RFC 9266: Channel Bindings for TLS 1.3 support

[Neustradamus]

Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?

• https://datatracker.ietf.org/doc/html/rfc9266

Little details, to know easily:

• tls-unique for TLS =< 1.2
• tls-server-end-point
• tls-exporter for TLS = 1.3

Thanks in advance.

Linked to:

• SCRAM-SHA-1(-PLUS) + SCRAM-SHA-256(-PLUS) + SCRAM-SHA-512(-PLUS) supports #1727

[georgehazan]

@Neustradamus hi, is there a server where I could test this feature?

[Neustradamus]

@georgehazan: Hi Georges,

Thanks for your answer!

About XMPP Servers:

Djabberd has a ticket:

• RFC 9266: Channel Bindings for TLS 1.3 support djabberd/DJabberd#57

ejabberd has a ticket:

• RFC 9266: Channel Bindings for TLS 1.3 support processone/xmpp#69

Jackal has a PR:

• Support tls-exporter channel binding type ortuman/jackal#243

Metronome IM has a ticket:

• RFC 9266: Channel Bindings for TLS 1.3 support maranda/metronome#539

Mongoose IM has a ticket:

• RFC 9266: Channel Bindings for TLS 1.3 support esl/MongooseIM#3721

Prosody IM has added the support few days ago:

• https://issues.prosody.im/1542
• https://issues.prosody.im/1760

Tigase XMPP Server has a ticket:

• RFC 9266: Channel Bindings for TLS 1.3 support tigase/tigase-server#161

About XMPP Clients:

CoyIM has a PR:

• Support tls-exporter channel binding on TLS >= 1.3 coyim/coyim#845

About XMPP Libraries:

Mellim SASL has a commit:

• https://github.com/mellium/sasl/commit/00912085c89c126d442cce0c931a4dd71d356e64

[georgehazan]

Aha, Prosody is ok, I'll upgrade my server

[georgehazan]

@Neustradamus I've added some code and tested that it really reports some data. Unfortunately, I hadn't verified it with the real server, because I still don't have the version of Prosody that supports it.

[Neustradamus]

@georgehazan: Thanks for your changes!

You can not try with Prosody trunk?

[Neustradamus]

@georgehazan: Have you looked for "tls-server-end-point"?

[Neustradamus]

@georgehazan: Have you looked for "tls-server-end-point" in more "tls-unique" and "tls-exporter"?

It is supported by:

• ejabberd (@prefiks): https://github.com/processone/xmpp/blob/ded8be8c169487688b11130eda566b1377ab3301/src/xmpp_stream_in.erl#L934
• Prosody IM: https://hg.prosody.im/trunk/log?rev=tls-server-end-point
• Tigase XMPP Server: https://github.com/search?q=org%3Atigase+tls-server-end-point&type=code

[georgehazan]

The problem is where to get Prosody Trunk... I have Ubuntu on my desktop, and it comes with the previous version, those SASL fixes were introduced only 8 weeks ago

[Neustradamus]

@georgehazan: You can try the ejabberd master code with deps too...

• https://github.com/processone/ejabberd

For Prosody IM, it is here:

• https://hg.prosody.im/trunk/
• https://prosody.im/download/start
• https://prosody.im/download/start#nightly_builds