-
Notifications
You must be signed in to change notification settings - Fork 0
/
xep-0344.xml
449 lines (449 loc) · 19 KB
/
xep-0344.xml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE xep SYSTEM 'xep.dtd' [
<!ENTITY % ents SYSTEM 'xep.ent'>
%ents;
]>
<?xml-stylesheet type='text/xsl' href='xep.xsl'?>
<xep>
<header>
<title>Impact of TLS and DNSSEC on Dialback</title>
<abstract>This specification provides documentation how Server Dialback is used together with Transport Layer Security, and discusses how the security considerations of Dialback are changed by the introduction of TLS and/or DNSSEC.</abstract>
&LEGALNOTICE;
<number>0344</number>
<status>Deferred</status>
<type>Standards Track</type>
<sig>Standards</sig>
<approver>Council</approver>
<dependencies>
<spec>XMPP Core</spec>
<spec>XEP-0220</spec>
</dependencies>
<supersedes/>
<supersededby/>
<shortname>N/A</shortname>
&fippo;
&dcridland;
<revision>
<version>0.4</version>
<date>2017-09-11</date>
<initials>XEP Editor (jwi)</initials>
<remark>Defer due to lack of activity.</remark>
</revision>
<revision>
<version>0.3</version>
<date>2015-03-23</date>
<initials>dwd/ph</initials>
<remark>
<p>Described same-certificate flow.</p>
</remark>
</revision>
<revision>
<version>0.2</version>
<date>2014-03-19</date>
<initials>editor (mam)</initials>
<remark>
<p>Editorial fixes.</p>
</remark>
</revision>
<revision>
<version>0.1</version>
<date>2014-03-14</date>
<initials>editor (mam)</initials>
<remark>
<p>Initial published version approved by the XMPP Council.</p>
</remark>
</revision>
<revision>
<version>0.0.3</version>
<date>2014-02-28</date>
<initials>dwd</initials>
<remark>
<p>Changed title and added more security considerations.</p>
</remark>
</revision>
<revision>
<version>0.0.2</version>
<date>2013-11-13</date>
<initials>dwd</initials>
<remark><p>Added some narrative and a section on dwd.</p></remark>
</revision>
<revision>
<version>0.0.1</version>
<date>2013-11-04</date>
<initials>ph</initials>
<remark><p>First draft.</p></remark>
</revision>
</header>
<section1 topic='Introduction' anchor='intro'>
<p>Although &xep0220; describes dialback as being run before any other negotiation, it is typically run over TLS where supported. This allows it to be used as a simple convenient fallback to X.509 Strong Authentication within the TLS layer, as described in &rfc6120;, and also affords greater protection to the exchange.</p>
<p>This document describes these practises, and also describes various functionally equivalent shortcuts to the protocol, including that known as "dialback without dialback".</p>
</section1>
<section1 topic='Protocol' anchor='protocol'>
<section2 topic='Dramatis Personae'>
<p>This document will tell a tale of two servers; orchard.capulet.example is trying to contact home.montague.example. Each server operates a single domain; these are capulet.example and montague.example respectively.</p>
</section2>
<section2 topic='Classic Dialback Flow' anchor='classic'>
<p>The traditional pattern is shown here:</p>
<code><![CDATA[
orchard.capulet. home.montague.
example example
(as Initiating) (as Receiving
Server) Server)
---------------- -------------
| |
| [if necessary, |
| perform DNS |
| lookup on |
| Target Domain, |
| open TCP |
| connection, |
| and establish |
| stream] |
| -----------------> |
| (ID D60000229F) |
| |
| send | capulet.example
| dialback key | (as Authoritative
| -----(STEP 1)----> | Server)
| | -----------------
| | [if necessary, |
| | perform DNS |
| | lookup on |
| | Sender Domain, |
| | open TCP |
| | connection, |
| | and establish |
| | stream] |
| | -----------------> |
| | |
| | send |
| | verify request |
| | ----(STEP 2)-----> |
| | |
| | send |
| | verify response |
| | <----(STEP 3)----- |
| | |
| report | |
| dialback result | |
| <-----(STEP 4)---- | |
]]></code>
</section2>
<section2 topic='XMPP Exchanges in Classic Dialback over TLS' anchor='dialback-stanzas'>
<p>This traditional pattern involves the following protocol exchanges when dialback over TLS is used:</p>
<example caption="Initiating Server Opens Stream"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
from='capulet.example'
to='montague.example'
version='1.0'>
]]></example>
<example caption="Receiving Server Responds with a stream header and advertises TLS feature"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
id='D60000229F'
from='montague.example'
to='capulet.example'
version='1.0'>
<stream:features>
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
<required/>
</starttls>
</stream:features>
]]></example>
<example caption="Initiating Server Sends STARTTLS command"><![CDATA[
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
]]></example>
<example caption="Receiving Server informs Initiating Server to proceed"><![CDATA[
<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
]]></example>
<example caption="Initiating Server Opens Stream"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
from='capulet.example'
to='montague.example'
version='1.0'>
]]></example>
<example caption="Receiving Server Responds with a stream header"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
id='D60000229F'
from='montague.example'
to='capulet.example'
version='1.0'>
<stream:features>
<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
</mechanisms>
</stream:features>
]]></example>
<example caption="Initiating Server Sends Dialback Key (Step 1)"><![CDATA[
<db:result
from='capulet.example'
to='montague.example'>
b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:result>
]]></example>
<p>The Receiving Server may need to establish a connection to the Authoritative Server at this point.</p>
<example caption="Receiving Server Sends Verification Request to Authoritative Server (Step 2)"><![CDATA[
<db:verify
from='montague.example'
id='D60000229F'
to='capulet.example'>
b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:verify>
]]></example>
<example caption="Receiving Server is Informed by Authoritative Server that Key is Valid (Step 3)"><![CDATA[
<db:verify
from='capulet.example'
id='D60000229F'
to='montague.example'
type='valid'/>
]]></example>
<example caption="Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)"><![CDATA[
<db:result
from='montague.example'
to='capulet.example'
type='valid'/>
]]></example>
</section2>
<section2 topic='Dialback without dialback flow' anchor='dwd'>
<p>If during the initial connection, home.montague.example is able to determine that the certificate presented is trustworthy, and authenticates orchard.capulet.example as authorized to offer the XMPP service for capulet.example, then the flow can be shortcutted heavily, allowing the entire Authoritative Server process to be elided.</p>
<p>This is particularly useful in cases where the dialback exchange is a subsequent exchange used in piggybacking, as it remains the only solution for piggybacking with strong authentication.</p>
<code><![CDATA[
orchard.capulet. home.montague.
example example
(as Initiating) (as Receiving
Server) Server)
---------------- -------------
| |
| [if necessary, |
| perform DNS |
| lookup on |
| Target Domain, |
| open TCP |
| connection, |
| and establish |
| stream] |
| -----------------> |
| (ID D60000229F) |
| |
| send |
| dialback key |
| -----(STEP 1)----> |
| |
| | [observe certificate
| | trustworthy and
| | correct for capulet.example
| | as per RFC 6125]
| |
| report |
| dialback result |
| <-----(STEP 4)---- |
]]></code>
</section2>
<section2 topic='XMPP Exchanges in Dialback without dialback' anchor='dwd-stanzas'>
<p>This traditional pattern involves the following protocol exchanges when dialback over TLS is used:</p>
<example caption="Initiating Server Opens Stream"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
from='capulet.example'
to='montague.example'
version='1.0'>
]]></example>
<example caption="Receiving Server Responds with a stream header and advertises TLS feature"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
id='D60000229F'
from='montague.example'
to='capulet.example'
version='1.0'>
<stream:features>
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
<required/>
</starttls>
</stream:features>
]]></example>
<example caption="Initiating Server Sends STARTTLS command"><![CDATA[
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
]]></example>
<example caption="Receiving Server informs Initiating Server to proceed"><![CDATA[
<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
]]></example>
<example caption="Initiating Server Opens Stream"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
from='capulet.example'
to='montague.example'
version='1.0'>
]]></example>
<example caption="Receiving Server Responds with a stream header"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
id='D60000229F'
from='montague.example'
to='capulet.example'
version='1.0'>
<stream:features>
<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
<mechanism name='EXTERNAL'/>
</mechanisms>
</stream:features>
]]></example>
<p>Note that having authenticated the certificate and found it authorized for capulet.example, montague.example has offered EXTERNAL above. It's not clear why capulet.example does not avail itself of the offer below; however it should be noted that EXTERNAL would not be available with piggybacking for example.</p>
<example caption="Initiating Server Sends Dialback Key (Step 1)"><![CDATA[
<db:result
from='capulet.example'
to='montague.example'>
b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:result>
]]></example>
<p>Critically, it is at this point that home.montague.example both authenticates and checks authorization on the certificate, or at least ensure that the certificate presented at this stage matches that presented at the initial handshake.</p>
<example caption="Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)"><![CDATA[
<db:result
from='montague.example'
to='capulet.example'
type='valid'/>
from='montague.example'
to='capulet.example'
type='valid'/>
]]></example>
</section2>
<section2 topic='Same Certificate shortcut' anchor='samecert'>
<p>If during the initial connection, the Receiving Server is unable to determine that the certificate presented is trustworthy but the Authoritative Server presents the same certificate as the Originating Server, the <db:verify/> step can be elided.</p>
<p>Note: the Receiving Server MUST still check that the hostname in the certificate matches.</p>
<p>Essentially, this replaces the Dialback Key Validation step from &xep0185; with the somewhat more elaborate proof of posession of the private key associated with the certificate.</p>
<code><![CDATA[
orchard.capulet. home.montague.
example example
(as Initiating) (as Receiving
Server) Server)
---------------- -------------
| |
| [if necessary, |
| perform DNS |
| lookup on |
| Target Domain, |
| open TCP |
| connection, |
| and establish |
| stream] |
| -----------------> |
| (ID D60000229F) |
| |
| send | capulet.example
| dialback key | (as Authoritative
| -----(STEP 1)----> | Server)
| | -----------------
| | [if necessary, |
| | perform DNS |
| | lookup on |
| | Sender Domain, |
| | open TCP |
| | connection, |
| | and establish |
| | stream] |
| | -----------------> |
| | [observe certificate is for
| | capulet.example and same as
| | used by orchard.capulat.example]
| report |
| dialback result |
| <-----(STEP 4)---- |
]]></code>
</section2>
<section2 topic='XMPP Exchanges in Same Certifiate shortcut' anchor='samecert-stanzas'>
<p>This pattern involves the following protocol exchanges:</p>
<example caption="Initiating Server Opens Stream"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
from='capulet.example'
to='montague.example'
version='1.0'>
]]></example>
<example caption="Receiving Server Responds with a stream header and advertises TLS feature"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
id='D60000229F'
from='montague.example'
to='capulet.example'
version='1.0'>
<stream:features>
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
<required/>
</starttls>
</stream:features>
]]></example>
<example caption="Initiating Server Sends STARTTLS command"><![CDATA[
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
]]></example>
<example caption="Receiving Server informs Initiating Server to proceed"><![CDATA[
<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
]]></example>
<example caption="Initiating Server Opens Stream"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
from='capulet.example'
to='montague.example'
version='1.0'>
]]></example>
<example caption="Receiving Server Responds with a stream header"><![CDATA[
<stream:stream
xmlns:stream='http://etherx.jabber.org/streams'
xmlns='jabber:server'
id='D60000229F'
from='montague.example'
to='capulet.example'
version='1.0'>
<stream:features>
<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
</mechanisms>
</stream:features>
]]></example>
<example caption="Initiating Server Sends Dialback Key (Step 1)"><![CDATA[
<db:result
from='capulet.example'
to='montague.example'>
b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:result>
]]></example>
<p>The Receiving Server may need to establish a connection to the Authoritative Server at this point. Here we assume that this connection is using TLS and the certificate presented by the Authoritative Server is the same as the one used by the Originating Server and contains the domain name claimed by the Originating Server.</p>
<example caption="Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)"><![CDATA[
<db:result
from='montague.example'
to='capulet.example'
type='valid'/>
]]></example>
</section2>
</section1>
<section1 topic='Security Considerations' anchor='security'>
<p>With respect to <strong>XEP-0220</strong>'s security considerations, the adaptations in this document add at minimum channel encryption and integrity, which forces an attacker into making an active attack, rather than passive eavesdropping. This raises the cost of an attack significantly. However, unless the certificates are authenticated, there is still a man-in-the-middle attack possible, and the reliance on unauthenticated DNS remains problematic.</p>
<section2 topic='Dialback without dialback shortcut'>
<p>Use of the "Dialback without dialback" shortcut described in section 2.4 raises the level of authentication to that of the TLS/SASL-EXTERNAL process described in <strong>RFC 6120</strong>, and is thought to be indistinguishable from a security standpoint. As such, the security considerations relating to this in <strong>RFC 6120</strong> et al apply.</p>
</section2>
<section2 topic='Same Certificate shortcut'>
<p>Use of the "Same Certificate" shortcut described in section 2.6 is not thought to materially alter the security profile beyond that described above. In particular, it does not alter the level of trust an implementation may put in authentication.</p>
</section2>
<section2 topic="DNSSEC">
<p>If both SRV and A/AAAA records are protected by DNSSEC, this means that the correct address for the peer can be proven, removing DNS forgery as an attack vector. Without TLS, it is however still possible to mount an array of attacks, including IP spoofing and eavesdropping.</p>
<p>With TLS, however, the situation improves. Since TLS protects against a naïve IP spoofing attack, a routing protocol attack (such as BGP hijacking) is required to forge the server.</p>
</section2>
<p>In addition, it is of critical importance to check the certificate at the time when the dialback result is received, and not only in the initial handshake. This protects against an attack based around renegotiation.</p>
</section1>
<section1 topic='IANA Considerations' anchor='iana'>
<p>This document requires no interaction with &IANA;.</p>
</section1>
<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
<p>This document requires no interaction with the XMPP Registrar.</p>
</section1>
</xep>