Re: [xmpp] Fwd: New Version Notification for draft-saintandre-xmpp-tls-04.txt

I read through this (or rather, read through the diff2). Two points:

1) I noticed you've changed SSLv3 and TLSv1.0 from SHOULD NOT to MAY.

I don't think we really want to be suggesting that SSLv3 in particular is a
neutral decision; I think, though, that offering it as a server is
reasonable.

Is it worth splitting the requirement levels between initiator and
receiver, something like:

XMPP implementations MAY offer SSLv3 in the receiving role, however SHOULD
NOT negotiate it in the initiating role, preferring later versions.

I'm not so sure about the TLSv1.0 levels, I'll defer to more
cryptographically minded folk on that one.

2) For Security Considerations: It's trivial for an attacker to observe
data between two servers, and given the lack of obfuscation, it'd be fairly
trivial to handle stanza counts. If all the hops are under scrutiny, then
it's fairly easy to observe the stanzas on each hop and establish who is
talking to whom. If you'd like some "proper RFC" text for this I can think
on it (but I'm travelling shortly as you know).

On Fri, Jan 24, 2014 at 2:04 AM, Peter Saint-Andre <stpeter@stpeter.im>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I added a bit to the security considerations...
>
>
> - -------- Original Message --------
> Subject: New Version Notification for draft-saintandre-xmpp-tls-04.txt
> Date: Thu, 23 Jan 2014 13:26:19 -0800
> From: internet-drafts@ietf.org
> To: Peter Saint-Andre <ietf@stpeter.im>, Peter Saint-Andre
> <ietf@stpeter.im>
>
>
> A new version of I-D, draft-saintandre-xmpp-tls-04.txt
> has been successfully submitted by Peter Saint-Andre and posted to the
> IETF repository.
>
> Name:           draft-saintandre-xmpp-tls
> Revision:       04
> Title:          Use of Transport Layer Security (TLS) in the Extensible
> Messaging and Presence Protocol (XMPP)
> Document date:  2014-01-23
> Group:          Individual Submission
> Pages:          10
> URL:
> http://www.ietf.org/internet-drafts/draft-saintandre-xmpp-tls-04.txt
> Status:
> https://datatracker.ietf.org/doc/draft-saintandre-xmpp-tls/
> Htmlized:       http://tools.ietf.org/html/draft-saintandre-xmpp-tls-04
> Diff:
> http://www.ietf.org/rfcdiff?url2=draft-saintandre-xmpp-tls-04
>
> Abstract:
>    This document provides recommendations for the use of Transport Layer
>    Security (TLS) in the Extensible Messaging and Presence Protocol
>    (XMPP).  This document updates RFC 6120.
>
>
>
>
>
> Please note that it may take a couple of minutes from the time of
> submission
> until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.12 (GNU/Linux)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIcBAEBAgAGBQJS4colAAoJEOoGpJErxa2pfKoP/As9w5Jl/R0usCA7u69hKJKw
> Ct8E3LL0HHz3kMLKKPlTrL7+qCqNXK2yKI5yfRbcBeg/0D2cUOtnNwhZPO+rFzWH
> K3q3A6zf/o+tLvw8ISPFDsrd1eXESNDBA620tieVEbJyT016+TuEHq/do9UDNnfW
> usyfPxutvFjI9hCgMNsR8FvIfFsiuKDUNxfGx+x6n4twIUSK5VRJlF4kbMVdATzz
> eypsFBTk+Y7WCRowPguUvqMURvoGiL3pqAXF5+DxzwobGlbpQh0kZlV+oiYHPksb
> d5uc1BYltcqbrC/vOoHOvA8sa7B49ZceqqcFYtb1NnTSlWzf+QPQi4FU2nRVK0zL
> 8SfJcX3ISeg4NJJBnJtiR1+wdkk8LduIqUfIcFoG03c/UBgARs8ukmgNMUqEI1bH
> dLQiYTdhD0MfQ2OmDcxaIpK56TNdn14aXG5nPCTd3ogA3Yx9IyxsA9fUF/nmvYkN
> cgszi2bG392S8AcAefXvu0QRg2wj38o8jQrE0yKfWjCKflIlbwOmnZ0pteFSFFpO
> XdUTZs0t3p9emcehoSZgX2KjigtI6PzH+cMl4vR2WLjtydz1bpDz0hltHGBTBEdb
> BoxTWqCTtcImKBhymrcnkgrFWl6RH74C4iMpxawUL7fSh7woJ9prsuQ5MVAs6r0z
> OWh3sy4JLxSXXztvVE9C
> =BwqQ
> -----END PGP SIGNATURE-----
> _______________________________________________
> xmpp mailing list
> xmpp@ietf.org
> https://www.ietf.org/mailman/listinfo/xmpp
>