Subject: [xmpp] service name(s) and SRVName in certs

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 12 Oct 2010 07:31:45 -0600

RFC 3920 registered two ports, 5222 and 5269, for the services
xmpp-client and xmpp-server. As previously discussed on this list, in
RFC 3920 we did not explicitly register those service names (only the
ports), but we could do that now according to the procedures defined here:

https://datatracker.ietf.org/doc/draft-ietf-tsvwg-iana-ports/

The service names are re-used for purposes of certificate issuance and
validation as defined in RFC 4985. Therefore a certificate to be used at
an XMPP service that offers both c2s and s2s connections would include
*two* SRVNames:

_xmpp-client.example.com
_xmpp-server.example.com

Is that confusing for CAs, service providers, and client developers?
Would it be easier (from the certificate perspective) to register a new
service name of "xmpp", so that we would have only one SRVName form?

_xmpp.example.com

Naturally, that in itself might be confusing, because I could see people
adding _xmpp._tcp.example.com to their DNS SRV records. Ouch!

Therefore, I think it is better to *not* register the plain "xmpp"
service name.

However, I will follow up with the IANA regarding updated registration
of the xmpp-client and xmpp-server names.

Finally, I think we need to clarify in 3920bis that a certificate would
include two SRV-IDs, one for xmpp-client and one for xmpp-server. The
right place seems to be Section 13.7.1.2.1 (the examples in Section
13.7.1.2.2 are correct, but I think we need to add a few words about
this in Section 13.7.1.2.1, too).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: "Richard L. Barnes" <[email-masked]>
Date: Tue, 12 Oct 2010 09:37:46 -0400

I agree that adding an _xmpp service seems unnecessary and confusing,  
much more so than having two SRVNames.  Certificates commonly have  
multiple names in them; SRVNames are just another type of name.

--Richard

On Oct 12, 2010, at 9:31 AM, Peter Saint-Andre wrote:

> _______________________________________________
> xmpp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/xmpp

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 12 Oct 2010 09:25:20 -0600

> of the xmpp-client and xmpp-server names.

In my working copy I've updated Section 14.7 as follows...

###

14.7.  Port Numbers and Service Names

   The IANA has registered "xmpp-client" and "xmpp-server" as keywords
   for [TCP] ports 5222 and 5269 respectively.  In accordance with
   [IANA-PORTS], this document updates the existing registration, as
   follows.

   Service Name:  xmpp-client
   Transport Protocol:  TCP
   Description:  A service offering support for connections by XMPP
      client applications
   Registrant:  IETF XMPP Working Group
   Contact:  IESG, <[email-masked]>
   Reference:  XXXX
   Port Number:  5222

   Service Name:  xmpp-server
   Transport Protocol:  TCP
   Description:  A service offering support for connections by XMPP
      server applications
   Registrant:  IETF XMPP Working Group
   Contact:  IESG, <[email-masked]>
   Reference:  XXXX
   Port Number:  5269

###

> this in Section 13.7.1.2.1, too).

In my working copy I've updated Section 13.7.1.2.1 as follows (note that
I broke out the text into bullets points to improve readability, and
also removed mention of the CN-ID identifier type because that is
covered by draft-saintandre-tls-server-id-check)...

###

13.7.1.2.1.  Rules

   In a digital certificate to be presented by an XMPP server (i.e., a
   SERVER CERTIFICATE), it is RECOMMENDED for the certificate to include
   one or more JIDs (i.e., domainparts) associated with domains serviced
   at the server.  The rules and guidelines defined in [TLS-CERTS] apply
   to XMPP server certificates, with the following supplemental rules
   for XMPP:

   o  Support for the DNS-ID identifier type [PKIX] is REQUIRED in XMPP
      client and server software implementations.  Certification
      authorities that issue XMPP-specific certificates MUST support the
      DNS-ID identifier type.  Service providers SHOULD include the
      DNS-ID identifier type in certificate requests.

   o  Support for the SRV-ID identifier type [PKIX-SRV] is REQUIRED for
      XMPP client and server software implementations (XMPP client
      implementations need to support only the "_xmpp-client" service
      type, whereas XMPP server implementations need to support both the
      "_xmpp-client" and "_xmpp-server" service types).  Certification
      authorities that issue XMPP-specific certificates SHOULD support
      the SRV-ID identifier type.  Service providers SHOULD include the
      SRV-ID identifier type in certificate requests.

   o  Support for the XmppAddr identifier type (specified under
      Section 13.7.1.4) is encouraged in XMPP client and server software
      implementations for the sake of backward-compatibility, but is no
      longer encouraged in certificates issued by certification
      authorities or requested by service providers.

###

/psa