Subject: [xmpp] #56: UUID recommended as server-generated resource

From: "xmpp issue tracker" <[email-masked]>
Date: Tue, 22 Jun 2010 01:39:41 -0000

#56: UUID recommended as server-generated resource
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  minor               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 7.4 (Generation of Resource Identifiers) states:

 > When generating a random resourcepart, it is RECOMMENDED that the
 > resourcepart be a Universally Unique Identifier (UUID), for which
 > the format specified in [UUID] is RECOMMENDED.

 Dave Cridland commented: "I see no compelling reason why the specification
 should require the use of a UUID as a resource identifier for strict
 comformance."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/56>
xmpp <http://tools.ietf.org/xmpp/>

---

From: "xmpp issue tracker" <[email-masked]>
Date: Sun, 27 Jun 2010 22:22:59 -0000

#56: UUID recommended as server-generated resource
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  minor               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Removed conformance language, as follows:

       Security Note: A resourcepart can be security-critical.  For
       example, if a malicious entity can guess a client's resourcepart
       then it might be able to determine if the client (and therefore
       the controlling principal) is online or offline, thus resulting in
       a presence leak as described under Section 13.10.2.  To prevent
       that possibility, a client can either (1) generate a random
       resourcepart on its own or (2) ask the server to generate a
       resourcepart on its behalf, which MUST be random (see [RANDOM]).
       One method for ensuring that the resourcepart is random is to
       generate a Universally Unique Identifier (UUID) as specified in
       [UUID].

-- 
Ticket URL: <https://trac.tools.ietf.org/wg/xmpp/trac/ticket/56#comment:1>
xmpp <http://tools.ietf.org/xmpp/>