%ents; ]>
Impact of TLS and DNSSEC on Dialback This specification provides documentation how Server Dialback is used together with Transport Layer Security, and discusses how the security considerations of Dialback are changed by the introduction of TLS and/or DNSSEC. &LEGALNOTICE; 0344 Experimental Standards Track Standards Council XMPP Core XEP-0220 dwd 0.1 2014-03-14 editor (mam)

Initial published version approved by the XMPP Council.

 0.0.3 2014-02-28 dwd

Changed title and added more security considerations.

 0.0.2 2013-11-13 dwd

Added some narrative and a section on dwd.

 0.0.1 2013-11-04 ph

First draft.

 &fippo; &dcridland;

Although &xep0220; describes dialback as being run before any other negotiation, it is typically run over TLS where supported. This allows it to be used as a simple convenient fallback to X.509 Strong Authentication within the TLS layer, as described in &rfc6120;, and also affords greater protection to the exchange.

This document describes these practises, and also describes various functionally equivalent shortcuts to the protocol, including that known as "dialback without dialback".

This document will tell a tale of two servers; orchard.capulet.example is trying to contact home.montague.example. Each server operates a single domain; these are capulet.example and montague.example respectively.

The traditional pattern is shown here:

| | (ID D60000229F) | | | | send | capulet.example | dialback key | (as Authoritative | -----(STEP 1)----> | Server) | | ----------------- | | [if necessary, | | | perform DNS | | | lookup on | | | Sender Domain, | | | open TCP | | | connection, | | | and establish | | | stream] | | | -----------------> | | | | | | send | | | verify request | | | ----(STEP 2)-----> | | | | | | send | | | verify response | | | <----(STEP 3)----- | | | | | report | | | dialback result | | | <-----(STEP 4)---- | | ]]>

This traditional pattern involves the following protocol exchanges when dialback over TLS is used:

]]> ]]> ]]> ]]> ]]> ]]> b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3 ]]> b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3 ]]> ]]> ]]>

If during the initial connection, home.montague.example is able to determine that the certificate presented is trustworthy, and authenticates orchard.capulet.example as authorized to offer the XMPP service for capulet.example, then the flow can be shortcutted heavily, allowing the entire Authoritative Server process to be elided.

This is particularly useful in cases where the dialback exchange is a subsequent exchange used in piggybacking, as it remains the only solution for piggybacking with strong authentication.

| | (ID D60000229F) | | | | send | | dialback key | | -----(STEP 1)----> | | | | | [observe certificate | | trustworthy and | | correct for capulet.example | | as per RFC 6125] | | | report | | dialback result | | <-----(STEP 4)---- | ]]>

This traditional pattern involves the following protocol exchanges when dialback over TLS is used:

]]> ]]> ]]> ]]> ]]> ]]>

Note that having authenticated the certificate and found it authorized for capulet.example, montague.example has offered EXTERNAL above. It's not clear why capulet.example does not avail itself of the offer below; however it should be noted that EXTERNAL would not be available with piggybacking for example.

b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3 ]]>

Critically, it is at this point that home.montague.example both authenticates and checks authorization on the certificate, or at least ensure that the certificate presented at this stage matches that presented at the initial handshake.

from='montague.example' to='capulet.example' type='valid'/> ]]>

With respect to XEP-0220's security considerations, the adaptations in this document add at minimum channel encryption and integrity, which forces an attacker into making an active attack, rather than passive eavesdropping. This raises the cost of an attack significantly. However, unless the certificates are authenticated, there is still a man-in-the-middle attack possible, and the reliance on unauthenticated DNS remains problematic.

Use of the "Same Certificate" shortcut described in XXXX is not thought to materially alter the security profile beyond that described above. In particular, it does not alter the level of trust an implementation may put in authentication.

Use of the "Dialback without dialback" shortcut described in XXXX raises the level of authentication to that of the TLS/SASL-EXTERNAL process described in RFC 6120, and is thought to be indistinguishable from a security standpoint. As such, the security considerations relating to this in RFC 6120 et al apply.

If both SRV and A/AAAA records are protected by DNSSEC, this means that the correct address for the peer can be proven, removing DNS forgery as an attack vector. Without TLS, it is however still possible to mount an array of attacks, including IP spoofing and eavesdropping.

With TLS, however, the situation improves. Since TLS protects against a naïve IP spoofing attack, a routing protocol attack (such as BGP hijacking) is required to forge the server.

In addition, it is of critical importance to check the certificate at the time when the dialback result is received, and not only in the initial handshake. This protects against an attack based around renegotiation.

This document requires no interaction with &IANA;.

This document requires no interaction with the XMPP Registrar.