Subject: [Uta] Fwd: I-D Action: draft-saintandre-xmpp-tls-03.txt

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 17 Dec 2013 13:25:22 -0700

FYI.

-------- Original Message --------
Subject: I-D Action: draft-saintandre-xmpp-tls-03.txt
Date: Tue, 17 Dec 2013 12:23:38 -0800
From: [email-masked]
Reply-To: [email-masked]
To: [email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.

	Title           : Use of Transport Layer Security (TLS) in the
Extensible Messaging and Presence Protocol (XMPP)
	Author(s)       : Peter Saint-Andre
	Filename        : draft-saintandre-xmpp-tls-03.txt
	Pages           : 10
	Date            : 2013-12-17

Abstract:
   This document provides recommendations for the use of Transport Layer
   Security (TLS) in the Extensible Messaging and Presence Protocol
   (XMPP).  This document updates RFC 6120.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-saintandre-xmpp-tls-03

A diff from the previous version is available at:
http://www.ietf.org/rfcdiff?url2=draft-saintandre-xmpp-tls-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 17 Dec 2013 23:06:01 +0200

Hi Peter,

One comment about the draft:

Stateless session resumption (RFC 5077) lists AES128/SHA256 as the 
recommended algorithms for protecting the ticket. It does not "mandate" 
these algorithms, in my reading. And of course servers can change these 
algorithms unilaterally.

For some reason the authors do not specify that this protection should 
be at the same strength as the TLS cipher suite. However they do mandate 
(as a SHOULD) that keys be changed regularly. If this is the case (e.g. 
if ticket keys are changed once a week), then the forward secrecy 
argument doesn't hold.

Can we add something like:

However, session tickets can be used if a stronger cipher suite is 
employed to encrypt the ticket (as least as strong as the main TLS 
cipher suite), and if ticket keys are changed regularly, e.g. once every 
week.

Thanks,
	Yaron

On 12/17/2013 10:25 PM, Peter Saint-Andre wrote:
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Ilari Liusvaara <[email-masked]>
Date: Tue, 17 Dec 2013 23:26:27 +0200

> Subject: I-D Action: draft-saintandre-xmpp-tls-03.txt

   o  XMPP implementations MUST support, and SHOULD prefer to negotiate,
      cipher suites offering authentication, such as the "AES-GCM"
      family.

      Rationale: Authenticated connections are better than
      unauthenticated connections (although, as explained under
      Section 4.6, unauthenticated connections are better than nothing).

Err... Judging from AES-GCM, this is about bulk ciphers (and all
bulk ciphers in TLS except NULL_NULL are authenticated, albeit there
are some vulernabilities here).

But Section 4.6 talks about certificate authentication, which is
associated with key exchange (which deals with certificates). The
algorithms there are different (RSA, DHE_RSA, ECDHE_RSA, ECDHE_ECDSA,
etc...)

Also, even if you aren't intending to validate the certificate,
using DH_ANON might be a bad idea (since the selection is visible
to the attacker).

   o  XMPP implementations MUST support, and SHOULD prefer to negotiate,
      cipher suites offering forward secrecy, such as those in the
      "EDH", "DHE", and "ECDHE" families.

I don't think there is anything called "EDH" in TLS. DHE and ECDHE yes.

There are also couple other PFS families, but those don't seem to be
any use for XMPP server-server connections.

-Ilari