mirror of https://github.com/moparisthebest/xeps
0.3 RC1 PEP nodes SHOULD be persistent
git-svn-id: file:///home/ksmith/gitmigration/svn/xmpp/trunk@189 4b5297f7-1745-476d-ba37-a9c6900126ab
This commit is contained in:
Ian Paterson
parent
1cae79caf2
commit
f13f39d1eb
209
xep-0189.xml
209
xep-0189.xml
|
|
@ -23,6 +23,12 @@
|
|||
<supersededby>None</supersededby>
|
||||
<shortname>pubkeys</shortname>
|
||||
&ianpaterson;
|
||||
<revision>
|
||||
<version>0.3</version>
|
||||
<date>2006-11-20</date>
|
||||
<initials>ip</initials>
|
||||
<remark><p>Specified that PEP nodes SHOULD be persistent</p></remark>
|
||||
</revision>
|
||||
<revision>
|
||||
<version>0.2</version>
|
||||
<date>2006-09-29</date>
|
||||
|
|
@ -47,105 +53,126 @@
|
|||
|
||||
<section1 topic='Public Key Publication and Retrieval via PEP' anchor='usecases-pubsub'>
|
||||
<p>An entity SHOULD use &xep0163; to publish all its long-term public keys via its own server.</p>
|
||||
<p>If the pubkeys PEP node does not exist already then the entity MUST create it first. In this case, the entity SHOULD specify that the keys will only be pushed to subscribers whenever new keys are published (i.e. not when subscribers become newly available or when a new subscription is created). If the user wants to control access to his/her identity (see <link url='#security'>Security Considerations</link>) then the entity MUST also specify an appropriate access model other than "Open".</p>
|
||||
<p>If the pubkeys PEP node does not exist already then the entity MUST create it first. In this case, the entity SHOULD specify that items published to the node are persistent and that the keys will only be pushed to subscribers whenever new keys are published (i.e. not when subscribers become newly available or when a new subscription is created). If the user wants to control access to his/her identity (see <link url='#security'>Security Considerations</link>) then the entity MUST also specify an appropriate access model other than "Open".</p>
|
||||
<example caption='Entity Creates Public Keys Publishing Node'><![CDATA[
|
||||
<iq from='juliet@capulet.com/balcony' type='set' id='create1'>
|
||||
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
|
||||
<create node='http://jabber.org/protocol/pubkeys'/>
|
||||
<configure>
|
||||
<x xmlns='jabber:x:data' type='form'>
|
||||
<x xmlns='jabber:x:data' type='submit'>
|
||||
<field var='FORM_TYPE' type='hidden'>
|
||||
<value>http://jabber.org/protocol/pubsub#node_config</value>
|
||||
</field>
|
||||
<field var='pubsub#persist_items'>
|
||||
<value>1</value>
|
||||
</field>
|
||||
<field var='pubsub#send_last_published_item'>
|
||||
<option><value>never</value></option>
|
||||
<value>never</value>
|
||||
</field>
|
||||
<field var='pubsub#access_model'>
|
||||
<option><value>roster</value></option>
|
||||
<value>roster</value>
|
||||
</field>
|
||||
<field var='pubsub#roster_groups_allowed'>
|
||||
<option><value>friends</value></option>
|
||||
<value>friends</value>
|
||||
</field>
|
||||
</x>
|
||||
</configure>
|
||||
</pubsub>
|
||||
</iq>
|
||||
]]></example>
|
||||
<p>Once the publishing node has been created, the entity can update the keys at any time. Each public key MUST be wrapped in a <KeyInfo/> element as specified in &w3xmlsig;. Each <KeyInfo/> element MUST contain a <KeyName/> element with a unique (for the user) name to allow the key to be referenced by other protocols. All the <KeyInfo/> elements MUST be wrapped in a single <pubkeys/> element.</p>
|
||||
<p> Note: Any change to the list of keys requires all keys to be republished. So clients SHOULD take care to request (see third example below) and then include all keys for the JID that were published previously by other clients (unless the keys have expired). <note>The keys are long-term so they will only be republished infrequently.</note></p>
|
||||
<example caption='Entity Publishes Keys to its Server'><![CDATA[
|
||||
<p>Once the publishing node has been created, the entity can update the keys at any time. Each public key MUST be wrapped in a <KeyInfo/> element as specified in &w3xmlsig;. Each <KeyInfo/> element MUST contain a <KeyName/> element with a unique (for the user) name to allow the key to be referenced by other XMPP Extension Protocols.</p>
|
||||
<example caption='Entity Publishes an RSA Key to its Server'><![CDATA[
|
||||
<iq from='juliet@capulet.com/balcony' type='set' id='pub1'>
|
||||
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
|
||||
<publish node='http://jabber.org/protocol/pubkeys'>
|
||||
<item>
|
||||
<pubkeys xmlns='http://jabber.org/protocol/pubkeys'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietRSAkey1</KeyName>
|
||||
<KeyValue>
|
||||
<RSAKeyValue>
|
||||
<Modulus>...</Modulus>
|
||||
<Exponent>AQAB</Exponent>
|
||||
</RSAKeyValue>
|
||||
</KeyValue>
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietDSAkey1</KeyName>
|
||||
<KeyValue>
|
||||
<DSAKeyValue>
|
||||
<P>...</P><Q>...</Q><G>...</G><Y>...</Y>
|
||||
</DSAKeyValue>
|
||||
</KeyValue>
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietX509cert1</KeyName>
|
||||
<X509Data>
|
||||
<X509IssuerSerial>
|
||||
<X509IssuerName>CN=TAMURA Kent, OU=TRL, O=IBM, L=Yamato-shi, ST=Kanagawa, C=JP</X509IssuerName>
|
||||
<X509SerialNumber>12345678</X509SerialNumber>
|
||||
</X509IssuerSerial>
|
||||
<X509SKI>31d97bd7</X509SKI>
|
||||
<X509SubjectName>Subject of Certificate B</X509SubjectName>
|
||||
<X509Certificate>...</X509Certificate>
|
||||
<X509Certificate>...</X509Certificate>
|
||||
<X509Certificate>...</X509Certificate>
|
||||
</X509Data>
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlnss="http://www.w3.org/2000/09/xmldsig#">
|
||||
<KeyName>julietPGPkey1</KeyName>
|
||||
<PGPData>
|
||||
<PGPKeyId>...</PGPKeyId>
|
||||
<PGPKeyPacket>...</PGPKeyPacket>
|
||||
</PGPData>
|
||||
</KeyInfo>
|
||||
</pubkeys>
|
||||
<item id='julietRSAkey1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietRSAkey1</KeyName>
|
||||
<KeyValue>
|
||||
<RSAKeyValue>
|
||||
<Modulus>...</Modulus>
|
||||
<Exponent>AQAB</Exponent>
|
||||
</RSAKeyValue>
|
||||
</KeyValue>
|
||||
</KeyInfo>
|
||||
</item>
|
||||
</publish>
|
||||
</pubsub>
|
||||
</iq>
|
||||
]]></example>
|
||||
<example caption='Subscriber Receives Event with Keys'><![CDATA[
|
||||
<example caption='Entity Publishes a DSA Key to its Server'><![CDATA[
|
||||
<iq from='juliet@capulet.com/balcony' type='set' id='pub2'>
|
||||
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
|
||||
<publish node='http://jabber.org/protocol/pubkeys'>
|
||||
<item id='julietDSAkey1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietDSAkey1</KeyName>
|
||||
<KeyValue>
|
||||
<DSAKeyValue>
|
||||
<P>...</P><Q>...</Q><G>...</G><Y>...</Y>
|
||||
</DSAKeyValue>
|
||||
</KeyValue>
|
||||
</KeyInfo>
|
||||
</item>
|
||||
</publish>
|
||||
</pubsub>
|
||||
</iq>
|
||||
]]></example>
|
||||
<example caption='Entity Publishes an X.509 Certificate to its Server'><![CDATA[
|
||||
<iq from='juliet@capulet.com/balcony' type='set' id='pub3'>
|
||||
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
|
||||
<publish node='http://jabber.org/protocol/pubkeys'>
|
||||
<item id='julietX509cert1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietX509cert1</KeyName>
|
||||
<X509Data>
|
||||
<X509IssuerSerial>
|
||||
<X509IssuerName>CN=TAMURA Kent, OU=TRL, O=IBM, L=Yamato-shi, ST=Kanagawa, C=JP</X509IssuerName>
|
||||
<X509SerialNumber>12345678</X509SerialNumber>
|
||||
</X509IssuerSerial>
|
||||
<X509SKI>31d97bd7</X509SKI>
|
||||
<X509SubjectName>Subject of Certificate B</X509SubjectName>
|
||||
<X509Certificate>...</X509Certificate>
|
||||
<X509Certificate>...</X509Certificate>
|
||||
<X509Certificate>...</X509Certificate>
|
||||
</X509Data>
|
||||
</KeyInfo>
|
||||
</item>
|
||||
</publish>
|
||||
</pubsub>
|
||||
</iq>
|
||||
]]></example>
|
||||
<example caption='Entity Publishes a PGP Key to its Server'><![CDATA[
|
||||
<iq from='juliet@capulet.com/balcony' type='set' id='pub4'>
|
||||
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
|
||||
<publish node='http://jabber.org/protocol/pubkeys'>
|
||||
<item id='julietPGPkey1'>
|
||||
<KeyInfo xmlnss="http://www.w3.org/2000/09/xmldsig#">
|
||||
<KeyName>julietPGPkey1</KeyName>
|
||||
<PGPData>
|
||||
<PGPKeyId>...</PGPKeyId>
|
||||
<PGPKeyPacket>...</PGPKeyPacket>
|
||||
</PGPData>
|
||||
</KeyInfo>
|
||||
</item>
|
||||
</publish>
|
||||
</pubsub>
|
||||
</iq>
|
||||
]]></example>
|
||||
<example caption='Subscriber Receives Event with Key'><![CDATA[
|
||||
<message to='romeo@montague.net/garden' from='juliet@capulet.com' type='headline'>
|
||||
<event xmlns='http://jabber.org/protocol/pubsub#event'>
|
||||
<items node='http://jabber.org/protocol/pubkeys'>
|
||||
<item>
|
||||
<pubkeys xmlns='http://jabber.org/protocol/pubkeys'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietRSAkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietDSAkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietX509cert1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlnss="http://www.w3.org/2000/09/xmldsig#">
|
||||
<KeyName>julietPGPkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
</pubkeys>
|
||||
<item id='julietRSAkey1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietRSAkey1</KeyName>
|
||||
<KeyValue>
|
||||
<RSAKeyValue>
|
||||
<Modulus>...</Modulus>
|
||||
<Exponent>AQAB</Exponent>
|
||||
</RSAKeyValue>
|
||||
</KeyValue>
|
||||
</KeyInfo>
|
||||
</item>
|
||||
</items>
|
||||
</event>
|
||||
|
|
@ -172,25 +199,29 @@
|
|||
id='items1'>
|
||||
<pubsub xmlns='http://jabber.org/protocol/pubsub'>
|
||||
<items node='http://jabber.org/protocol/pubkeys'>
|
||||
<item>
|
||||
<pubkeys xmlns='http://jabber.org/protocol/pubkeys'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietRSAkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietDSAkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietX509cert1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
<KeyInfo xmlnss="http://www.w3.org/2000/09/xmldsig#">
|
||||
<KeyName>julietPGPkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
</pubkeys>
|
||||
<item id='julietRSAkey1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietRSAkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
</item>
|
||||
<item id='julietDSAkey1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietDSAkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
</item>
|
||||
<item id='julietX509cert1'>
|
||||
<KeyInfo xmlns='http://www.w3.org/2000/09/xmldsig#'>
|
||||
<KeyName>julietX509cert1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
</item>
|
||||
<item id='julietPGPkey1'>
|
||||
<KeyInfo xmlnss="http://www.w3.org/2000/09/xmldsig#">
|
||||
<KeyName>julietPGPkey1</KeyName>
|
||||
...
|
||||
</KeyInfo>
|
||||
</item>
|
||||
</items>
|
||||
</pubsub>
|
||||
|
|
@ -241,7 +272,7 @@
|
|||
</section1>
|
||||
|
||||
<section1 topic='Security Considerations' anchor='security'>
|
||||
<p>The reliable association between a user or entity and its public keys is beyond the scope of this document. However, it is RECOMMENDED that each client maintains its own secure library of the public keys (or the "fingerprints" of the keys) it associates with other users (not necessarily JIDs).</p>
|
||||
<p>The reliable association between a user or entity and its public keys is beyond the scope of this document. However, each client SHOULD maintain its own secure library of the public keys (or the "fingerprints" of the keys) it associates with other users (not necessarily JIDs).</p>
|
||||
<p>Whenever public keys are published an identity is typically associated with a JID. Although the public keys are public information, it may be critically important for the user of the JID to keep his identity secret from all but a few specified people. Implementors MUST take great care to ensure the identity of the user of a JID is never divulged to anyone except the entities who have been permitted by the user to access the public key.</p>
|
||||
</section1>
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue