Re: [xmpp] Fwd: I-D Action: draft-saintandre-xmpp-tls-00.txt

[Dave Cridland <[e-mail]>]

On Mon, Sep 9, 2013 at 6:08 PM, Peter Saint-Andre <[e-mail]>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 9/9/13 10:51 AM, Dave Cridland wrote:
> > On Mon, Sep 9, 2013 at 5:35 PM, Peter Saint-Andre
> > <[e-mail] <mailto:[e-mail]>> wrote:
> >
> > There's also a htmlized version available at:
> > http://tools.ietf.org/html/draft-saintandre-xmpp-tls-00
> >
> >
> > Thanks for writing this, it looks like an excellent start.
>
> You inspired it because as I recall you suggested that we pull some of
> the security recommendations out of draft-ietf-xmpp-3920bis and into a
> separate spec that we could update more readily. :-)
>
>
OK, I could take credit. Though years of management have trained me to wait
until I see a successful outcome first.


> > o  Discuss TLS compression vs. application-layer compression?
> >
> > It's not obvious it's a security issue, but yes.
>
> Well, there is the CRIME attack against some technologies that use TLS
> compression, however it's not clear to me if that applies to XMPP.
>
>
Ah, that. Right.


> > The issue remains that compressing streams takes a serious wodge of
> > data, but it's desirable.
> >
> > Also, I think we should discuss the use of anonymous (or
> > unauthenticated in general) TLS; I've been convinced recently that
> > using even a non-channel-binding authentication and unauthenticated
> > TLS is substantially better than nothing. It's also what the
> > deployed base actually does.
>
> Could you explain a bit more what you mean by unauthenticated TLS?
>
>
Any TLS channel which is not authenticated; so ADH is anonymous, whereas
self-signed cert usage is the (broader) unauthenticated TLS, as are various
other cases.


> > Finally, I'd be keen to see this adopted by the working group if
> > that's on the table.
>
> I leave that up to the chairs. :-)  Depending on how you read the
> charter, it might or might not be in scope.
>
>
Charters can be changed, of course.

Dave.