You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

342 lines

  1. <?xml version='1.0' encoding='UTF-8'?>
  2. <!DOCTYPE xep SYSTEM 'xep.dtd' [
  3. <!ENTITY % ents SYSTEM 'xep.ent'>
  4. <!ENTITY BASE64 "<span class='ref'><link url=''>BASE64</link></span> <note>RFC 4648: The Base16, Base32, and Base64 Data &lt;<link url=''></link>&gt;.</note>" >
  5. <!ENTITY DATETIME "<span class='ref'><link url=''>DATETIME</link></span> <note>RFC 3339: Date and Time on the Internet Timestamps &lt;<link url=''></link>&gt;.</note>" >
  6. <!ENTITY XMLDSIG "<span class='ref'><link url=''>XMLDSIG</link></span> <note>XML Signature Syntax and Processing, W3C Recommendation, 10 June 2008 &lt;<link url=''></link>&gt;.</note>" >
  7. <!ENTITY E2EEncrypt "<span class='ref'><link url=''>E2EEncrypt</link></span> <note>End-to-End Object Encryption for the Extensible Messaging and Presence Protocol (XMPP), Miller, M. and P. Saint-Andre, work in progress &lt;<link url=''></link>&gt;.</note>" >
  8. %ents;
  9. ]>
  10. <?xml-stylesheet type='text/xsl' href='xep.xsl'?>
  11. <xep>
  12. <header>
  13. <title>Encapsulating Digital Signatures in XMPP</title>
  14. <abstract>This document provides a technical specification for Encapsulating Digital Signatures
  15. in the Extensible Messaging and Presence Protocol (XMPP).</abstract> &LEGALNOTICE;
  16. <number>0285</number>
  17. <status>Deferred</status>
  18. <type>Standards Track</type>
  19. <sig>Standards</sig>
  20. <approver>Council</approver>
  21. <dependencies>
  22. <spec>XMPP Core</spec>
  23. <spec>XEP-0001</spec>
  24. </dependencies>
  25. <supersedes/>
  26. <supersededby/>
  27. <shortname>N/A</shortname>
  28. &kdz;
  29. <revision>
  30. <version>0.3</version>
  31. <date>2011-01-12</date>
  32. <initials>kdz</initials>
  33. <remark><p>Change title, and clarify in text, that this is an encapulating digital
  34. signature approach, an alternative to the encapulated digitial signatures proposal.</p></remark>
  35. </revision>
  36. <revision>
  37. <version>0.2</version>
  38. <date>2010-09-29</date>
  39. <initials>kdz</initials>
  40. <remark><p>Minor changes (editorial, cleanup, etc.).</p></remark>
  41. </revision>
  42. <revision>
  43. <version>0.1</version>
  44. <date>2010-09-15</date>
  45. <initials>psa</initials>
  46. <remark><p>Initial published version.</p></remark>
  47. </revision>
  48. <revision>
  49. <version>0.0.1</version>
  50. <date>2010-03-10</date>
  51. <initials>kdz</initials>
  52. <remark>
  53. <p>Proto-XEP draft.</p>
  54. </remark>
  55. </revision>
  56. </header>
  57. <section1 topic="Introduction" anchor="intro">
  58. <p class='box'><em>This document is one of two proposals for digital signatures in XMPP. It is expected
  59. that only one of these proposals be progressed beyond Experimental on the Standards Track.</em></p>
  60. <p>This document provides a technical specification for Digital Signatures in Extensible
  61. Messaging and Presence Protocol (&xmpp;) based upon End-to-End Object Encryption
  62. (&E2EEncrypt;) "work in progress".</p>
  63. <p>The S/MIME approach defined in &rfc3923; has never been implemented in XMPP clients to the
  64. best of our knowledge, but has some attractive features, especially the ability to
  65. store-and-forward a signed message at a user's server if the user is not online when the
  66. message is received (in the XMPP community this is called "offline storage" and the message is
  67. referred to as an "offline message"). The authors surmise that RFC 3923 has not been
  68. implemented mainly because it adds several new dependencies to XMPP clients, especially MIME
  69. (along with the CPIM and MSGFMT media types).</p>
  70. <p>This document explores the possibility of an approach that is similar to but simpler than
  71. RFC 3923. Like the approach detailed in RFC 3923, the approach utilizes encapsulating
  72. digital signatures.</p>
  73. <p>Like other encapsulating signature approaches (e.g., &xep0027;), this approach does not
  74. support <em>optimistic signing</em>.</p>
  75. </section1>
  76. <section1 topic="Signing XMPP Stanzas" anchor="stanza">
  77. <p>The process that a sending agent follows for securing stanzas is very similar regardless of
  78. the form of stanza (i.e., &lt;iq/&gt;, &lt;message/&gt;, or &lt;presence/&gt;).</p>
  79. <ol>
  80. <li>Constructs a cleartext version of the stanza, S.</li>
  81. <li>Notes the current UTC date and time N when this stanza is constructed, formatted as
  82. described in Section 5.</li>
  83. <li>Converts the stanza to a UTF-8, as defined by &rfc3629;, encoded string, optionally
  84. removing line breaks and other insignificant whitespace between elements and attributes,
  85. i.e., UTF8-encode(S) = S'. We call S' a "stanza-string" because for purposes of signing and
  86. verification it is treated not as XML but as an opaque string (this avoids the need for
  87. complex canonicalization of the XML input).</li>
  88. <li>Constructs a plaintext envelope (E) &lt;plain/&gt; qualified by the "urn:xmpp:signed:0"
  89. namespace as follows: <ul>
  90. <li>The attribute 'timestamp' set to the UTC date and time value N</li>
  91. <li>The XML character data set to the base64-encoded form of S' (where the encoding
  92. adheres to the definition in Section 4 of &BASE64; and where the padding bits are set to
  93. zero). This encoding is necessary to preserve a canonicalized form of S'.</li>
  94. </ul>
  95. </li>
  96. <li>Converts the envelope (E) to a UTF-8 encoded string, optionally removing line breaks and
  97. other insignificant whitespace between elements and attributes, i.e., E' =
  98. UTF8-encode(E).</li>
  99. <li>Produce a signature of UTF8-encoded envelope (E') using the intended signature algorithm.
  100. T = signature(E'). (This step is underspecified and will be expanded upon in later revision
  101. of this document.)</li>
  102. <li>Base64-encodes T to produce the signature data T'.</li>
  103. <li>Constructs an &lt;signed/&gt; element qualified by the "urn:xmpp:signed:0" namespace as
  104. follows: <ul>
  105. <li>The child element &lt;signature&gt; (implicitly qualified by the "urn:xmpp:signed:0"
  106. namespace) as follows: <ul>
  107. <li>The attribute 'algorithm' set to a string identifying the signature algorithm
  108. used.</li>
  109. <li>The XML character data T'.</li>
  110. </ul></li>
  111. <li>The child element &lt;data&gt; (implicitly qualified by the "urn:xmpp:signed:0"
  112. namespace) as follows: <ul>
  113. <li>The XML character data E'.</li>
  114. </ul>
  115. </li>
  116. </ul>
  117. </li>
  118. <li>Sends the &lt;signed&gt; element as the payload of a stanza that SHOULD match the stanza
  119. from step 1 in kind (e.g., &lt;message/&gt;), type (e.g., "chat"), and addressing (e.g.
  120. to="" from=""). If the original stanza (S) has a
  121. value for the "id" attribute, this stanza MUST NOT use the same value for its "id"
  122. attribute.</li>
  123. </ol>
  124. <section2 topic="Example of Signing Messages" anchor="ex-message">
  125. <p>The sender begins with the cleartext version of the &lt;message/&gt; stanza "S":</p>
  126. <example><![CDATA[
  127. <message xmlns='jabber:client'
  128. from=''
  129. id='183ef129'
  130. to=''
  131. type='chat'>
  132. <thread>8996aef0-061d-012d-347a-549a200771aa</thread>
  133. <body>Wherefore art thou, Romeo?</body>
  134. </message>
  135. ]]></example>
  136. <p>The sender then performs the steps 1 through 4 from above to generate:</p>
  137. <example><![CDATA[
  138. <plain xmlns="urn:xmpp:signed:0"
  139. timestamp="2010-06-29T02:15:21.012Z">
  140. PG1lc3NhZ2UgeG1sbnM9ImphYmJlcjpjbGllbnQiIGZyb209Imp1bGlldEBjYXB
  141. 1bGV0Lm5ldC9iYWxjb255IiB0bz0icm9tZW9AbW9udGVndWUubmV0IiB0eXBlPS
  142. JjaGF0Ij48dGhyZWFkPmM2MzczODI0LWEzMDctNDBkZC04ZmUwLWJhZDZlNzI5O
  143. WFkMDwvdGhyZWFkPjxib2R5PldoZXJlZm9yZSBhcnQgdGhvdSwgUm9tZW8/PC9i
  144. b2R5PjwvbWVzc2FnZT4=
  145. </plain>
  146. ]]></example>
  147. <p>And then performs steps 5 through 9 steps, causing the following to be sent:</p>
  148. <example><![CDATA[
  149. <message xmlns='jabber:client'
  150. from=''
  151. id='6410ed123'
  152. to=''
  153. type='chat'>
  154. <signed xmlns="urn:xmpp:signed:0">
  155. <signature algorithm="RSA-SHA1">
  156. DxbxIziY1C1Ytcxkj0IFLsfmDLMv96JMlMAQZ7jh49IbsOIPsxI2LyLmqhKH/994UXDJKQLHvLJz
  157. gAmw8V2b+zmyZeItJzSmB+HHiLFVXkD2Dd4JfetsafsfIcB7uNWg0gAeiKrTHfFgiyEC/2WxwOj3
  158. JUMRyQ9ykEPIzS0GZ/k=
  159. </signature>
  160. <data>
  161. PHBsYWluIHhtbG5zPSJ1cm46eG1wcDpzaWduZWQ6MCIgdGltZXN0YW1wPSIyMDEwLTA2LTI5VDAy
  162. OjE1OjIxLjAxMloiPgogIFBHMWxjM05oWjJVZ2VHMXNibk05SW1waFltSmxjanBqYkdsbGJuUWlJ
  163. R1p5YjIwOUltcDFiR2xsZEVCallYQgogIDFiR1YwTG01bGRDOWlZV3hqYjI1NUlpQjBiejBpY205
  165. emN6T0RJMExXRXpNRGN0TkRCa1pDMDRabVV3TFdKaFpEWmxOekk1TwogIFdGa01Ed3ZkR2h5WldG
  166. a1BqeGliMlI1UGxkb1pYSmxabTl5WlNCaGNuUWdkR2h2ZFN3Z1VtOXRaVzgvUEM5aQogIGIyUjVQ
  167. and2YldWemMyRm5aVDQ9CjwvcGxhaW4+Cg==
  168. </data>
  169. </signed>
  170. </message>
  171. ]]></example>
  172. </section2>
  173. <section2 topic="Example of Securing IQs" anchor="ex-iq">
  174. <p>To be added....</p>
  175. </section2>
  176. </section1>
  177. <section1 topic="Interaction with Stanza Semantics" anchor="interact">
  178. <p>The following limitations and caveats apply:</p>
  179. <ul>
  180. <li>Undirected &lt;presence/&gt; stanzas SHOULD NOT be signed.</li>
  181. <li>Stanzas directed to multiplexing services (e.g. multi-user chat) SHOULD NOT be signed,
  182. unless the sender has established the service supports the handling of signed stanzas.</li>
  183. </ul>
  184. </section1>
  185. <section1 topic="Handling of Inbound Stanzas" anchor="inbound">
  186. <p>Several scenarios are possible when an entity receives an encrypted stanza:</p>
  187. <dl>
  188. <di>
  189. <dt>Case #1:</dt>
  190. <dd>The receiving application does not understand the protocol.</dd>
  191. </di>
  192. <di>
  193. <dt>Case #2:</dt>
  194. <dd>The receiving application understands the protocol and is able to verify the
  195. signature.</dd>
  196. </di>
  197. <di>
  198. <dt>Case #3:</dt>
  199. <dd>The receiving application understands the protocol and is able to verify the signature,
  200. but the timestamps fail the checks specified under Checking of Timestamps.</dd>
  201. </di>
  202. <di>
  203. <dt>Case #4:</dt>
  204. <dd>The receiving application understands the protocol and is unable to verify the
  205. signature.</dd>
  206. </di>
  207. </dl>
  208. <p>In Case #1, the receiving application MUST do one and only one of the following: (1) ignore
  209. the &lt;signed/&gt; extension, (2) ignore the entire stanza, or (3), except where precluded by
  210. the protocol (&rfc6120;), return a &lt;service-unavailable/&gt; error to the sender.</p>
  211. <p>In Case #2, the receiving application MUST NOT return a stanza error to the sender, since
  212. this is the success case.</p>
  213. <p>In Case #3, the receiving application MAY, except where precluded by the protocol, return a
  214. &lt;not-acceptable/&gt; error to the sender, optionally supplemented by an
  215. application-specific error condition element of &lt;bad-timestamp/&gt; as shown below:</p>
  216. <example><![CDATA[
  217. <message from=''
  218. id='6410ed123'
  219. to=''
  220. type='error'>
  221. <signed xmlns='urn:xmpp:signed:0'>
  222. <!-- original content -->
  223. </signed>
  224. <error type='modify'>
  225. <not-acceptable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
  226. <bad-timestamp xmlns='urn:xmpp:signed:0'/>
  227. </error>
  228. </message>
  229. ]]></example>
  230. <p>In Case #4, the receiving application SHOULD, except as precluded by the protocol, return a
  231. &lt;bad-request/&gt; error to the sender, optionally supplemented by an application-specific
  232. error condition element of &lt;bad-signature/&gt; as shown below:</p>
  233. <example><![CDATA[
  234. <message from=''
  235. id='6410ed123'
  236. to=''
  237. type='error'>
  238. <signed xmlns='urn:xmpp:signed:0'>
  239. <!-- original content -->
  240. </signed>
  241. <error type='modify'>
  242. <bad-request xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
  243. <bad-signature xmlns='urn:ietf:params:xml:xmpp-signed:0'/>
  244. </error>
  245. </message>
  246. ]]></example>
  247. <p>Additionally in Case #4, the receiving application SHOULD NOT present the stanza to the
  248. intended recipient (human or application) and SHOULD provide some explicit alternate
  249. processing of the stanza (which may be to display a message informing the recipient that it
  250. has received a stanza that cannot be verified).</p>
  251. </section1>
  252. <section1 topic="Inclusion and Checking of Timestamps" anchor="timestamps">
  253. <p>Timestamps are included to help prevent replay attacks. All timestamps MUST conform to
  254. &DATETIME; and be presented as UTC with no offset, always including the seconds and fractions
  255. of a second to three digits (resulting in a datetime 24 characters in length). Absent a local
  256. adjustment to the sending agent's perceived time or the underlying clock time, the sending
  257. agent MUST ensure that the timestamps it sends to the receiver increase monotonically (if
  258. necessary by incrementing the seconds fraction in the timestamp if the clock returns the same
  259. time for multiple requests). The following rules apply to the receiving application:</p>
  260. <ul style="symbols">
  261. <li>It MUST verify that the timestamp received is within five minutes of the current time,
  262. except as described below for offline messages.</li>
  263. <li>If the foregoing check fails, the timestamp SHOULD be presented to the receiving entity
  264. (human or application) marked with descriptive text indicating "old timestamp" or "future
  265. timestamp" and the receiving entity MAY return a stanza error to the sender (except as
  266. precluded in the protocol).</li>
  267. </ul>
  268. <p>The foregoing timestamp checks assume that the recipient is online when the message is
  269. received. However, if the recipient is offline then the server will probably store the message
  270. for delivery when the recipient is next online (offline storage does not apply to &lt;iq/&gt;
  271. or &lt;presence/&gt; stanzas, only &lt;message/&gt; stanzas). As described in &xep0160;, when
  272. sending an offline message to the recipient, the server SHOULD include delayed delivery data
  273. as specified in &xep0203; so that the recipient knows that this is an offline message and also
  274. knows the original time of receipt at the server. In this case, the recipient SHOULD verify
  275. that the timestamp received in the encrypted message is within five minutes of the time
  276. stamped by the recipient's server in the &lt;delay/&gt; element.</p>
  277. </section1>
  278. <section1 topic="Mandatory-to-Implement Cryptographic Algorithms" anchor="mti">
  279. <p>All implementations MUST support the following algorithms. Implementations MAY support other
  280. algorithms as well.</p>
  281. <ul>
  282. <li>TBD (RSA/SHA1? RSASSA-RKCS1-v1_5? RSASSA-PSS?)</li>
  283. </ul>
  284. </section1>
  285. <section1 topic="Certificates" anchor="certs">
  286. <p>To participate in end-to-end signing using the methods defined in this document, a client
  287. needs to possess an X.509 certificate. It is expected that many clients will generate their
  288. own (self-signed) certificates rather than obtain a certificate issued by a certification
  289. authority (CA). In any case the certificate MUST include an XMPP address that is represented
  290. using the ASN.1 Object Identifier "id-on-xmppAddr" as specified in Section 5.1.1 of
  291. RFC 3920bis.</p>
  292. </section1>
  293. <section1 topic="Security Considerations" anchor="security">
  294. <p>TBD.</p>
  295. </section1>
  296. <section1 topic="XMPP Registrar Considerations" anchor="reg">
  297. <section2 topic="XML Namespace Name for Signed Data in XMPP" anchor="ns">
  298. <p>A URN sub-namespace of signed content for the Extensible Messaging and Presence Protocol
  299. (XMPP) is defined as follows.</p>
  300. <dl>
  301. <di>
  302. <dt>URI:</dt>
  303. <dd>urn:xmpp:signed</dd>
  304. </di>
  305. <di>
  306. <dt>Specification:</dt>
  307. <dd>ProtoXEP</dd>
  308. </di>
  309. <di>
  310. <dt>Description:</dt>
  311. <dd>This is an XML namespace name of signed content for the Extensible Messaging and
  312. Presence Protocol as defined by ProtoXEP.</dd>
  313. </di>
  314. <di>
  315. <dt>Registrant Contact:</dt>
  316. <dd>XSF</dd>
  317. </di>
  318. </dl>
  319. </section2>
  320. </section1>
  321. <section1 topic="Acknowledgements" anchor="ack">
  322. <p>This document borrows ideas and text from End-to-End Object Encryption "work in progress" by
  323. Matthew Miller and Peter Saint-Andre.</p>
  324. </section1>
  325. </xep>