Subject: [xmpp] Fwd: New Version Notification for draft-ietf-uta-xmpp-03.txt

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Tue, 11 Nov 2014 20:34:46 -0700

FYI.

-------- Original Message --------
Subject: New Version Notification for draft-ietf-uta-xmpp-03.txt
Date: Tue, 11 Nov 2014 19:33:53 -0800
From: [email-masked]
To: Peter Saint-Andre <[email-masked]>, Peter Saint-Andre 
<[email-masked]>, [email-masked] <[email-masked]>, Thijs 
Alkemade <[email-masked]>

A new version of I-D, draft-ietf-uta-xmpp-03.txt
has been successfully submitted by Peter Saint-Andre and posted to the
IETF repository.

Name:		draft-ietf-uta-xmpp
Revision:	03
Title:		Use of Transport Layer Security (TLS) in the Extensible 
Messaging and Presence Protocol (XMPP)
Document date:	2014-11-11
Group:		uta
Pages:		7
URL: 
http://www.ietf.org/internet-drafts/draft-ietf-uta-xmpp-03.txt
Status:         https://datatracker.ietf.org/doc/draft-ietf-uta-xmpp/
Htmlized:       http://tools.ietf.org/html/draft-ietf-uta-xmpp-03
Diff:           http://www.ietf.org/rfcdiff?url2=draft-ietf-uta-xmpp-03

Abstract:
    This document provides recommendations for the use of Transport Layer
    Security (TLS) in the Extensible Messaging and Presence Protocol
    (XMPP).  This document updates RFC 6120.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Dave Cridland <[email-masked]>
Date: Wed, 12 Nov 2014 11:47:11 +0000

Lightning review:

1) §3.3 - I don't understand why session tickets would be bad compared to
session ids?

2) Should there be a discussion about recommended SAN types? RFC 6120
currently says the only MTI is xmppAddr; RFC 6125 gives no MTI as I
understand it.

3) If so, should we discuss wildcard resolution? Or not? RFC 5280 says
wildcard resolution is within the scope of the application rather than
TLS/PKIX itself.

4) Finally, there's two different protocols in XMPP - C2S and S2S. It might
be good to explicitly note the different requirements on these (the draft
says C2S clients MUST authenticate servers, for example).

On 12 November 2014 03:34, Peter Saint-Andre - &yet <[email-masked]>
wrote:

> To: Peter Saint-Andre <[email-masked]>, Peter Saint-Andre <
> [email-masked]>, [email-masked] <[email-masked]>, Thijs Alkemade <
> [email-masked]>
>
>
> URL: http://www.ietf.org/internet-drafts/draft-ietf-uta-xmpp-03.txt
> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp
>

---

From: Peter Saint-Andre - &yet <[email-masked]>
Date: Thu, 13 Nov 2014 16:08:51 -0700

Hi Dave, thanks for the feedback.

On 11/12/14, 4:47 AM, Dave Cridland wrote:
> Lightning review:
>
> 1) §3.3 - I don't understand why session tickets would be bad compared
> to session ids?

I freely admit that I don't understand the effective difference between 
session IDs and session tickets for XMPP (or for TLS session resumption 
in general). To my meager brain, the differences are not explained well 
in the RFCs. Enlightenment would be appreciated. :-)

> currently says the only MTI is xmppAddr; RFC 6125 gives no MTI as I

This is covered in §13.7.1.2.1 of RFC 6120. Perhaps a pointer to that 
section would be helpful?

> wildcard resolution is within the scope of the application rather than

That's also covered in the aforementioned section of RFC 6120. However, 
do we feel that it's time to revisit the text there? (BTW, Jeff Hodges 
and I tried to kill off wildcard certs entirely in RFC 6125 but weren't 
successful.)

> 4) Finally, there's two different protocols in XMPP - C2S and S2S. It
> might be good to explicitly note the different requirements on these
> (the draft says C2S clients MUST authenticate servers, for example).

And it doesn't say that servers need to authenticate peer servers over 
s2s, which implies that unauthenticated s2s connections are allowed. 
This is consistent with current practice. Are you suggesting that we 
change the recommendation (e.g., SHOULD or MUST authenticate for s2s) or 
at least make it explicit that unauthenticated s2s connections are allowed?

Peter

-- 
Peter Saint-Andre
https://andyet.com/