Subject: [xmpp] Agenda Topics

From: Sean Turner <[email-masked]>
Date: Wed, 15 Jul 2009 17:30:36 -0400

Joe and I are in the process of drafting the an initial agenda.

Peter Saint-Andre has offered to present the issues with the WG's two 
work products:
draft-ietf-xmpp-3921bis-00.txt
draft-ietf-xmpp-3921bis-01.txt

We've also received requests for time slots to present the following two 
drafts as proposals for new working group items: 
draft-saintandre-xmpp-e2e-requirements-00.txt
draft-hildebrand-xmpp-tls-multiplexing-00.txt.

We have also received two other request for time slots to present topics 
related to but not explicitly part of our charter.

Are there others that wish to present at the meeting?  For example, are 
there others that have read the two above proposed WG work items and 
have other IDs or ideas?  If you have a topic that you would like to 
present to the XMPP WG, then please submit your request to Joe 
([email-masked]) or myself ([email-masked]) with the topic 
and an expected length of the presentation.

spt

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 15 Jul 2009 17:06:56 -0600

> draft-saintandre-xmpp-e2e-requirements-00.txt

Perhaps Dirk Meyer can talk about draft-meyer-xmpp-e2e-encryption as one
possible solution addressing the e2e encryption requirements. I'd also
be curious if people have ideas about other possible solutions...

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: Dirk Meyer <[email-masked]>
Date: Thu, 16 Jul 2009 14:38:42 +0200

> be curious if people have ideas about other possible solutions...

Yes, first talking about the requirements and after that about a
possible solution sounds like a good idea. I also have some remarks on
what we may want to change in XTLS, but maybe someone else has a
completly different idea.

Dirk

-- 
Wash: This is gonna get pretty interesting.
Mal: Define "interesting".
Wash: Oh God, oh God, we're all gonna die?
    - Serenity (2005)

---

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 16 Jul 2009 08:55:06 -0600

> completly different idea.

Sounds good. Perhaps you could relay those thoughts to the list before
the Stockholm meeting (not everyone on the list will be there, and it's
always helpful to give people time to think about the issue before we
discuss it in person).

I have been meaning to write a little summary of XTLS, too, so I will
send that to the list soon.

Peter

- --
Peter Saint-Andre
https://stpeter.im/

---

From: Dirk Meyer <[email-masked]>
Date: Fri, 17 Jul 2009 15:30:59 +0200

> always helpful to give people time to think about the issue before we

OK. The idea is to replace TLS-SRP and the additional method exchange by
always using TLS with (self-signed) X.509 certificates and use SASL
later in case one client can not verify its peer's certificate.

My understanding of SCRAM is that it may not possible to use it without
some modification, but there is (an expired) version of SRP used for SASL
http://www.melnikov.ca/mel/Drafts/draft-burdis-cat-srp-sasl-07.txt

Dirk

-- 
perl -le '$_=(split("\"",`$^Xdoc -q japh`))[1].".";y/pj/PJ/;print'

---

From: Alexey Melnikov <[email-masked]>
Date: Fri, 17 Jul 2009 15:11:04 +0100

Hi Dirk,

>http://www.melnikov.ca/mel/Drafts/draft-burdis-cat-srp-sasl-07.txt
Can you clarify what would need to be changed in SCRAM in order to make 
it work for your purposes?

---

From: Dirk Meyer <[email-masked]>
Date: Fri, 17 Jul 2009 16:19:20 +0200

Alexey Melnikov wrote:
> Can you clarify what would need to be changed in SCRAM in order to
> make it work for your purposes?

I am no security expert, so I may be wrong here. But I'm not sure it
provides mutal authentication with simple passwords (like a 4 digest
PIN). There was some discussion about that on the XMPP security mailing
list. IIRC is it possible for the client in the role of the SASL server
to guess the password based on a dictionary.

Dirk