[Stox] Stephen Farrell's IESG feedback on draft-ietf-stox-core

[Peter Saint-Andre <[e-mail]>]

( + STOX WG since one of the issues might deserve broader discussion )

Hi Stephen, thanks for your review:

https://datatracker.ietf.org/doc/draft-ietf-stox-core/ballot/

You wrote in part:

    - I wondered why you didn't just say that (D)TLS SHOULD
    be used/supported between gateways. Given that all the
    relevant bits of code are likely to support that, wouldn't
    it be a good thing?

Yes, that seems eminently reasonable.

    - Has anyone thought about confusability in the name
    mappings? I expected to see a bit of text in the
    security considerations but didn't see it.

Confusion is always possible. :-) Were you thinking about confusable 
characters from Unicode, or something else?

    - It seems a shame to not be able to gateway when the To is
    a sips URI at all but I understand that some loss of
    security is inevitable for cases like this. Is there any
    work planned for an update that would allow gatewaying for
    such cases, e.g. if the 1st XMPP server is the one to which
    the user is connected and the user is connected using
    XMPP/TLS?

Hmm. I cannot say that I am aware of planning for updates to provide 
more secure gatewaying, although folks active in the STOX WG might be 
thinking along those lines.

Depending on the deployment architecture, I think there are cases where 
it is *possible* to TLS-protect all the hops. For instance, if 
sip.example.org has a direct server-to-server connection to 
xmpp.example.com (no intermediate hops) and both organizations agree to 
force the use of TLS for client connections (e.g., via SLA), then I 
suppose that sip.example.com could honor 'sips' URIs when sending 
traffic to xmpp.example.com. However, such an arrangement is rare enough 
right now that I don't know if it is worth mentioning.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/