Re: [xmpp] End-to-end encryption

[Matthew Miller <[e-mail]>]

On Jun 28, 2010, at 16:28, Ben Campbell wrote:

> [as co-chair]
> 
> The XMPP charter has a milestone determining a direction for end-to-end encryption. Matt and Peter submitted draft-miller-3923bis back in March. There's been very little discussion of it since then.
> 
> Have people read and understood this draft? If so, do you think this should be the basis for going forward on end-to-end encryption? Note that this doesn't mean we consider the draft perfect as is--just that we think it's a good starting point.

Ben Schumacher and I met in person to talk about some of the things we were discussing on list earlier.  The result will be -02, which I hope to get submitted very soon.  The nutshell of the process we came up with is:

1) Generate timestamp
TS = RFC3339 datetime of (now)

2) UTF8 encode stanza (S).  This is necessary for signing
S' = utf8(S)

3) Create plain envelope; prepare for encryption
E = <plain xmlns='urn:ietf:params:xml:ns:xmpp-objenc:0'
          timestamp='{TS}'>
     {base64(S')}
   </plain>
E' = utf8(E)

4) Encrypt with Block Cipher
R = <cipher session key>
T = block-encrypt(R, E')
T' = base64(T)

5) Generate MAC (using T as the salt, R as the message)
M = mac(T, R)
M' = base64(M)

6) Protect block cipher session key
V = pki-encrypt(pub(K), R)
V' = base64(V)

7) Construct container <e2e/>
C = <e2e xmlns='urn:ietf:params:xml:ns:xmpp-objenc:0'>
     <key cipher-algo='<PKI cipher algorithm>'>
       {V'}
     </key>
     <data cipher-algo='<block cipher algorithm>'>
           mac-algo='<mac algorithm>'
           hash='{M'}'>
       {T'}
     </data>
   </e2e>

8) Construct sending stanza (D); include C as child of D 
D = <message xmlns='jabber:client'
            to='[e-mail]'
            type='chat'>
     <e2e xmlns='urn:ietf:params:xml:ns:xmpp-objenc:0'>
       <key cipher-algo='<PKI cipher algorithm>'>
         {V'}
       </key>
       <data cipher-algo='<block cipher algorithm>'>
             mac-algo='<mac algorithm>'
             hash='{M'}'>
         {T'}
       </data>
     </e2e>
   </message>

The biggest complaint we had with the above is that XML is serialized/parsed 3 times; but I don't know how we can avoid that unless we ignore signing entirely, which is something we're interested in.

Comments and questions welcome...


- m&m