Re: [xmpp] Clarification of TLS Identity checking in draft-ietf-xmpp-3920bis

[Peter Saint-Andre <[e-mail]>]

On 3/14/11 9:03 PM, Peter Saint-Andre wrote:
> Sorry, I was in a hurry earlier. I've had another look at this now that
> I have a bit more time...
> 
> On 3/14/11 5:30 PM, Florian Zeitz wrote:
>> Am 15.03.2011 00:01, schrieb Peter Saint-Andre:
>>> On 3/14/11 4:38 PM, Florian Zeitz wrote:
>>>> I think there are 2 things in the draft that are actually wrong-ish:
>>>> a) It currently says "The initiating entity sets its reference
>>>> identifier to the 'to' address it communicates in the initial stream
>>>> header". I think that is somewhat backwards. The initiating entity does
>>>> not choose the domain to construct reference identifiers from based on
>>>> the 'to' attribute that it set, but it sets the 'to' attribute based on
>>>> the same domain it bases the reference identifiers of.
>>>
>>> I don't see a real difference between those two things.
>>>
>> It's really not a big deal. Basically currently it says that the 'to'
>> attribute is said from the user input and the source domain is then set
>> from the 'to' attribute. That seems like a strange layer of indirection,
>> but I can certainly live with it.
> 
> In fact I think it's right as it is. Here's why:
> 
> 1. First the initiating entity opens a stream to the receiving entity.
> There is no security interaction yet.
> 
> 2. The parties decide to negotiate TLS. Now the initiating entity
> establishes its set of reference identifiers based on the source domain.
> 
>>>> b) I don't think the draft means "reference identifier" here. I think
>>>> what it actually is talking about is the "source domain" that it will
>>>> base reference identifiers of. I think once that is clarified the rules
>>>> for building a list of reference identifiers that are in
>>>> draft-saintandre-tls-server-id are sufficient.
>>>
>>> I think that's right, and changing "reference identifier" to "source
>>> domain" is a relatively small fix. The rules about reference identifiers
>>> are provided in Section 13.7.1.2.1.
>>>
>> I had hoped for that ;)
> 
> The right fix is:
> 
>    The initiating entity sets the source domain of its reference
>                               ^^^^^^^^^^^^^^^^^^^^
>    identifier to the 'to' address it communicates in the initial
>    stream header...

Sorry, one more slight correction: "the source domain of its reference
identifiers" (in the plural) because the initiating entity might have
multiple reference identifiers (dNSName, SRVName, etc.).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/