Require to specify an algorithm for elements with hashes; remove fingerprint in <keyinfo/>; add sign request; add guidelines for key management; and improve examples.
An entity MAY have multiple public keys with different formats, signatures, algorithms, strengths and expiry dates. Each client used by a user may use different keys.
+An entity MAY have multiple public keys with different formats, signatures, algorithms, strengths and expiry dates. Each client used by a user may use different keys. Guidelines how to manage different public keys in included in this document.
This document does not use the 'http://www.w3.org/2000/09/xmldsig#' namespace as specified in &w3xmlsig; because it is too complicated and the complexity is not needed for this use case. The keyinfo element defined in the 'urn:xmpp:tmp:pubkey' namespace is based on the ASCII output most cryptographic libraries support. The keyinfo has three parts: a unique name, the public key data (optional) and signatures from other keys (optional). The name is the fingerprint of the public key. The unique name / fingerprint can be used to search for a key (see Public Key Publication via PEP) and MUST be written in lower case.
+This document does not use the 'http://www.w3.org/2000/09/xmldsig#' namespace as specified in &w3xmlsig; because it is too complicated and the complexity is not needed for this use case. The <keyinfo/> element defined in the 'urn:xmpp:tmp:pubkey' namespace is based on the ASCII output most cryptographic libraries support. It has two parts: the public key data and signatures from other keys (optional). The optional argument 'jid' SHOULD be set if the X.509 certificate or OpenPGP key does not belong to the user providing it to another.
Since X.509 has no standard fingerprint mechanisms, the SHA1 value in hex of the certificate is used as name. The public key data is the X.509 certificate in DER encoding. To be included in an XML stream the data is Base64 encoded.
+The public key data is the X.509 certificate in DER encoding. To be included in an XML stream the data is Base64 encoded.
OpenPGP (&rfc4880;) defines how to create fingerprints. This fingerprint is used as unique name. The public key data is the OpenPGP public key using binary output. Like X.509 certificates the data must be Base64 encoded to fit in an XML stream.
+The public key data is the OpenPGP public key (&rfc4880;) using binary output. Like X.509 certificates the data must be Base64 encoded to fit in an XML stream.
Besides the name and the data a key can have one or more signatures. A signature can be used to sign an X.509 certificate with an OpenPGP key or the other way around. This makes it possible to verify a self-signed X.509 certificate with the OpenPGP web-of-trust. A second use case is the concept of user and client keys. A user may choose to use a different X.509 certificate for each client for &xep0178; or &xep0250;. All these client key can be signed by a user key. Once the user key is known all clients can be verified. This XMPP based approach makes it possible to use self-signed certificates without setting up a CA.
-The signature has an issuer and the signature data. The issuer contains the unique name / fingerprint of the key that was used to create the signature. An optional argument 'jid' SHOULD be set if the issuer has a different base JID than the key to sign. This makes it possible to find the issuer key using PEP (see Public Key Publication via PEP).
+Besides the data, a key can have one or more signatures. A signature can be used to sign an X.509 certificate with an OpenPGP key or the other way around. This makes it possible to verify a self-signed X.509 certificate with the OpenPGP web-of-trust. A second use case is the concept of user and client keys. A user may choose to use a different X.509 certificates for each client for &xtls; or &saslext;. All these client key can be signed by a user key. Once the user key is known, all clients can be verified. This XMPP based approach makes it possible to use self-signed certificates without setting up a CA (see Key Management Guidelines for Secure End-on-End Communication).
+The signature has an issuer and the signature data. The issuer contains the fingerprint of the key that was used to create the signature. An optional argument 'jid' SHOULD be set if the issuer has a different base JID than the key to sign. This makes it possible to find the issuer key using PEP (see Public Key Publication via PEP).
While OpenPGP defines how to sign a string, X.509 does not specify the hash algorithm. For X.509 the signature data MUST contain an attribute what hash and sign algorithms were used. This document only defines 'RSA-SHA1' at this time. To make it easier to use standard cryptographic libraries the hash must contain the ASN.1 BER SHA1 algorithm designator prefix required in PKCS1. See XML-SIG section 6.4.2 how to hash and sign a string using RSA-SHA1. In most cases the cryptographic library will automatically take care of this. The data to sign is the X.509 certificate in DER encoding or the OpenPGP binary string of the fingerprint (the provided key data without Base64 encoding).
-The next example contains am X.509 certificate signed by the key defined in the first example.
-If the user wants to control access to his/her identity (see Security Considerations) then the node access model SHOULD be something other than "open" (this can be done by setting the "access_model" option to a value of "authorize", "presence", "roster", or "whitelist").
Alternatively, if the entity's pubsub service supports both the "auto-create" and "publish-options" features, then the entity MAY create the node by publishing a key and in the first publish including a <publish-options/> element. However, note that not all pubsub services support this feature, since it is optional in &xep0060;.
The entity publishes a key by sending a pubsub publish request to the pubsub service. A previously published key can be updated by re-publishing the key using the same ItemID. The value of the ItemID SHOULD be set to the fingerprint of the public key (the name). Therefore subscribers or other interested entities are able to request a single key by specifying its fingerprint (for example, when a subscriber is using C2C Authentication Using TLS).
+The entity publishes a key by sending a pubsub publish request to the pubsub service. A previously published key can be updated by re-publishing the key using the same ItemID. The value of the ItemID SHOULD be the fingerprint of the X.509 certificate or the OpenPGP key and SHOULD be written in lower case. Since X.509 has no standard fingerprint mechanisms, the SHA1 value in hex is SHOULD be used as ItemID. Therefore subscribers or other interested entities are able to request a single key by specifying its fingerprint (for example, when a subscriber is using XTLS).
If an entity wishes to request the public keys of another entity and it cannot access the keys via Personal Eventing via Pubsub, then the entity MAY send an &IQ; of type 'get' to the other entity, containing an empty <pubkeys/> element qualified by the 'urn:xmpp:tmp:pubkey' namespace &NSNOTE;.
The other entity MUST make a careful access control decision before returning only those public keys for which it holds the corresponding private key (not necessarily the full list of keys being published via Personal Eventing via Pubsub):
+The other entity MUST make a careful access control decision before returning only those public keys for which it holds the corresponding private key (not necessarily the full list of keys being published via Personal Eventing via Pubsub). The client MAY also include the public key which was used to sign its keys even if it does not hold the private key. In that case the <keyinfo/> element MUST contain the 'jid' attribute of the public key even it is belongs to the same user.
If the receiving entity decides not to return the public keys, it MUST return an IQ error, which SHOULD be &unavailable; (to avoid divulging presence to unauthorized entities), but MAY be some other appropriate error, such as &forbidden; or ¬allowed;:
An entity MAY request one or more specific public keys by specifying their fingerprints (see Public Key Publication via PEP) as the content of <fprint/> child elements:
+An entity MAY request one or more specific public keys by specifying their fingerprints (see Public Key Publication via PEP) as the content of <fingerprint/> child elements:
An entity may request the public keys of another entity from a third party using the 'jid' attribute of the <pubkeys/> element to specify the JID that the keys belong to:
If an entity wishes to send public keys to another entity then it MAY include them in a &MESSAGE; stanza. The entity MAY use the 'jid' attribute of the <pubkeys/> element to specify the JID that the keys belong to. If no 'jid' attribute is specified then the other entity SHOULD assume the keys belong to the sender of the stanza.
+If an entity wishes to send public keys to another entity then it MAY include them in a &MESSAGE; stanza. The entity MAY use the 'jid' attribute of the <keyinfo/> element to specify the JID that the keys belong to. If no 'jid' attribute is specified then the other entity SHOULD assume the keys belong to the sender of the stanza.
A client may want to add another client's X.509 certificate to the pubsub node or send it directly to another client, and the client wants that certificate signed with the user's private key. If the client is not in possession of the private key, it can send a 'sign' request to another client of the user having access to the certificate.
+The signing client SHOULD only accept signing requests from clients of the same user (sharing a bare JID) and it is RECOMMENDED to use a secure end-to-end communicate according to &xtls; or &xep0250; for serverless-messing.
+Possible error conditions are that the signing client does not have the requested private key, the client is not authorized to request a signature, or that the signing client requires a secure connection and the request was issued over an insecure link.
+Different X.509 certificates for each client, a user X.509 certificate to sign client certificates, and secure communication with friends make the scenario quite confusing. This section provides guidelines how to manage the different public keys and what kind of key to sign. The desired use case is to manage for secure end-on-end communication as defined by XTLS.
+Each client has its own certificate. This certificate is most likely self-signed.
The user has a user certificate and one or more clients can have access to the user's private key to sign certificates. To bootstrap the system, one client generates the certificate on behalf of the user.
Users SHOULD sign all their client certificates with their user certificate. To accomplish this in a userfriendly way, the user MAY log into the account with more than one client simultaneously. One client MUST have the user's private key or is trusted to issue a 'sign' request. The two clients open a secure connection between themselves based on TLS-SRP (see XTLS, Section 6). After a secure communicate between the two clients is established, the client without the user certificate requests its certificate to be signed. After that it can be uploaded to the pubsub node. The new client SHOULD also request the user certificate to be able to validate signatures for other clients.
If a client opens a secure connection to another user based on TLS-SRP, it SHOULD request the user certificate of its peer. It will either sign the certificate itself or ask another client with the user's private key to do so. The friend's user certificate can then be uploaded to the pubsub node of the user (not the friend). The <keyinfo/> element SHOULD contain the bare JID of the friend in the 'jid' attribute.
If a client wants to open a secure end-to-end connection to another client of the same user, it SHOULD check the pubsub node for the certificate. The certificate MUST be signed by the user's certificate.
If a client wants to open a secure end-to-end connection to a client of another user, it SHOULD check the its pubsub node for the friend's user certificate and the friend's pubsub node for the client certificate. The friend's user certificate MUST be signed by its own user certificate and the clients certificate MUST be signed by the friend's user certificate.
If a user possess an OpenPGP key, the user certificate SHOULD be signed with that key. This allows another users to verify the certificate based on the OpenPGP web-of-trust, and two users may be able to bootstrap a secure communicate without the usage of TLS-SRP.
+If an entity can sign certificates or OpenPGP keys with the user's private key, it MUST report that by including a service discovery feature of "urn:xmpp:tmp:pubkey:sign" in response to disco#info requests &NSNOTE;.
+The reliable association between a user or entity and its public keys is beyond the scope of this document. However, each client SHOULD maintain its own secure library of the public keys (or the "fingerprints" of the keys) it associates with other users (not necessarily JIDs).
Whenever public keys are published an identity is typically associated with a JID. Although the public keys are public information, it may be critically important for the user of the JID to keep his identity secret from all but a few specified people. Implementors MUST take great care to ensure that the identity of the user of a JID is never divulged to anyone except the entities who have been permitted by the user to access the public key.
+The usage of secure end-to-end communication is RECOMMENDED for exchanging public keys without a pubsub service.
Until this specification advances to a status of Draft, its associated namespace shall be "urn:xmpp:tmp:pubkey"; upon advancement of this specification, the ®ISTRAR; shall issue a permanent namespace in accordance with the process defined in Section 4 of &xep0053;.
The XMPP Registrar shall include the following features in its registry of service discovery features (see &DISCOFEATURES;), where the string "urn:xmpp:tmp:pubkey" shall be replaced with the URN issued by the XMPP Registrar:
+
+ urn:xmpp:tmp:pubkey:sign
+ The client is in possession of the user's private client to sign certificates.
+ XEP-0189
+
+ ]]>
+