This document will tell a tale of two servers; orchard.capulet.example is trying to contact home.montague.example. Each server operates a single domain; these are capulet.example and montague.example respectively.

The traditional pattern is shown here:

This traditional pattern involves the following protocol exchanges when dialback over TLS is used:

The Receiving Server may need to establish a connection to the Authoritative Server at this point.

If during the initial connection, home.montague.example is able to determine that the certificate presented is trustworthy, and authenticates orchard.capulet.example as authorized to offer the XMPP service for capulet.example, then the flow can be shortcutted heavily, allowing the entire Authoritative Server process to be elided.

This is particularly useful in cases where the dialback exchange is a subsequent exchange used in piggybacking, as it remains the only solution for piggybacking with strong authentication.

This traditional pattern involves the following protocol exchanges when dialback over TLS is used:

Note that having authenticated the certificate and found it authorized for capulet.example, montague.example has offered EXTERNAL above. It's not clear why capulet.example does not avail itself of the offer below; however it should be noted that EXTERNAL would not be available with piggybacking for example.

Critically, it is at this point that home.montague.example both authenticates and checks authorization on the certificate, or at least ensure that the certificate presented at this stage matches that presented at the initial handshake.

If during the initial connection, the Receiving Server is unable to determine that the certificate presented is trustworthy but the Authoritative Server presents the same certificate as the Originating Server, the <db:verify/> step can be elided.

Note: the Receiving Server MUST still check that the hostname in the certificate matches.

Essentially, this replaces the Dialback Key Validation step from &xep0185; with the somewhat more elaborate proof of posession of the private key associated with the certificate.

This pattern involves the following protocol exchanges:

The Receiving Server may need to establish a connection to the Authoritative Server at this point. Here we assume that this connection is using TLS and the certificate presented by the Authoritative Server is the same as the one used by the Originating Server and contains the domain name claimed by the Originating Server.

Use of the "Dialback without dialback" shortcut described in section 2.4 raises the level of authentication to that of the TLS/SASL-EXTERNAL process described in RFC 6120, and is thought to be indistinguishable from a security standpoint. As such, the security considerations relating to this in RFC 6120 et al apply.

Use of the "Same Certificate" shortcut described in section 2.6 is not thought to materially alter the security profile beyond that described above. In particular, it does not alter the level of trust an implementation may put in authentication.

If both SRV and A/AAAA records are protected by DNSSEC, this means that the correct address for the peer can be proven, removing DNS forgery as an attack vector. Without TLS, it is however still possible to mount an array of attacks, including IP spoofing and eavesdropping.

With TLS, however, the situation improves. Since TLS protects against a naïve IP spoofing attack, a routing protocol attack (such as BGP hijacking) is required to forge the server.