Subject: [xmpp] End-to-end encryption

From: Ben Campbell <[email-masked]>
Date: Mon, 28 Jun 2010 17:28:11 -0500

[as co-chair]

The XMPP charter has a milestone determining a direction for end-to-end encryption. Matt and Peter submitted draft-miller-3923bis back in March. There's been very little discussion of it since then.

Have people read and understood this draft? If so, do you think this should be the basis for going forward on end-to-end encryption? Note that this doesn't mean we consider the draft perfect as is--just that we think it's a good starting point.

Thanks!

Ben.

---

From: Matthew Miller <[email-masked]>
Date: Mon, 28 Jun 2010 22:19:17 -0600

> Have people read and understood this draft? If so, do you think this should be the basis for going forward on end-to-end encryption? Note that this doesn't mean we consider the draft perfect as is-…

Ben Schumacher and I met in person to talk about some of the things we were discussing on list earlier.  The result will be -02, which I hope to get submitted very soon.  The nutshell of the process we came up with is:

1) Generate timestamp
TS = RFC3339 datetime of (now)

2) UTF8 encode stanza (S).  This is necessary for signing
S' = utf8(S)

3) Create plain envelope; prepare for encryption
E = <plain xmlns='urn:ietf:params:xml:ns:xmpp-objenc:0'
          timestamp='{TS}'>
     {base64(S')}
   </plain>
E' = utf8(E)

4) Encrypt with Block Cipher
R = <cipher session key>
T = block-encrypt(R, E')
T' = base64(T)

5) Generate MAC (using T as the salt, R as the message)
M = mac(T, R)
M' = base64(M)

6) Protect block cipher session key
V = pki-encrypt(pub(K), R)
V' = base64(V)

7) Construct container <e2e/>
C = <e2e xmlns='urn:ietf:params:xml:ns:xmpp-objenc:0'>
     <key cipher-algo='<PKI cipher algorithm>'>
       {V'}
     </key>
     <data cipher-algo='<block cipher algorithm>'>
           mac-algo='<mac algorithm>'
           hash='{M'}'>
       {T'}
     </data>
   </e2e>

8) Construct sending stanza (D); include C as child of D 
D = <message xmlns='jabber:client'
            to=[email-masked]'
            type='chat'>
     <e2e xmlns='urn:ietf:params:xml:ns:xmpp-objenc:0'>
       <key cipher-algo='<PKI cipher algorithm>'>
         {V'}
       </key>
       <data cipher-algo='<block cipher algorithm>'>
             mac-algo='<mac algorithm>'
             hash='{M'}'>
         {T'}
       </data>
     </e2e>
   </message>

The biggest complaint we had with the above is that XML is serialized/parsed 3 times; but I don't know how we can avoid that unless we ignore signing entirely, which is something we're interested in.

Comments and questions welcome...

- m&m

---

From: Jonathan Schleifer <[email-masked]>
Date: Tue, 29 Jun 2010 12:21:18 +0200

What I don't get is this:

We had ESessions, the XEP was working, implemented etc. This was dropped because we could not have get a cryptanalysis for it and thus focus was shifted on using TLS.
My question is: How is the situation with this different from ESessions now? If we can't get a cryptanalysis for ESessions, how could we get one for this? It looks to me like history repeating, but instead of ESessions, it's E2E now.

Can somebody please explain to me how this is different now?

--
Jonathan

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 Jun 2010 06:08:49 -0600

On 6/29/10 4:21 AM, Jonathan Schleifer wrote:
> We had ESessions, the XEP was working, implemented etc. This was
> dropped because we could not have get a cryptanalysis for it and thus
> focus was shifted on using TLS. My question is: How is the situation
> with this different from ESessions now? If we can't get a
> cryptanalysis for ESessions, how could we get one for this? It looks
> to me like history repeating, but instead of ESessions, it's E2E
> now.
> 

Feel free to submit ESessions as an Internet-Draft based on some
combination of XEP-0116, XEP-0188, XEP-0200, and XEP-0217. That will
enable the WG to consider ESessions, XTLS, and 3923bis side-by-side in a
thorough manner. Others are free to submit OpenPGP (XEP-0027 with
revisions to address known issues) and additional proposals, too.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Jonathan Schleifer <[email-masked]>
Date: Tue, 29 Jun 2010 16:09:34 +0200

> revisions to address known issues) and additional proposals, too.

Ah, so now we can get a cryptanalysis because we are running it through the IETF? Thanks, that's what I wanted to know :).

I'd like to submit it, but unfortunately, I don't have time, which is why my XMPP involvement really decreased a lot lately, to almost nothing now :(. Hope to be able to change that in the future.

--
Jonathan

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 Jun 2010 08:56:43 -0600

On 6/29/10 8:09 AM, Jonathan Schleifer wrote:
>> combination of XEP-0116, XEP-0188, XEP-0200, and XEP-0217. That
>> will enable the WG to consider ESessions, XTLS, and 3923bis
>> side-by-side in a thorough manner. Others are free to submit
>> OpenPGP (XEP-0027 with revisions to address known issues) and
>> additional proposals, too.
> 
> Ah, so now we can get a cryptanalysis because we are running it
> through the IETF? Thanks, that's what I wanted to know :).

It's not guaranteed to be a full cryptanalysis, but anything that the
working group produces will receive a security review via normal IETF
processes.

> I'd like to submit it, but unfortunately, I don't have time, which is
> why my XMPP involvement really decreased a lot lately, to almost
> nothing now :(. Hope to be able to change that in the future.

That's unfortunate, because the person who really defined ESessions (Ian
Paterson) disappeared entirely some years ago and you've been the
primary advocate for the technology since then.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Jonathan Schleifer <[email-masked]>
Date: Tue, 29 Jun 2010 18:20:38 +0200

> primary advocate for the technology since then.

Maybe Brendan Taylor volunteers? He did the only existing ESession implementation.

--
Jonathan

---

From: Sean Turner <[email-masked]>
Date: Tue, 29 Jun 2010 14:03:43 -0400

> working group produces will receive a security review via normal IETF

If you want additional input I suggest you* forward the approaches to 
the CFRG mail: [email-masked] and charter: 
http://irtf.org/charter?gtype=rg&group=cfrg.

spt

* (or your friendly chair or AD)

> ------------------------------------------------------------------------
> 
> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp

---

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 29 Jun 2010 14:08:01 -0400

Also, I might suggest that the proper term is probably "security  
analysis" instead of "cryptanalysis"

<http://en.wikipedia.org/wiki/Cryptanalysis>

After all, the point of using good crypto is to *avoid* (successful)  
cryptanalysis.

On Jun 29, 2010, at 2:03 PM, Sean Turner wrote:

> If you want additional input I suggest you* forward the approaches  
> to the CFRG mail: [email-masked] and charter: http://irtf.org/charter?gtype=rg&group=cfrg 
> .
>
> spt
>

---

From: Ben Campbell <[email-masked]>
Date: Tue, 29 Jun 2010 13:20:50 -0500

On Jun 29, 2010, at 1:03 PM, Sean Turner wrote:

> If you want additional input I suggest you* forward the approaches to the CFRG mail: [email-masked] and charter: http://irtf.org/charter?gtype=rg&group=cfrg.
> 
> spt
> 

We could also ask for an early security area expert review, if we think it is warranted, couldn't we Sean ;-)  ?

Thanks!

Ben*

(* one of your friendly chairs)

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 Jun 2010 12:23:27 -0600

On 6/29/10 12:20 PM, Ben Campbell wrote:
>> to the CFRG mail: [email-masked] and charter:
> We could also ask for an early security area expert review, if we
> think it is warranted, couldn't we Sean ;-)  ?

At this point I think we need advice about the possible approaches under
discussion -- it's probably a bit early to seek out a security review
regarding a specific document. But I'm not sure how to go about that...

/psa

---

From: Sean Turner <[email-masked]>
Date: Tue, 29 Jun 2010 14:24:10 -0400

Yes you could.  Let me know if we're getting near that stage.

spt

---

From: Ben Campbell <[email-masked]>
Date: Tue, 29 Jun 2010 13:42:49 -0500

> Yes you could.  Let me know if we're getting near that stage.

As Peter mentioned separately, I don't think we're there yet. I think we're just discussing the options available for when we _are_ ready.

Thanks!

Ben.