mirror of
https://github.com/moparisthebest/xeps
synced 2024-11-25 10:42:19 -05:00
c091b4c77d
git-svn-id: file:///home/ksmith/gitmigration/svn/xmpp/trunk@425 4b5297f7-1745-476d-ba37-a9c6900126ab
293 lines
12 KiB
XML
293 lines
12 KiB
XML
<?xml version='1.0' encoding='UTF-8'?>
|
|
<!DOCTYPE xep SYSTEM 'xep.dtd' [
|
|
<!ENTITY % ents SYSTEM 'xep.ent'>
|
|
%ents;
|
|
]>
|
|
<?xml-stylesheet type='text/xsl' href='xep.xsl'?>
|
|
<xep>
|
|
<header>
|
|
<title>Dialback Key Generation and Validation</title>
|
|
<abstract>This document provides a recommended method for generating and validating the keys used in the XMPP server dialback protocol.</abstract>
|
|
&LEGALNOTICE;
|
|
<number>0185</number>
|
|
<status>Proposed</status>
|
|
<type>Informational</type>
|
|
<sig>Standards</sig>
|
|
<approver>Council</approver>
|
|
<dependencies>
|
|
<spec>XMPP Core</spec>
|
|
</dependencies>
|
|
<supersedes/>
|
|
<supersededby/>
|
|
<shortname>N/A</shortname>
|
|
<author>
|
|
<firstname>Philipp</firstname>
|
|
<surname>Hancke</surname>
|
|
<email>fippo@goodadvice.pages.de</email>
|
|
<jid>fippo@goodadvice.pages.de</jid>
|
|
</author>
|
|
<revision>
|
|
<version>0.3</version>
|
|
<initials>ph</initials>
|
|
<date>2006-11-01</date>
|
|
<remark><p>Recommended hashing the secret to satisfy length requirement; hostnames and Stream ID should be separated by spaces to avoid ambiguity; updated example to match rfc3920bis.</p>
|
|
</remark>
|
|
</revision>
|
|
<revision>
|
|
<version>0.2</version>
|
|
<initials>ph</initials>
|
|
<date>2006-05-10</date>
|
|
<remark>
|
|
<p>Clarified and corrected roles of originating and receiving servers; updated recommendation and main example to use HMAC-SHA256 for key generation.</p>
|
|
</remark>
|
|
</revision>
|
|
<revision>
|
|
<version>0.1</version>
|
|
<date>2006-04-11</date>
|
|
<initials>psa</initials>
|
|
<remark><p>Initial version.</p></remark>
|
|
</revision>
|
|
<revision>
|
|
<version>0.0.1</version>
|
|
<date>2006-03-30</date>
|
|
<initials>ph</initials>
|
|
<remark><p>First draft.</p></remark>
|
|
</revision>
|
|
</header>
|
|
<section1 topic='Introduction' anchor='intro'>
|
|
&RFC3920BISNOTE;
|
|
<p><cite>RFC 3920</cite> does not specify in detail how to generate the keys used in the server dialback protocol, and why each of the variables used in key generation is crucial for security. This document is provided for discussion purposes and aims at clarifying the key generation and its validation mechanism and to show common attacks on weak mechanisms. It is not meant to supersede the text in <cite>RFC 3920</cite>; however, the recommendations in this document have been incorporated into <cite>rfc3920bis</cite>.</p>
|
|
</section1>
|
|
<section1 topic='Dialback Explained'>
|
|
<p>The Originating Server, which generates the dialback key, and the Authoritative Server, which validates the dialback key, may reside on different hosts or be running in separate processes. The method used in key generation and validation should not require interactive communication between Originating Server, Authoritative Server and optionally a third party like a database.</p>
|
|
<p>The key is generated based on:</p>
|
|
<ul>
|
|
<li>the (hostname of) Originating Server,</li>
|
|
<li>the (hostname of) Receiving Server,</li>
|
|
<li>the Stream ID,</li>
|
|
<li>and a secret known by the Authoritative Server's network.</li>
|
|
</ul>
|
|
<p>The last item, a shared secret known to Originating Server and Authoritative Server, is used in a Keyed-Hash Message Authentication Code (HMAC) to generate and validate the dialback keys. This key must either be set up in a configuration option for each host or process, or generated as a random string when starting the server.</p>
|
|
<p>&nistfips198a; recommends that the length of the key should be at least half the size of the hash function output. To fulfill this requirement, the secret SHOULD be hashed with the hash function prior to usage as a key in HMAC.</p>
|
|
<p>The Stream ID and the involved hostnames should be concatenated with a unicode space character (U+0020) for the delimiter.</p>
|
|
<code>
|
|
key = HMAC-SHA256
|
|
(
|
|
SHA256(Secret),
|
|
{
|
|
Receiving Server, ' ',
|
|
Originating or Authoritative server, ' ',
|
|
Stream ID
|
|
}
|
|
)
|
|
</code>
|
|
<p>To avoid encoding problems, the digest algorithm output MUST be provided in the hexadecimal representation.</p>
|
|
</section1>
|
|
<section1 topic='Key Generation and Validation'>
|
|
<p>This document closely follows the description of the dialback protocol in <cite>RFC 3920</cite>, but omits steps that are not important for the generation and validation of the dialback keys. For ease of comparison the numbering of the steps is the same as in section 8.3 of <cite>RFC 3920</cite>. Any line breaks in the examples are included for the purpose of readability only.</p>
|
|
<p>The following data values are used in the examples:</p>
|
|
<table caption='Data Used in Examples'>
|
|
<tr>
|
|
<td>Originating Server</td>
|
|
<td>example.org</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Authoritative Server</td>
|
|
<td>example.org</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Receiving Server</td>
|
|
<td>xmpp.example.com</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Secret</td>
|
|
<td>s3cr3tf0rd14lb4ck</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Stream ID</td>
|
|
<td>D60000229F</td>
|
|
</tr>
|
|
</table>
|
|
<p>3. Receiving Server sends a stream header back to the Originating Server, including a unique ID for this interaction:</p>
|
|
<code><![CDATA[
|
|
<stream:stream
|
|
xmlns:stream='http://etherx.jabber.org/streams'
|
|
xmlns='jabber:server'
|
|
xmlns:db='jabber:server:dialback'
|
|
to='xmpp.example.com'
|
|
from='example.org'
|
|
id='D60000229F'>
|
|
]]></code>
|
|
<p>The Originating Server now generates a dialback key to be sent to the Receiving Server:</p>
|
|
<code>
|
|
key = HMAC-SHA256(
|
|
SHA256(secret),
|
|
{ Receiving server, ' ', Originating server, ' ', Stream ID}
|
|
)
|
|
= HMAC-SHA256(
|
|
SHA256('s3cr3tf0rd14lb4ck'),
|
|
{ 'xmpp.example.com', ' ', 'example.org', ' ', 'D60000229F' }
|
|
)
|
|
= HMAC-SHA256(
|
|
'a7136eb1f46c9ef18c5e78c36ca257067c69b3d518285f0b18a96c33beae9acc',
|
|
'xmpp.example.com example.org D60000229F'
|
|
)
|
|
= '37c69b1cf07a3f67c04a5ef5902fa5114f2c76fe4a2686482ba5b89323075643'
|
|
</code>
|
|
<p>4. The Originating Server sends the generated dialback key to the Receiving Server:</p>
|
|
<code><![CDATA[
|
|
<db:result
|
|
to='xmpp.example.com'
|
|
from='example.org'>
|
|
37c69b1cf07a3f67c04a5ef5902fa5114f2c76fe4a2686482ba5b89323075643
|
|
</db:result>
|
|
]]></code>
|
|
<p>8. The Receiving Server sends the Authoritative Server a request for verification of the key:</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='example.org'
|
|
from='xmpp.example.com'
|
|
id='D60000229F'>
|
|
37c69b1cf07a3f67c04a5ef5902fa5114f2c76fe4a2686482ba5b89323075643
|
|
</db:verify>
|
|
]]></code>
|
|
<p>The Authoritative Server calculates the valid key for this verify request, using data supplied in the packet and the secret shared with the Originating Server.</p>
|
|
<code>
|
|
key = HMAC-SHA256(
|
|
SHA256(secret),
|
|
{ Receiving Server, ' ', Authoritative Server, ' ', Stream ID }
|
|
)
|
|
= HMAC-SHA256(
|
|
SHA256('s3cr3tf0rd14lb4ck'),
|
|
{ 'xmpp.example.com', ' ', 'example.org', ' ', 'D60000229F' }
|
|
)
|
|
= HMAC-SHA256(
|
|
'a7136eb1f46c9ef18c5e78c36ca257067c69b3d518285f0b18a96c33beae9acc',
|
|
'xmpp.example.com example.org D60000229F'
|
|
)
|
|
= '37c69b1cf07a3f67c04a5ef5902fa5114f2c76fe4a2686482ba5b89323075643'
|
|
</code>
|
|
<p>9. The Authoritative Server compares this value to the key contained in the verification requests and informs the Originating Server of the result, in our example a success:</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='xmpp.example.com'
|
|
from='example.org'
|
|
id='D60000229F'
|
|
type='valid'/>
|
|
]]></code>
|
|
</section1>
|
|
<section1 topic='Attacks Against Key Generation Methods'>
|
|
<p>This section contains attack scenarios that illustrate why each of the factors used in key generation is important.</p>
|
|
<p>An attacker will assume the role of the Originating Server and try to send a dialback key that the Authoritative Server acknowledges as valid. If this is successful, the attacker is allowed to send packets for the hostname of the Authoritative Server.</p>
|
|
<p>In each subsection, the example hash method, which uses the (compromised and NOT RECOMMENDED) SHA1 algorithm as described in &rfc3174; for simplicity, ignores one of the variables,</p>
|
|
<ul>
|
|
<li>Originating Server,</li>
|
|
<li>Stream ID,</li>
|
|
<li>Receiving Server,</li>
|
|
<li>or Secret,</li>
|
|
</ul>
|
|
<p>and it is shown how an attacker might exploit this behavior to get a valid result from the Authoritative Server.</p>
|
|
<section2 topic='Hostname of Originating Server Not Considered'>
|
|
<p>This subsection demonstrates what can happen if the key generation method ignores the hostname of the Originating Server, e.g. for the hash function</p>
|
|
<code>
|
|
key = SHA1({ Secret, Receiving Server, Stream ID })
|
|
</code>
|
|
<p>The dialback keys generated for the originating domains 'example.org' and 'xmpp.example.com' are the same, which might disclose that the secret used to generate the keys for these domains is equal. An attacker cannot exploit this any further.</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='example.org'
|
|
from='xmpp.example.com'
|
|
id='D60000229F'>
|
|
22f8a639f5864d851556c566f52683ac3790bd35
|
|
</db:verify>
|
|
]]></code>
|
|
<p>This key is generated using:</p>
|
|
<code>
|
|
SHA1('s3cr3tf0rd14lb4ckxmpp.example.comD60000229F') =
|
|
'22f8a639f5864d851556c566f52683ac3790bd35'
|
|
</code>
|
|
</section2>
|
|
<section2 topic='Stream ID Not Considered'>
|
|
<p>This subsection demonstrates a replay attack that is possible if the key generation method ignores the Stream ID, e.g. for the hash function</p>
|
|
<code>
|
|
key = SHA1({ Secret, Receiving Server, Originating Server })
|
|
</code>
|
|
<p>If the attacker is able to obtain a single valid dialback key exchanged between the two domains, this key can be used to validate any stream.</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='example.org'
|
|
from='xmpp.example.com'
|
|
id='D60000229F'>
|
|
7c39e9cbd28b63676c1ae74e9b98ac229c611cfc
|
|
</db:verify>
|
|
]]></code>
|
|
<p>This key is generated using the empty string instead of the id:</p>
|
|
<code>
|
|
SHA1('s3cr3tf0rd14lb4ckxmpp.example.comexample.org') =
|
|
'7c39e9cbd28b63676c1ae74e9b98ac229c611cfc'
|
|
</code>
|
|
<p>This key is also valid for</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='example.org'
|
|
from='xmpp.example.com'
|
|
id='anyidyouwant'>
|
|
7c39e9cbd28b63676c1ae74e9b98ac229c611cfc
|
|
</db:verify>
|
|
]]></code>
|
|
</section2>
|
|
<section2 topic='Hostname of the Receiving Server Not Considered'>
|
|
<p>This subsection demonstrates against a key generation method that ignores the hostname of the receiving server, e.g. for the hash function</p>
|
|
<code>
|
|
key = SHA1({ Secret, Originating Server, Stream ID })
|
|
</code>
|
|
<p>The attacker can use a dialback key and stream ID we have sent to a domain under his control.</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='example.org'
|
|
from='xmpp.example.com'
|
|
id='D60000229F'>
|
|
ffe5f8139d3eee683068de52481ae61a131e7025
|
|
</db:verify>
|
|
]]></code>
|
|
<p>This key is generated using:</p>
|
|
<code>
|
|
SHA1('s3cr3tf0rd14lb4ckexample.orgD60000229F') =
|
|
'ffe5f8139d3eee683068de52481ae61a131e7025'
|
|
</code>
|
|
</section2>
|
|
<section2 topic='Shared Secret Not Considered'>
|
|
<p>If the key generation method does not take into account a shared secret in the Authoritative Servers network or if this secret is disclosed and the key generation method is known, an attacker can generate valid dialback keys.</p>
|
|
<code>
|
|
key = SHA1({ Receiving Server, Originating Server, Stream ID })
|
|
</code>
|
|
<p>In both cases the attacker is able to generate an arbitrary number of dialback keys.</p>
|
|
<code><![CDATA[
|
|
<db:verify
|
|
to='example.org'
|
|
from='xmpp.example.com'
|
|
id='D60000229F'>
|
|
65d94be830a9cba41edb50b6f6ec72a89754a2a5
|
|
</db:verify>
|
|
]]></code>
|
|
<p>This key is generated using:</p>
|
|
<code>
|
|
SHA1('xmpp.example.comexample.orgD60000229F') =
|
|
'65d94be830a9cba41edb50b6f6ec72a89754a2a5'
|
|
</code>
|
|
</section2>
|
|
</section1>
|
|
<section1 topic='Security Considerations' anchor='security'>
|
|
<p>This document introduces no security considerations or concerns above and beyond those discussed in <cite>RFC 3920</cite>, but describes what might happen if the security considerations are ignored.</p>
|
|
</section1>
|
|
<section1 topic='IANA Considerations' anchor='iana'>
|
|
<p>This document requires no interaction with &IANA;.</p>
|
|
</section1>
|
|
<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
|
|
<p>This document requires no interaction with the ®ISTRAR;.</p>
|
|
</section1>
|
|
<section1 topic='Acknowledgements' anchor='ack'>
|
|
<p>Thanks to Ian Paterson and Matthias Wimmer for their feedback.</p>
|
|
</section1>
|
|
</xep>
|