Re: [Stox] Stephen Farrell's No Objection on draft-ietf-stox-chat-10: (with COMMENT)

[Peter Saint-Andre <[e-mail]>]

On 3/4/15 4:52 PM, Peter Saint-Andre - &yet wrote:
> On 3/3/15 1:42 PM, Stephen Farrell wrote:
>> Stephen Farrell has entered the following ballot position for
>> draft-ietf-stox-chat-10: No Objection
>>
>> When responding, please keep the subject line intact and reply to all
>> email addresses included in the To and CC lines. (Feel free to cut this
>> introductory paragraph, however.)
>>
>>
>> Please refer to http://www.ietf.org/iesg/statement/discuss-criteria.html
>> for more information about IESG DISCUSS and COMMENT positions.
>>
>>
>> The document, along with other ballot positions, can be found here:
>> http://datatracker.ietf.org/doc/draft-ietf-stox-chat/
>>
>>
>>
>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>>
>> - OTR works for xmpp. I think (not sure) it could be made
>> work for MSRP or SIMPLE, and presumably then it might work
>> here. If that's true, be good to note that and explain a bit
>> how to do that. (And I don't mean the long-promised OTR I-D,
>> just a pointer at the inevitably bad best reference we can
>> find.)
>
> Yes, we might do that in all three of these specs (or, as Barry
> suggests, mention it in the -im spec and point there from the others).

Here is proposed / updated text for the -im document, to which we can 
point from the -chat document:

    This document specifies methods for exchanging "page-mode" instant
    messages through a gateway that translates between SIP and XMPP, and
    [I-D.ietf-stox-chat] specifies such methods for "session-mode"
    instant messaging between MSRP and XMPP.  Such a gateway MUST be
    compliant with the minimum security requirements of the textual chat
    protocols for which it translates (i.e., SIP or MSRP and XMPP).

    The addition of gateways to the security model of instant messaging
    specified in [RFC2779] introduces some new risks.  In particular,
    end-to-end security properties (especially confidentiality and
    integrity) between instant messaging clients that interface through a
    gateway can be provided only if common formats are supported.
    Specification of those common formats is out of scope for this
    document.  For instant messages, it is possible to use [RFC3862] and
    [RFC3923], but those methods are not widely implemented.  A more
    widely implemented albeit unstandardized method for interoperable
    end-to-end encryption would be Off-the-Record Messaging [OTR].

Peter