Apple-Mail=_7B60C23F-9A7B-4880-81AC-BA6B38147ED3 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii Hello Peter, Thank you for writing this. I think it's a good initiative and I hope many servers start following it. Two things I want to note though: * 3DES is technically 168 bit, but offers only 112 bits of security. As it is written, it does not fall under the MUST NOT for <128 bit algorithms. In my opinion it should be a MUST NOT too. * If you follow the OpenSSL naming, I think you mean the ECDHE suites, not ECDH. ECDH does not offer forward secrecy. Regards, Thijs --Apple-Mail=_7B60C23F-9A7B-4880-81AC-BA6B38147ED3 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJSMGZbAAoJELRGwhIrI4PETb8P/2HsmF1I3bt+XbrCYsD0Wkfx L1VE7fkhfKXaSlCiYAGurBro/p1+tYF+G20UTElXa2prfsphEpcfqAhiMN/DQRcD eGvIH5hA4WYZZxH5vW0MnaHjJpQnnMkuwSc9dOjk18ESrnKN1/XEO5ldYxtg1rWn DaNwHis91P9775JsQUwAW3z2oWJWJUPEWbBug7x/WcCx0kys6+Gwj3QyvbCdilZA 3O0kuoBJvG7xOmLf2yAuK/Pj70NzLpnU7IdyasCwfRYeyhNl0/+M0eI6QZXybv9p j+zTuDFICMkI4JsZgKFvkEkJjqsz3p7AB+79MQSfplR5yC0oqbNFsYrHx/EH52Iv ws9tkLzyfDiEcOvOL3JvslHPLkkD37OuNkfOq7NwKjkS4qKcvG/Y4S3VzZgwJ8KW vYP6ThAIBN3Huwf85iebF/DriGLB3VBBOZYA7OBTz/93LmtvQq4x3MWizQxQjMDL zaW783PfbEFnSwAl2vKL4tzYK8tPHhVpwz7eXcvZyupaG0bq0Emht+pCteXOLCg2 Ad1DcMAnT/pHjYLZo4UX6zG0xG4y0kJSh6Xn7vLUyStEoma3ZKY1tp30TLA7Qcuj 6vkiABZ7EvCSL/C9ez+qcE/bTBqEC68qLP3hM2Lf+NEaeQhIoA6PW3LtLxnWIoQL TKNpSv/JiE6blRFd9sev =JWtv -----END PGP SIGNATURE----- --Apple-Mail=_7B60C23F-9A7B-4880-81AC-BA6B38147ED3-- From stpeter@stpeter.im Wed Sep 11 08:25:29 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33F6921E8132 for ; Wed, 11 Sep 2013 08:25:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D5xbkfSNqH3g for ; Wed, 11 Sep 2013 08:25:05 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 1BA3E21E8130 for ; Wed, 11 Sep 2013 08:25:05 -0700 (PDT) Received: from ergon.local (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 4F74041641; Wed, 11 Sep 2013 09:29:33 -0600 (MDT) Message-ID: <52308B4F.9020301@stpeter.im> Date: Wed, 11 Sep 2013 09:25:03 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: Thijs Alkemade References: <20130909163208.24682.22846.idtracker@ietfa.amsl.com> <522DF8BC.7040701@stpeter.im> <6E448524-9EC2-4CB2-9C2A-A4E47564AEF4@edvina.net> <52306106.7010002@stpeter.im> <632BDE78-5A3D-45C7-A580-57714136772E@xnyhps.nl> In-Reply-To: <632BDE78-5A3D-45C7-A580-57714136772E@xnyhps.nl> X-Enigmail-Version: 1.5.2 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: XMPP Subject: Re: [xmpp] I-D Action: draft-saintandre-xmpp-tls-00.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Sep 2013 15:25:29 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hallo Thijs! On 9/11/13 6:47 AM, Thijs Alkemade wrote: > Hello Peter, > > Thank you for writing this. I think it's a good initiative and I > hope many servers start following it. Two things I want to note > though: > > * 3DES is technically 168 bit, but offers only 112 bits of > security. As it is written, it does not fall under the MUST NOT for > <128 bit algorithms. In my opinion it should be a MUST NOT too. > > * If you follow the OpenSSL naming, I think you mean the ECDHE > suites, not ECDH. ECDH does not offer forward secrecy. You are right on both counts. I'll fix those errors in the next version. As to the first point, I'll change the text to talk about bits of security, not the bit-size of the keys. Peter - -- Peter Saint-Andre https://stpeter.im/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSMItPAAoJEOoGpJErxa2pPYYP/j++g2QM/5UeE5F4ytuDV8qW PvFEEHAIsxbycTNPdEHlw3yvbcxEnwMRXouRCHFHYGxjYN7wj4ixmuZQx8BQRUW5 aSk3Eqadmj9MhyLhwVnGCBzV0eCgAtqy98im5W04hyQNVE3yH6JH8L1oKw1d8YdJ n6VxUQdk/SSQm7IbO57GHezkiJ0n9+6WdDJT9CX5QJTxvyWozY1TyYLQ44p1GYut fhrX7hGMZwoMGUtBkcb5O5VGSv7/lBhnlusGz9PAntXQ1j8O13Y+jSfrbrOHPXCo B+CiMKLRw7qOH83Kstz7tTz8X3ruk+P2+iA4eswOlZ4013P3PgsdBV9qHs0xAP31 7JoR5FpaWMxhr7lXxy2T5y9DCYnvK0CkqiKAU1+IlvYIKE/PQ1NQvef8GapPGdcn 1qJ9jAE66zWTLPp32rOj31a+5m1/axWdc1foffToDNV9ZA2QhUHKGPcQsPdQvVGO bqZVLBNq4VcVSxHPzF6Gw1RLe1avrawLuow+fkmr4eQNpt+PYh42LI7emEsPOf8p e91gtW+26DD+Z6McfdjrcwuXDl+d522iKyoFqcGqjjTOdpXtF5OgRwAISRSdzQ50 aWbgIVhILaiEtYY4PWq5DQeOm82v1D3HTB3jikYsUYvCyNWJ3p/Wx8dYsUKbHjqU 9Us/RJdhslz6mpzDgamF =me75 -----END PGP SIGNATURE----- From stpeter@stpeter.im Thu Sep 12 19:20:51 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3CF3611E8169 for ; Thu, 12 Sep 2013 19:20:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.584 X-Spam-Level: X-Spam-Status: No, score=-102.584 tagged_above=-999 required=5 tests=[AWL=0.015, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7TcZ5JNk3msU for ; Thu, 12 Sep 2013 19:20:38 -0700 (PDT) Received: from stpeter.im (mailhost.stpeter.im [207.210.219.225]) by ietfa.amsl.com (Postfix) with ESMTP id 5EA3D11E8163 for ; Thu, 12 Sep 2013 19:20:38 -0700 (PDT) Received: from sjc-vpn6-26.cisco.com (unknown [128.107.239.233]) (Authenticated sender: stpeter) by stpeter.im (Postfix) with ESMTPSA id 46C6F41648; Thu, 12 Sep 2013 20:25:10 -0600 (MDT) Message-ID: <52327672.1090301@stpeter.im> Date: Thu, 12 Sep 2013 20:20:34 -0600 From: Peter Saint-Andre User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:17.0) Gecko/20130801 Thunderbird/17.0.8 MIME-Version: 1.0 To: XMPP References: <20130913021445.20935.15470.idtracker@ietfa.amsl.com> In-Reply-To: <20130913021445.20935.15470.idtracker@ietfa.amsl.com> X-Enigmail-Version: 1.5.2 X-Forwarded-Message-Id: <20130913021445.20935.15470.idtracker@ietfa.amsl.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-01.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Sep 2013 02:20:51 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Updated to incorporate feedback received so far. Thanks for the input! /psa - -------- Original Message -------- Subject: I-D Action: draft-saintandre-xmpp-tls-01.txt Date: Thu, 12 Sep 2013 19:14:45 -0700 From: internet-drafts@ietf.org Reply-To: internet-drafts@ietf.org To: i-d-announce@ietf.org A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP) Author(s) : Peter Saint-Andre Filename : draft-saintandre-xmpp-tls-01.txt Pages : 10 Date : 2013-09-12 Abstract: This document provides recommendations for the use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP). This document updates RFC 6120. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls There's also a htmlized version available at: http://tools.ietf.org/html/draft-saintandre-xmpp-tls-01 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-saintandre-xmpp-tls-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ I-D-Announce mailing list I-D-Announce@ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBAgAGBQJSMnZyAAoJEOoGpJErxa2p/KoQAKmkNmhuN8ADmamYtPzw5UNV kkrpYadCfLBHe6KaNXt+qKFPf0n258n3nViWzADpoeIzYW0HiD9VgDdfQ2HX1Trw hf3OV9GBvda7WP6DNnEENAV4k9l+Z+j4z2Sks0W30YHcLeJQvjnv1eSRTmGJIgPJ eBj2S8LxFwDqi4nB4ZWrlroxftzD3zDLvrLr3BJsGdMjKuNwqjAIisMK0EVPdSLh I+OEwYQ40114QuUOgxvd9CVjkA4QXZWBBqQFXMv7Km3rThJbI2Dt4mUVb5F581LF gKtoGhTjKUOSAxq1yEQ2WUMEcogseeJfykGAizVeSEHitAQGraMtj27eylWeBaAM Wo28PaxVwJGUvif2J1ojKude19T085Y8ti5suBa28Gf/a/DHfzb+y7yeyuCYk96b I5v1KiXcrkoFWQNUCIu9avzJaiVcLppXePSvLzvhrDQ6TOYCF4p8E3cV3QneMbYL 3mAt0cNR7rLF3NFaR7Nzi8uv15UYlST23ZGi2huwTTO7GvY07LrGzbZNjzWfefaB NFzWia1ur2NSdSpoJERe9NyN2ep6Pwww7c75hNnTySZN/Q88/2C6JobMj17fEAIS +mk9Ye72N60QS8ts90odwYI105x+h6syw/6JSkA2gyEDIXtHx/P3++UVZpcdCh+f t8//qQkGHRmiZHQ/yKsz =nE6P -----END PGP SIGNATURE----- From mamille2@cisco.com Fri Sep 27 13:59:29 2013 Return-Path: X-Original-To: xmpp@ietfa.amsl.com Delivered-To: xmpp@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8D4E21E8096 for ; Fri, 27 Sep 2013 13:59:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZzwDzkcD98Ou for ; Fri, 27 Sep 2013 13:59:22 -0700 (PDT) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by ietfa.amsl.com (Postfix) with ESMTP id 54EA321E8092 for ; Fri, 27 Sep 2013 13:59:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9153; q=dns/txt; s=iport; t=1380315561; x=1381525161; h=from:to:subject:date:message-id:references:mime-version; bh=r1H3gMO2eW814UA2Pgj91+OVWPD5siuKD17tyHsKNXU=; b=iljPIm5/PE8jF6qVyYcYAqzA4MtO38sWrDyrOuHohgvhJ6CZuY868fQa pLGHKfjmlVSUk/1C4S2bMSszncWMmOJEeqVVwb2fEgiA8Zmp/0PLIwEYi MmY4MQtv3vC4UAhDSvceTDewZJdzCfNAenNPnowlTQ7xcMMGTjxSf3ogc g=; X-Files: smime.p7s : 4136 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AgkFALLwRVKtJXHA/2dsb2JhbABRAQmDBzhMBsBSgSEWdIIlAQEBAwEBAQFrEAsCARkDAQILJAIlCxQHAggCBBECCAEFh3IGBwW6I44IBgGBERYKEwuDGYEBA5AngTCHV4sYhTGDJECBMTk X-IronPort-AV: E=Sophos;i="4.90,995,1371081600"; d="p7s'?scan'208";a="265486849" Received: from rcdn-core2-5.cisco.com ([173.37.113.192]) by rcdn-iport-5.cisco.com with ESMTP; 27 Sep 2013 20:59:20 +0000 Received: from xhc-rcd-x13.cisco.com (xhc-rcd-x13.cisco.com [173.37.183.87]) by rcdn-core2-5.cisco.com (8.14.5/8.14.5) with ESMTP id r8RKxJ2o010957 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL) for ; Fri, 27 Sep 2013 20:59:19 GMT Received: from xmb-aln-x11.cisco.com ([169.254.6.253]) by xhc-rcd-x13.cisco.com ([173.37.183.87]) with mapi id 14.02.0318.004; Fri, 27 Sep 2013 15:59:19 -0500 From: "Matt Miller (mamille2)" To: XMPP Group Thread-Topic: I-D Action: draft-miller-posh-02.txt Thread-Index: AQHOu8MhVysXTVnUBkmOGP2CRQQttA== Date: Fri, 27 Sep 2013 20:59:19 +0000 Message-ID: References: <20130927204922.11230.40587.idtracker@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [64.101.72.48] Content-Type: multipart/signed; boundary="Apple-Mail=_984CDC47-B756-4D28-B3C3-2E56FFCB648F"; protocol="application/pkcs7-signature"; micalg=sha1 MIME-Version: 1.0 Subject: [xmpp] Fwd: I-D Action: draft-miller-posh-02.txt X-BeenThere: xmpp@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: XMPP Working Group List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Sep 2013 20:59:30 -0000 --Apple-Mail=_984CDC47-B756-4D28-B3C3-2E56FFCB648F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Here is the latest revision. This should cover most of the comments = (on- or offlist) received since -01. - m&m Matt Miller < mamille2@cisco.com > Cisco Systems, Inc. Begin forwarded message: > From: > Subject: I-D Action: draft-miller-posh-02.txt > Date: September 27, 2013 2:49:22 PM MDT > To: > Reply-To: >=20 >=20 > A New Internet-Draft is available from the on-line Internet-Drafts = directories. >=20 >=20 > Title : PKIX over Secure HTTP (POSH) > Author(s) : Matthew Miller > Peter Saint-Andre > Filename : draft-miller-posh-02.txt > Pages : 15 > Date : 2013-09-27 >=20 > Abstract: > Experience has shown that it is extremely difficult to deploy proper > PKIX certificates for TLS in multi-tenanted environments, since > certification authorities will not issue certificates for hosted > domains to hosting services, hosted domains do not want hosting > services to hold their private keys, and hosting services wish to > avoid liability for holding those keys. As a result, domains hosted > in multi-tenanted environments often deploy non-HTTP applications > such as email and instant messaging using certificates that identify > the hosting service, not the hosted domain. Such deployments force > end users and peer services to accept a certificate with an improper > identifier, resulting in obvious security implications. This > document defines two methods that make it easier to deploy > certificates for proper server identity checking in non-HTTP > application protocols. The first method enables the TLS client > associated with a user agent or peer application server to obtain = the > end-entity certificate of a hosted domain over secure HTTP as an > alternative to standard PKIX techniques. The second method enables = a > hosted domain to securely delegate a non-HTTP application to a > hosting service using redirects provided by HTTPS itself or by a > pointer in a file served over HTTPS at the hosted domain. >=20 >=20 > The IETF datatracker status page for this draft is: > https://datatracker.ietf.org/doc/draft-miller-posh >=20 > There's also a htmlized version available at: > http://tools.ietf.org/html/draft-miller-posh-02 >=20 > A diff from the previous version is available at: > http://www.ietf.org/rfcdiff?url2=3Ddraft-miller-posh-02 >=20 >=20 > Please note that it may take a couple of minutes from the time of = submission > until the htmlized version and diff are available at tools.ietf.org. >=20 > Internet-Drafts are also available by anonymous FTP at: > ftp://ftp.ietf.org/internet-drafts/ >=20 > _______________________________________________ > I-D-Announce mailing list > I-D-Announce@ietf.org > https://www.ietf.org/mailman/listinfo/i-d-announce > Internet-Draft directories: http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt --Apple-Mail=_984CDC47-B756-4D28-B3C3-2E56FFCB648F Content-Disposition: attachment; filename="smime.p7s" Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIMezCCBjQw ggQcoAMCAQICAR4wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCSUwxFjAUBgNVBAoTDVN0YXJ0 Q29tIEx0ZC4xKzApBgNVBAsTIlNlY3VyZSBEaWdpdGFsIENlcnRpZmljYXRlIFNpZ25pbmcxKTAn BgNVBAMTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTA3MTAyNDIxMDE1NVoX DTE3MTAyNDIxMDE1NVowgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSsw KQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFy dENvbSBDbGFzcyAxIFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMcJg8zOLdgasSmkLhOrlr6KMoOMpohBllVHrdRvEg/q6r8jR+EK 75xCGhR8ToREoqe7zM9/UnC6TS2y9UKTpT1v7RSMzR0t6ndl0TWBuUr/UXBhPk+Kmy7bI4yW4urC +y7P3/1/X7U8ocb8VpH/Clt+4iq7nirMcNh6qJR+xjOhV+VHzQMALuGYn5KZmc1NbJQYclsGkDxD z2UbFqE2+6vIZoL+jb9x4Pa5gNf1TwSDkOkikZB1xtB4ZqtXThaABSONdfmv/Z1pua3FYxnCFmdr /+N2JLKutIxMYqQOJebr/f/h5t95m4JgrM3Y/w7YX9d7YAL9jvN4SydHsU6n65cCAwEAAaOCAa0w ggGpMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMB0GA1UdDgQWBBRTcu2SnODaywFc fH6WNU7y1LhRgjAfBgNVHSMEGDAWgBROC+8apEBbpRdphzDKNGhD0EGu8jBmBggrBgEFBQcBAQRa MFgwJwYIKwYBBQUHMAGGG2h0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9jYTAtBggrBgEFBQcwAoYh aHR0cDovL3d3dy5zdGFydHNzbC5jb20vc2ZzY2EuY3J0MFsGA1UdHwRUMFIwJ6AloCOGIWh0dHA6 Ly93d3cuc3RhcnRzc2wuY29tL3Nmc2NhLmNybDAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5j b20vc2ZzY2EuY3JsMIGABgNVHSAEeTB3MHUGCysGAQQBgbU3AQIBMGYwLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwNAYIKwYBBQUHAgEWKGh0dHA6Ly93d3cu c3RhcnRzc2wuY29tL2ludGVybWVkaWF0ZS5wZGYwDQYJKoZIhvcNAQEFBQADggIBAAqDCH14qywG XLhjjF6uHLkjd02hcdh9hrw+VUsv+q1eeQWB21jWj3kJ96AUlPCoEGZ/ynJNScWy6QMVQjbbMXlt UfO4n4bGGdKo3awPWp61tjAFgraLJgDk+DsSvUD6EowjMTNx25GQgyYJ5RPIzKKR9tQW8gGK+2+R HxkUCTbYFnL6kl8Ch507rUdPPipJ9CgJFws3kDS3gOS5WFMxcjO5DwKfKSETEPrHh7p5shuuNktv sv6hxHTLhiMKX893gxdT3XLS9OKmCv87vkINQcNEcIIoFWbP9HORz9v3vQwR4e3ksLc2JZOAFK+s sS5XMEoznzpihEP0PLc4dCBYjbvSD7kxgDwZ+Aj8Q9PkbvE9sIPP7ON0fz095HdThKjiVJe6vofq +n6b1NBc8XdrQvBmunwxD5nvtTW4vtN6VY7mUCmxsCieuoBJ9OlqmsVWQvifIYf40dJPZkk9YgGT zWLpXDSfLSplbY2LL9C9U0ptvjcDjefLTvqSFc7tw1sEhF0n/qpA2r0GpvkLRDmcSwVyPvmjFBGq Up/pNy8ZuPGQmHwFi2/14+xeSUDG2bwnsYJQG2EdJCB6luQ57GEnTA/yKZSTKI8dDQa8Sd3zfXb1 9mOgSF0bBdXbuKhEpuP9wirslFe6fQ1t5j5R0xi72MZ8ikMu1RQZKCyDbMwazlHiMIIGPzCCBSeg AwIBAgIDBoRIMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYG A1UEAxMvU3RhcnRDb20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0EwHhcN MTMwNDMwMjE1NDQyWhcNMTQwNTAyMDUzOTA0WjBbMRkwFwYDVQQNExBiN2F6NndOY0t0R3JtMEpF MRswGQYDVQQDDBJtYW1pbGxlMkBjaXNjby5jb20xITAfBgkqhkiG9w0BCQEWEm1hbWlsbGUyQGNp c2NvLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJbKBMsG+9UFTx9uq/bhhXgu vJvO8z7cwKaqqwZhVf5z/kHFyCNijtmTOE+YXjA8mWR4aoBwB5SvGypI/cJUofJ+AlBTC4g+RMx/ K0Ab4/jQqTQz9CDzMOB+Wm+rt8ZJ7A8ZzOJmNDAsf/VvB8l2A1SQz1UsAixgH16NTr8SlblAXEKk 4hwpCudUiNjjQokqJ0H686UBKVorcZSgXaza8XMqGtJF/8mNhR9GQYi7Xht1ky+9LFOrto2daZto KJRwMeVusVdHUeKEQSu7jztw8HchH3KEb7Q+r5X+hhDZoddfKE8d5eyPuhiZdrzv7OlNZ0fSLdx7 3AE3nx9/R5YlXucCAwEAAaOCAtgwggLUMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgSwMB0GA1UdJQQW MBQGCCsGAQUFBwMCBggrBgEFBQcDBDAdBgNVHQ4EFgQUxGd+/qrdVudHrIKkw5xOMY7eaLUwHwYD VR0jBBgwFoAUU3Ltkpzg2ssBXHx+ljVO8tS4UYIwHQYDVR0RBBYwFIESbWFtaWxsZTJAY2lzY28u Y29tMIIBTAYDVR0gBIIBQzCCAT8wggE7BgsrBgEEAYG1NwECAzCCASowLgYIKwYBBQUHAgEWImh0 dHA6Ly93d3cuc3RhcnRzc2wuY29tL3BvbGljeS5wZGYwgfcGCCsGAQUFBwICMIHqMCcWIFN0YXJ0 Q29tIENlcnRpZmljYXRpb24gQXV0aG9yaXR5MAMCAQEagb5UaGlzIGNlcnRpZmljYXRlIHdhcyBp c3N1ZWQgYWNjb3JkaW5nIHRvIHRoZSBDbGFzcyAxIFZhbGlkYXRpb24gcmVxdWlyZW1lbnRzIG9m IHRoZSBTdGFydENvbSBDQSBwb2xpY3ksIHJlbGlhbmNlIG9ubHkgZm9yIHRoZSBpbnRlbmRlZCBw dXJwb3NlIGluIGNvbXBsaWFuY2Ugb2YgdGhlIHJlbHlpbmcgcGFydHkgb2JsaWdhdGlvbnMuMDYG A1UdHwQvMC0wK6ApoCeGJWh0dHA6Ly9jcmwuc3RhcnRzc2wuY29tL2NydHUxLWNybC5jcmwwgY4G CCsGAQUFBwEBBIGBMH8wOQYIKwYBBQUHMAGGLWh0dHA6Ly9vY3NwLnN0YXJ0c3NsLmNvbS9zdWIv Y2xhc3MxL2NsaWVudC9jYTBCBggrBgEFBQcwAoY2aHR0cDovL2FpYS5zdGFydHNzbC5jb20vY2Vy dHMvc3ViLmNsYXNzMS5jbGllbnQuY2EuY3J0MCMGA1UdEgQcMBqGGGh0dHA6Ly93d3cuc3RhcnRz c2wuY29tLzANBgkqhkiG9w0BAQUFAAOCAQEAlDhXbGEI7lbqUcu5r2JHZaMsbRZda/99ZqODzWGX 0llou9jGccsAWDPPwRRe2+ROpXfH4cuJZElTcLDeZSp/qpXKhjYieFSX8+Ml9sKEj5UOSqQLyoLk PtrIJV12Jk3nuG2Jc0UeEnGwK/aqtzy7+bfEVI0ziyVM2gChHh0RH74KyiwYWknbOTRIkZcz/ulE DVFQp63uj6wfmDNvAUHBAdhKVqA1S/rfP1KcDZpf1NfvwXJibiqTRA6K1EOxTJOP41n/XdvHqHXL RWL2xrOUI9/URANr/ok3OrsuZEMFnAAGefS1bWS/hFtUGVkHGiKEBbyDW7da2ULXbuC7umrQnzGC A28wggNrAgEBMIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkG A1UECxMiU2VjdXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRD b20gQ2xhc3MgMSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwaESDAJBgUrDgMCGgUA oIIBrzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xMzA5MjcyMDU5 MTlaMCMGCSqGSIb3DQEJBDEWBBRuZ4puTlerIneCiWgrKO6GLZ0EEzCBpQYJKwYBBAGCNxAEMYGX MIGUMIGMMQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2Vj dXJlIERpZ2l0YWwgQ2VydGlmaWNhdGUgU2lnbmluZzE4MDYGA1UEAxMvU3RhcnRDb20gQ2xhc3Mg MSBQcmltYXJ5IEludGVybWVkaWF0ZSBDbGllbnQgQ0ECAwaESDCBpwYLKoZIhvcNAQkQAgsxgZeg gZQwgYwxCzAJBgNVBAYTAklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1 cmUgRGlnaXRhbCBDZXJ0aWZpY2F0ZSBTaWduaW5nMTgwNgYDVQQDEy9TdGFydENvbSBDbGFzcyAx IFByaW1hcnkgSW50ZXJtZWRpYXRlIENsaWVudCBDQQIDBoRIMA0GCSqGSIb3DQEBAQUABIIBAB6e vnXEwPniEqSeDRyoZh7JSO9WA1Gp08o1YJLq5+38SfWKX2k00BUysDPW3ZkPDfy3mHddVdap36HN LlAfe+bTx50japhf/zeZqbX5havfxmHni4FMbWT/+qj6fZwzb6k4aY5vtG2XV58uk0+Epl/rRtFC D5Pw5M/Y/6yiPTGvwtt/+/O9/Vwp+/TOramWpsR6HwTNnVej3wla6I7EpCo5om9ZQ5fv6unZrknV 3WXYz7V1tMD3MumE5XaUXUkod9yXe2fqwskp+TpsuuD4BvpK8lhFMLqiGsULIizdMM2HejUUw73X jppMu3bqRoKfOY6RXt8rx8t3Fmd5mFNedhwAAAAAAAA= --Apple-Mail=_984CDC47-B756-4D28-B3C3-2E56FFCB648F--