XEP-0344 v0.3 -- Described same-certificate flow.

xep-0344.xml

@@ -21,6 +21,14 @@
   <supersedes/>
   <supersededby/>
   <shortname>dwd</shortname>
+  <revision>
+    <version>0.3</version>
+    <date>2015-03-23</date>
+    <initials>dwd/ph</initials>
+    <remark>
+       <p>Described same-certificate flow.</p>
+    </remark>
+  </revision>
   <revision>
     <version>0.2</version>
     <date>2014-03-19</date>
@@ -68,7 +76,7 @@
   <section2 topic='Dramatis Personae'>
     <p>This document will tell a tale of two servers; orchard.capulet.example is trying to contact home.montague.example. Each server operates a single domain; these are capulet.example and montague.example respectively.</p>
   </section2>
-  <section2 topic='Classic Dialback Flow'>
+  <section2 topic='Classic Dialback Flow' anchor='classic'>
     <p>The traditional pattern is shown here:</p>
   <code><![CDATA[
 orchard.capulet.     home.montague.
@@ -115,7 +123,7 @@ example              example
     | <-----(STEP 4)---- |                    |
   ]]></code>
   </section2>
-  <section2 topic='XMPP Exchanges in Classic Dialback over TLS'>
+  <section2 topic='XMPP Exchanges in Classic Dialback over TLS' anchor='dialback-stanzas'>
     <p>This traditional pattern involves the following protocol exchanges when dialback over TLS is used:</p>
       <example caption="Initiating Server Opens Stream"><![CDATA[
 <stream:stream 
@@ -173,6 +181,7 @@ example              example
   b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
 </db:result>
       ]]></example>
+      <p>The Receiving Server may need to establish a connection to the Authoritative Server at this point.</p>
       <example caption="Receiving Server Sends Verification Request to Authoritative Server (Step 2)"><![CDATA[
 <db:verify
     from='montague.example'
@@ -230,7 +239,7 @@ example              example
     | <-----(STEP 4)---- |
   ]]></code>
   </section2>
-  <section2 topic='XMPP Exchanges in Dialback without dialback'>
+  <section2 topic='XMPP Exchanges in Dialback without dialback' anchor='dwd-stanzas'>
     <p>This traditional pattern involves the following protocol exchanges when dialback over TLS is used:</p>
       <example caption="Initiating Server Opens Stream"><![CDATA[
 <stream:stream 
@@ -301,14 +310,123 @@ example              example
   type='valid'/>
       ]]></example>
   </section2>
+  <section2 topic='Same Certificate shortcut' anchor='samecert'>
+    <p>If during the initial connection, the Receiving Server is unable to determine that the certificate presented is trustworthy but the Authoritative Server presents the same certificate as the Originating Server, the &lt;db:verify/&gt; step can be elided.</p>
+    <p>Note: the Receiving Server MUST still check that the hostname in the certificate matches.</p>
+    <p>Essentially, this replaces the Dialback Key Validation step from &xep0185; with the somewhat more elaborate proof of posession of the private key associated with the certificate.</p>
+  <code><![CDATA[
+orchard.capulet.     home.montague.
+example              example 
+(as Initiating)      (as Receiving
+   Server)              Server)
+----------------     -------------
+    |                    |
+    |  [if necessary,    |
+    |   perform DNS      |
+    |   lookup on        |
+    |   Target Domain,   |
+    |   open TCP         |
+    |   connection,      |
+    |   and establish    |
+    |   stream]          |
+    | -----------------> |
+    |  (ID D60000229F)   |
+    |                    |
+    |      send          |               capulet.example
+    |  dialback key      |             (as Authoritative 
+    | -----(STEP 1)----> |                 Server)
+    |                    |             -----------------
+    |                    |  [if necessary,    |
+    |                    |   perform DNS      |
+    |                    |   lookup on        |
+    |                    |   Sender Domain,   |
+    |                    |   open TCP         |
+    |                    |   connection,      |
+    |                    |   and establish    |
+    |                    |   stream]          |
+    |                    | -----------------> |
+    |                    | [observe certificate is for
+    |                    |  capulet.example and same as
+    |                    |  used by orchard.capulat.example]
+    |      report        |
+    |  dialback result   |
+    | <-----(STEP 4)---- |
+  ]]></code>
+  </section2>
+  <section2 topic='XMPP Exchanges in Same Certifiate shortcut' anchor='samecert-stanzas'>
+    <p>This pattern involves the following protocol exchanges:</p>
+      <example caption="Initiating Server Opens Stream"><![CDATA[
+<stream:stream 
+        xmlns:stream='http://etherx.jabber.org/streams' 
+        xmlns='jabber:server' 
+        from='capulet.example' 
+        to='montague.example' 
+        version='1.0'>
+      ]]></example>
+      <example caption="Receiving Server Responds with a stream header and advertises TLS feature"><![CDATA[
+<stream:stream 
+        xmlns:stream='http://etherx.jabber.org/streams' 
+        xmlns='jabber:server' 
+        id='D60000229F' 
+        from='montague.example' 
+        to='capulet.example'
+        version='1.0'>
+<stream:features>
+  <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
+    <required/>
+  </starttls>
+</stream:features>
+      ]]></example>
+      <example caption="Initiating Server Sends STARTTLS command"><![CDATA[
+<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
+      ]]></example>
+      <example caption="Receiving Server informs Initiating Server to proceed"><![CDATA[
+<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
+      ]]></example>
+      <example caption="Initiating Server Opens Stream"><![CDATA[
+<stream:stream 
+        xmlns:stream='http://etherx.jabber.org/streams' 
+        xmlns='jabber:server' 
+        from='capulet.example' 
+        to='montague.example' 
+        version='1.0'>
+      ]]></example>
+      <example caption="Receiving Server Responds with a stream header"><![CDATA[
+<stream:stream 
+        xmlns:stream='http://etherx.jabber.org/streams' 
+        xmlns='jabber:server' 
+        id='D60000229F' 
+        from='montague.example' 
+        to='capulet.example'
+        version='1.0'>
+<stream:features>
+  <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
+  </mechanisms>
+</stream:features>
+      ]]></example>
+      <example caption="Initiating Server Sends Dialback Key (Step 1)"><![CDATA[
+<db:result
+    from='capulet.example'
+    to='montague.example'>
+  b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
+</db:result>
+      ]]></example>
+      <p>The Receiving Server may need to establish a connection to the Authoritative Server at this point. Here we assume that this connection is using TLS and the certificate presented by the Authoritative Server is the same as the one used by the Originating Server and contains the domain name claimed by the Originating Server.</p>
+      <example caption="Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)"><![CDATA[
+<db:result
+  from='montague.example'
+  to='capulet.example'
+  type='valid'/>
+      ]]></example>
+  </section2>
 </section1>
 <section1 topic='Security Considerations' anchor='security'>
   <p>With respect to <strong>XEP-0220</strong>'s security considerations, the adaptations in this document add at minimum channel encryption and integrity, which forces an attacker into making an active attack, rather than passive eavesdropping. This raises the cost of an attack significantly. However, unless the certificates are authenticated, there is still a man-in-the-middle attack possible, and the reliance on unauthenticated DNS remains problematic.</p>
-  <section2 topic='Same Certificate shortcut'>
-  <p>Use of the "Same Certificate" shortcut described in XXXX is not thought to materially alter the security profile beyond that described above. In particular, it does not alter the level of trust an implementation may put in authentication.</p>
-  </section2>
   <section2 topic='Dialback without dialback shortcut'>
-  <p>Use of the "Dialback without dialback" shortcut described in XXXX raises the level of authentication to that of the TLS/SASL-EXTERNAL process described in <strong>RFC 6120</strong>, and is thought to be indistinguishable from a security standpoint. As such, the security considerations relating to this in <strong>RFC 6120</strong> et al apply.</p>
+  <p>Use of the "Dialback without dialback" shortcut described in section 2.4 raises the level of authentication to that of the TLS/SASL-EXTERNAL process described in <strong>RFC 6120</strong>, and is thought to be indistinguishable from a security standpoint. As such, the security considerations relating to this in <strong>RFC 6120</strong> et al apply.</p>
+  </section2>
+  <section2 topic='Same Certificate shortcut'>
+  <p>Use of the "Same Certificate" shortcut described in section 2.6 is not thought to materially alter the security profile beyond that described above. In particular, it does not alter the level of trust an implementation may put in authentication.</p>
   </section2>
   <section2 topic="DNSSEC">
     <p>If both SRV and A/AAAA records are protected by DNSSEC, this means that the correct address for the peer can be proven, removing DNS forgery as an attack vector. Without TLS, it is however still possible to mount an array of attacks, including IP spoofing and eavesdropping.</p>