There is a number of different end-to-end encryption mechanisms that can be used to secure user communication against unauthorized access from malicious third parties. Popular examples for this are &xep0384; and &xep0373;.

While the latter allows for encryption of arbitrary extension elements, protocols such as &xep0384; are limited to only encrypt the body of a message. This approach is not very flexible and prevents the combined usage with XMPP extension protocols such as &xep0385; or &xep0308; as their extension elements cannot be included in the encrypted part of the message, therefore leaking information about the message content.

This extension protocol proposes a solution to aforementioned issues by generalizing the OpenPGP Content Elements (eg. <signcrypt>) introduced by &xep0373; for the use with other encryption protocols.

This proposal widens the scope of the security guarantees given by the used encryption mechanism from just the body of the message to various extension elements. It is intended to serve as a "one size fits all" solution for extension element encryption in XMPP.

In order to achieve its goal, Stanza Content Encryption does the following:

• Define elements that hold sensitive information
• Speficy rules about how extension elements are encrypted and embedded in the message
• Specify rules about which elements are allowed inside and outside the protected domain

Envelope Element &envelope;

An XMPP extension element which is used to hold the &content; element and the affix elements. The XML representation of this element is encrypted and then embedded as the payload of the message being sent.

Content Element &content;

An element which is used to contain all extension elements which need to be encrypted.

In order to prevent certain attacks, different affix elements MAY be added as direct child elements of the &envelope; element.

Encryption protocols that make use of Stanza Content Encryption MUST define their own profiles that describe mandatory behaviour of which of these elements are used. They MAY also define and add their own specific affix elements.

Some end-to-end encryption protocols like &xep0384; are historically limited to encryption of the message body only. This approach excludes other extension elements from the protected domain of the payload element, exposing them to potential attackers.

The example above obviously leaks information about the communication through the unencrypted OOB extension element.

Most end-to-end encryption mechanisms are also focussed solely on message content encryption and do not tackle <iq/> requests/replies at all. Stanza Content Encryption can be applied to those as well.

In order to send an encrypted message without leaking extension elements, the sender prepares the message by placing the sensitive extension elements inside a &content; element and that inside an &envelope; element.

Depending on the encryption-specific SCE-profile, some affix elements are added as child elements of the &envelope; element.

The &envelope; element is then serialized into XML and encrypted using the SCE-specific profile of the encryption mechanism in place. The result is appended to the message.

Since the outer message element does not contain a <body/> element the sender appends an unencrypted <store/> hint as specified in &xep0334;.

The message can then be sent to the recipient.

The recipient of the message decrypts its encrypted payload. The result is the &envelope; element containing the &content; element and the affix elements as direct child elements. Depending on the affix profiles specified by the used encryption protocol, the affix elements are verified to prevent certain attacks from taking place.

Afterwards, the extension elements inside the &content; element are checked against the permitted list and any disallowed elements are discarded.

As a last step, the original unencrypted stanza is recreated by replacing the &envelope; element of the stanza with the elements inside of the &content; element.

There are certain extension elements which are required to be available to the server in order to do message routing and processing. Additionally there are some elements that MUST be filtered by the server. Allowing for those elements to be included in, and parsed from the encrypted payload would allow a malicious client to perform a number of attacks.

Contrary to this, other elements are considered sensitive and MUST NOT be available in plaintext outside the &envelope; element.

It is hard to come up with a complete list of exceptional elements at this point, as there is no practical implementation experience.

Below is a non-exhaustive list of elements that are definitely forbidden inside the &envelope; element and permitted as direct child elements of the message.

Unencrypted &envelope; elements are NOT ALLOWED as child elements of the stanza and MUST be dropped.

Elements in the &content; element MUST be identified using an element name and namespace. Notably the <body/> element MUST contain a valid namespace (i.e. "jabber:client").

The recipient MUST verify that the decrypted &envelope; element contains valid XML before processing it any further. Invalid XML must be rejected.

After verifying the integrity of the &envelope; element, the recipient needs to make sure that no server-processed elements are found inside of it. Any forbidden elements MUST be dropped before the message is processed any further.

Furthermore the receiving client MUST ignore any extension elements considered as sensitive which are found outside of the &envelope; element, especially as direct unencrypted child elements of the enclosing stanza.

Since a chat message encrypted with SCE MUST NOT contain a <body/> element, it is not eligible for MAM message storage (&xep0313;). Therefore sending entities MUST append an unencrypted &xep0334; <store/> hint as a direct child element to the message.

As a first, naïve approach a recipient of a message containing an &envelope; element could simply reinject the reassambled unencrypted stanza into the XML stream. This might introduce some security issues. Most notably, depending on the clients implementation it may become ambiguous which elements were received end-to-end encrypted and which were received unencrypted.

Implementations should rather handle encrypted elements explicitly.

For the sake of simplicity, the examples in this document are not encrypted. A real-world implementation MUST make use of real cryptographic protocols.

TODO: Maybe the Registrar should handle a list of elements that are forbidden as child elements of the &content; element?

TODO.

Big thanks to the authors of &xep0373; (Florian Schmaus, Dominik Schürmann and Vincent Breitmoser) which heavily inspired the idea of this protocol.

Also thanks to Marvin Wißfeld, Tim Henkes, Daniel Gultsch, Melvin Keskin and Andreas Straub for their feedback.