Re: [atoca] Call for submissions: Secure Alert Format

Hey Peter,

Thanks for this observation.

I think we were thinking of things in kind of the other direction:
1. Define a general signed alert format
2. Define a way to transport those over XMPP (XEP-0127-bis)

This approach provides a more general functionality than sending CAP in secure XMPP (e.g., with an RFC 3923 signature).  The relationship is essentially the same as that between POSH and, say, attribute certificates over HTTP.  In one case, the signature is being provided by the protocol used to deliver the alert; in the  other, the signature is attached to the object itself.  In the interest of being delivery-agnostic, ISTM that the object-based approach is preferable.

It may also be pretty trivial to extend XEP-0127 to support the security we describe here.  For example, if we allow detached signatures (which seems like a good idea), you could keep the same syntax as XEP-0127 and just add an attribute/element to carry signature data. (As long as the serialization of the CAP can't change...)

Hope this helps,
--Richard

On Aug 17, 2012, at 3:06 PM, Peter Saint-Andre wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 8/17/12 12:34 PM, Martin Thomson wrote:
>> The ATOCA WG needs you.
>> 
>> It has been determined that providing a means of authenticating
>> alerts is critical to the working group.
>> 
>> Please submit internet drafts containing proposals that address
>> this problem before September 12.
>> 
>> Such a proposal must be able to carry CAP-formatted alerts in such
>> a way that the source(s) of the alert can be authenticated by 
>> recipients.  Attributing trust to that source is not necessarily 
>> within scope, nor is it necessary to describe a protocol or
>> delivery architecture.
> 
> Some years ago, the XMPP Standards Foundation defined a way to send
> CAP-formatted alerts over XMPP:
> 
> http://xmpp.org/extensions/xep-0127.html
> 
> XMPP also includes methods for signed messages (e.g., RFC 3923,
> although the XMPP WG is considering a more modern approach based on
> the output of the JOSE WG).
> 
> If signed XMPP messages containing CAP-formatted alerts might be of
> interest, I would be happy to write an I-D defining this approach in
> more detail.
> 
> Peter
> 
> - -- 
> Peter Saint-Andre
> https://stpeter.im/
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.18 (Darwin)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAlAulicACgkQNL8k5A2w/vxKaACg+FtkpH/ocmY9B08BfvNXgFLZ
> YlEAoJiGG0s1B6nzHWIgVhSPBbvutfbZ
> =CK+1
> -----END PGP SIGNATURE-----
> _______________________________________________
> atoca mailing list
> atoca@ietf.org
> https://www.ietf.org/mailman/listinfo/atoca