git-svn-id: file:///home/ksmith/gitmigration/svn/xmpp/trunk@1721 4b5297f7-1745-476d-ba37-a9c6900126ab
This commit is contained in:
Peter Saint-Andre 2008-03-03 16:28:46 +00:00
parent e9668e88f8
commit e89914b1e0
1 changed files with 43 additions and 37 deletions

View File

@ -7,7 +7,7 @@
<xep>
<header>
<title>Public Key Publishing</title>
<abstract>This document specifies how an entity may publish its public keys over XMPP.</abstract>
<abstract>This specification defines a method by which an entity can publish its public keys over XMPP.</abstract>
&LEGALNOTICE;
<number>0189</number>
<status>Experimental</status>
@ -24,6 +24,12 @@
<shortname>NOT YET ASSIGNED</shortname>
&ianpaterson;
&stpeter;
<revision>
<version>0.7</version>
<date>2008-03-03</date>
<initials>psa</initials>
<remark><p>Changed temporary namespace per XEP-0053 procedures; corrected several small errors in the text and examples.</p></remark>
</revision>
<revision>
<version>0.6</version>
<date>2007-08-15</date>
@ -70,13 +76,13 @@
<p>An entity MAY have multiple public keys with different formats, signatures, algorithms, strengths and expiry dates. Each client used by a user may use different keys.</p>
</section1>
<section1 topic='Public Key Publication via PEP' anchor='usecases-pub'>
<p>An entity SHOULD use &xep0163; to publish its long-term public keys via its own server. Processes for doing so are described in the following sections.</p>
<section2 topic='Creating the Node' anchor='usecases-pub-create'>
<p>If the pubkeys PEP node does not exist already then the entity must create it. The node MUST have a NodeID of "http://www.xmpp.org/extensions/xep-0189.html#ns" &NSNOTE;.</p>
<p>The node SHOULD be configured as follows (see also &xep0222;):</p>
<section1 topic='Public Key Publication via PEP' anchor='pub'>
<p>An entity SHOULD follow the best practices defined in &xep0222; to publish its long-term public keys via its own server. Processes for doing so are described in the following sections.</p>
<section2 topic='Creating the Node' anchor='pub-create'>
<p>If the pubkeys PEP node does not exist already then the entity must create it. The node MUST have a NodeID of "urn:xmpp:tmp:pubkey" &NSNOTE;.</p>
<p>The node MUST be configured as follows:</p>
<ul>
<li>Items published to the node are persistent (this is done by setting the "persistent-items" option to true).</li>
<li>Items published to the node are persistent (this is done by setting the "persist_items" option to true).</li>
<li>Keys will be pushed to subscribers only when new keys are published, not when subscribers become newly available or when a new subscription is created (this is done by setting the "send_last_published_item" option to "never").</li>
</ul>
<p>If the user wants to control access to his/her identity (see <link url='#security'>Security Considerations</link>) then the node access model SHOULD be something other than "Open" (this can be done by setting the "access_model" option to a value of "authorize", "presence", "roster", or "whitelist").</p>
@ -86,7 +92,7 @@
to='pubsub.shakespeare.lit'
id='create1'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<create node='http://www.xmpp.org/extensions/xep-0189.html#ns'/>
<create node='urn:xmpp:tmp:pubkey'/>
<configure>
<x xmlns='jabber:x:data' type='submit'>
<field var='FORM_TYPE' type='hidden'>
@ -113,7 +119,7 @@
<example caption='Entity Auto-Creates Node and Publishes an RSA Key'><![CDATA[
<iq from='juliet@capulet.com/balcony' type='set' id='pub1'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<publish node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<publish node='urn:xmpp:tmp:pubkey'>
<item id='julietRSAkey1hash'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyName>julietRSAkey1hash</KeyName>
@ -149,15 +155,15 @@
</iq>
]]></example>
</section2>
<section2 topic='Publishing a Key' anchor='usecases-pub-publish'>
<section2 topic='Publishing a Key' anchor='pub-publish'>
<p>The entity publishes a key by sending a pubsub publish request to the pubsub service. A previously published key can be updated by re-publishing the key using the same ItemID.</p>
<p>Each public key MUST be wrapped in a &lt;KeyInfo/&gt; element qualified by the 'http://www.w3.org/2000/09/xmldsig#' namespace as specified in &w3xmlsig;. Each &lt;KeyInfo/&gt; element published using PEP MUST contain a &lt;KeyName/&gt; element with a name that is unique for the user; this enables the key to be referenced by other XMPP Extension Protocols (for example, &xep0136;). The name MAY be the same as the value of the ItemID. However, if two &lt;KeyInfo/&gt; elements contain the same public key in different formats (for example, an X.509 certificate may contain an RSA key), then the name of the two keys SHOULD be the same.</p>
<p>Each public key MUST be wrapped in a &lt;KeyInfo/&gt; element qualified by the 'http://www.w3.org/2000/09/xmldsig#' namespace as specified in &w3xmlsig;. Each &lt;KeyInfo/&gt; element MUST contain a &lt;KeyName/&gt; element with a name that is unique for the user; this enables the key to be referenced by other XMPP Extension Protocols (for example, &xep0136;). The name MAY be the same as the value of the ItemID. However, if two &lt;KeyInfo/&gt; elements contain the same public key in different formats (for example, an X.509 certificate may contain an RSA key), then the name of the two keys SHOULD be the same.</p>
<p>Before computing the fingerprint or publishing the key, all character data <em>between</em> all elements in the &lt;KeyInfo/&gt; element MUST be removed and the XML MUST be converted to canonical form according to &w3canon;. (Any whitespace or other character data shown in the examples herein is included only for the purpose of readability.)</p>
<p>The value of the ItemID SHOULD be set to the fingerprint of the public key, e.g., the SHA256 hash (see &nistfips180-2;) of the key's normalized &lt;KeyValue/&gt;, &lt;PGPData/&gt; or &lt;X509Data/&gt; element. Therefore subscribers or other interested entities are able to request a single key by specifying its fingerprint (for example, when a subscriber is using the &xep0116; protocol).</p>
<example caption='Entity Publishes a DSA Key to its Server'><![CDATA[
<iq from='juliet@capulet.com/balcony' type='set' id='pub2'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<publish node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<publish node='urn:xmpp:tmp:pubkey'>
<item id='julietDSAkey1hash'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyName>julietDSAkey1hash</KeyName>
@ -178,7 +184,7 @@
<example caption='Entity Publishes an X.509 Certificate to its Server'><![CDATA[
<iq from='juliet@capulet.com/balcony' type='set' id='pub3'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<publish node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<publish node='urn:xmpp:tmp:pubkey'>
<item id='julietX509cert1hash'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyName>julietX509cert1hash</KeyName>
@ -202,7 +208,7 @@
<example caption='Entity Publishes a PGP Key to its Server'><![CDATA[
<iq from='juliet@capulet.com/balcony' type='set' id='pub4'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<publish node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<publish node='urn:xmpp:tmp:pubkey'>
<item id='julietPGPkey1hash'>
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
<KeyName>julietPGPkey1hash</KeyName>
@ -220,7 +226,7 @@
<example caption='Pubsub Service Sends Notification with Key'><![CDATA[
<message to='romeo@montague.net/garden' from='juliet@capulet.com' type='headline'>
<event xmlns='http://jabber.org/protocol/pubsub#event'>
<items node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<items node='urn:xmpp:tmp:pubkey'>
<item id='julietRSAkey1hash'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyName>julietRSAkey1hash</KeyName>
@ -243,14 +249,14 @@
</section2>
</section1>
<section1 topic='Public Key Retrieval via PEP' anchor='usecases-retrieve'>
<section1 topic='Public Key Retrieval via PEP' anchor='retrieve'>
<example caption='Subscriber Requests Keys from Account'><![CDATA[
<iq type='get'
to='juliet@capulet.com'
from='romeo@montague.net/garden'
id='items1'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<items node='http://www.xmpp.org/extensions/xep-0189.html#ns'/>
<items node='urn:xmpp:tmp:pubkey'/>
</pubsub>
</iq>
]]></example>
@ -260,7 +266,7 @@
from='juliet@capulet.com'
id='items1'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<items node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<items node='urn:xmpp:tmp:pubkey'>
<item id='julietRSAkey1hash'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyName>julietRSAkey1hash</KeyName>
@ -295,7 +301,7 @@
from='romeo@montague.net/garden'
id='items2'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<items node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<items node='urn:xmpp:tmp:pubkey'>
<item id='julietRSAkey1hash'/>
</items>
</pubsub>
@ -307,7 +313,7 @@
from='juliet@capulet.com'
id='items2'>
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
<items node='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<items node='urn:xmpp:tmp:pubkey'>
<item id='julietRSAkey1hash'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyName>julietRSAkey1hash</KeyName>
@ -325,14 +331,14 @@
]]></example>
</section1>
<section1 topic='Requesting Public Keys Directly From Another Entity' anchor='usecases-request'>
<p>If an entity wishes to request the public keys of another entity and it cannot access the keys via <cite>Personal Eventing via Pubsub</cite>, then the entity MAY send an &IQ; of type 'get' to the other entity, containing an empty &lt;pubkeys/&gt; element qualified by the 'http://www.xmpp.org/extensions/xep-0189.html#ns' namespace &NSNOTE;.</p>
<section1 topic='Requesting Public Keys Directly From Another Entity' anchor='request'>
<p>If an entity wishes to request the public keys of another entity and it cannot access the keys via <cite>Personal Eventing via Pubsub</cite>, then the entity MAY send an &IQ; of type 'get' to the other entity, containing an empty &lt;pubkeys/&gt; element qualified by the 'urn:xmpp:tmp:pubkey' namespace &NSNOTE;.</p>
<example caption='Public keys request'><![CDATA[
<iq type='get'
id='keys1'
to='juliet@capulet.com/balcony'
from='romeo@montague.net/garden'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns'/>
<pubkeys xmlns='urn:xmpp:tmp:pubkey'/>
</iq>
]]></example>
<p>The other entity MUST make a careful access control decision before returning only those public keys for which it holds the corresponding private key (not necessarily the full list of keys being published via <cite>Personal Eventing via Pubsub</cite>):</p>
@ -341,7 +347,7 @@
id='keys1'
to='romeo@montague.net/garden'
from='juliet@capulet.com/balcony'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<pubkeys xmlns='urn:xmpp:tmp:pubkey'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
...
</KeyInfo>
@ -363,19 +369,19 @@
id='keys1'
to='romeo@montague.net/garden'
from='juliet@capulet.com/balcony'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns'/>
<pubkeys xmlns='urn:xmpp:tmp:pubkey'/>
<error code='503' type='cancel'>
<service-unavailable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
</error>
</iq>
]]></example>
<p>An entity MAY request one or more specific public keys by specifying their fingerprints (see <link url='#usecases-pub'>Public Key Publication via PEP</link>) as the content of &lt;fprint/&gt; child elements:</p>
<p>An entity MAY request one or more specific public keys by specifying their fingerprints (see <link url='#pub'>Public Key Publication via PEP</link>) as the content of &lt;fprint/&gt; child elements:</p>
<example caption='Specific public keys request'><![CDATA[
<iq type='get'
id='keys2'
to='juliet@capulet.com/balcony'
from='romeo@montague.net/garden'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<pubkeys xmlns='urn:xmpp:tmp:pubkey'>
<fprint>julietRSAkey1hash</fprint>
<fprint>julietRSAkey2hash</fprint>
</pubkeys>
@ -386,7 +392,7 @@
id='keys2'
to='romeo@montague.net/garden'
from='juliet@capulet.com/balcony'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns'>
<pubkeys xmlns='urn:xmpp:tmp:pubkey'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
...
</KeyInfo>
@ -398,14 +404,14 @@
]]></example>
</section1>
<section1 topic='Requesting Public Keys Directly From a Third Party' anchor='usecases-third'>
<section1 topic='Requesting Public Keys Directly From a Third Party' anchor='third'>
<p>An entity may request the public keys of another entity from a third party using the 'jid' attribute of the &lt;pubkeys/&gt; element to specify the JID that the keys belong to:</p>
<example caption='Requesting public keys from a third-party'><![CDATA[
<iq type='get'
id='keys3'
to='juliet@capulet.com/balcony'
from='romeo@montague.net/garden'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns' jid='benvolio@capulet.com'/>
<pubkeys xmlns='urn:xmpp:tmp:pubkey' jid='benvolio@capulet.com'/>
</iq>
]]></example>
<example caption='Third-party responds with public keys'><![CDATA[
@ -413,7 +419,7 @@
id='keys3'
to='romeo@montague.net/garden'
from='juliet@capulet.com/balcony'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns' jid='benvolio@capulet.com'>
<pubkeys xmlns='urn:xmpp:tmp:pubkey' jid='benvolio@capulet.com'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
...
</KeyInfo>
@ -428,7 +434,7 @@
id='keys3'
to='romeo@montague.net/garden'
from='juliet@capulet.com/balcony'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns' jid='benvolio@capulet.com'/>
<pubkeys xmlns='urn:xmpp:tmp:pubkey' jid='benvolio@capulet.com'/>
<error code='404' type='cancel'>
<item-not-found xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
</error>
@ -436,12 +442,12 @@
]]></example>
</section1>
<section1 topic='Sending Public Keys Directly To Another Entity' anchor='usecases-send'>
<section1 topic='Sending Public Keys Directly To Another Entity' anchor='send'>
<p>If an entity wishes to send public keys to another entity then it MAY include them in a &MESSAGE; stanza. The entity MAY use the 'jid' attribute of the &lt;pubkeys/&gt; element to specify the JID that the keys belong to. If no 'jid' attribute is specified then the other entity SHOULD assume the keys belong to the sender of the stanza.</p>
<example caption='Sending public keys'><![CDATA[
<message to='romeo@montague.net/garden'
from='juliet@capulet.com/balcony'>
<pubkeys xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns' jid='benvolio@capulet.com'>
<pubkeys xmlns='urn:xmpp:tmp:pubkey' jid='benvolio@capulet.com'>
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
<KeyValue>
<RSAKeyValue>
@ -474,7 +480,7 @@
<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
<section2 topic='Protocol Namespaces' anchor='ns'>
<p>Until this specification advances to a status of Draft, its associated namespace shall be "http://www.xmpp.org/extensions/xep-0189.html#ns"; upon advancement of this specification, the &REGISTRAR; shall issue a permanent namespace in accordance with the process defined in Section 4 of &xep0053;.</p>
<p>Until this specification advances to a status of Draft, its associated namespace shall be "urn:xmpp:tmp:pubkey"; upon advancement of this specification, the &REGISTRAR; shall issue a permanent namespace in accordance with the process defined in Section 4 of &xep0053;.</p>
</section2>
</section1>
@ -484,8 +490,8 @@
<xs:schema
xmlns:xs='http://www.w3.org/2001/XMLSchema'
targetNamespace='http://www.xmpp.org/extensions/xep-0189.html#ns'
xmlns='http://www.xmpp.org/extensions/xep-0189.html#ns'
targetNamespace='urn:xmpp:tmp:pubkey'
xmlns='urn:xmpp:tmp:pubkey'
elementFormDefault='qualified'>
<xs:element name='pubkeys'>