RFC 3860

Common Profile for Instant Messaging (CPIM)

📅 published August 2004, from ietf

RFC 3860: Common Profile for Instant Messaging (CPIM) 💖

okay bestie, this is RFC 3860 and it's giving standards track 👑. It was written by J. Peterson of NeuStar, sits in the Network Working Group, and is dated August 2004. The category is Standards Track. The header doesn't list anything it obsoletes or updates, so there's no older RFC it replaces or changes 🧐.

Status of This Memo ✨

this section is the official "what even is this doc" bit 📜. this document specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🎀. if you want the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1) 📚. distribution of this memo is unlimited 🌈.

"Copyright (C) The Internet Society (2004)."

Abstract 🌸

back when this was written, there were so many instant messaging protocols in use, and barely any interoperability between the services built on them 😭. this spec defines common semantics and data formats for instant messaging so that gateways can be built between IM services 🫶.

Table of Contents 🧚

   1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  2
   2.  Terminology  . . . . . . . . . . . . . . . . . . . . . . . . .  3
   3.  Abstract Instant Messaging Service . . . . . . . . . . . . . .  4
       3.1.  Overview of Instant Messaging Service  . . . . . . . . .  4
       3.2.  Identification of INSTANT INBOXes  . . . . . . . . . . .  5
             3.2.1.  Address Resolution . . . . . . . . . . . . . . .  5
       3.3.  Format of Instant Messages . . . . . . . . . . . . . . .  5
       3.4.  The Messaging Service  . . . . . . . . . . . . . . . . .  5
             3.4.1.  The Message Operation  . . . . . . . . . . . . .  5
             3.4.2.  Looping  . . . . . . . . . . . . . . . . . . . .  6
   4.  Security Considerations  . . . . . . . . . . . . . . . . . . .  7
   5.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . .  8
       5.1.  The IM URI Scheme. . . . . . . . . . . . . . . . . . . .  8
   6.  Contributors . . . . . . . . . . . . . . . . . . . . . . . . .  8
   7.  References . . . . . . . . . . . . . . . . . . . . . . . . . .  9
       7.1.  Normative References . . . . . . . . . . . . . . . . . .  9
       7.2.  Informative References . . . . . . . . . . . . . . . . .  9

   A.  IM URI IANA Registration Template  . . . . . . . . . . . . . . 10
       A.1.  URI Scheme Name  . . . . . . . . . . . . . . . . . . . . 10
       A.2.  URI Scheme Syntax  . . . . . . . . . . . . . . . . . . . 10
       A.3.  Character Encoding Considerations  . . . . . . . . . . . 10
       A.4.  Intended Usage . . . . . . . . . . . . . . . . . . . . . 10
       A.5.  Applications and/or Protocols which use this URI Scheme
             Name . . . . . . . . . . . . . . . . . . . . . . . . . . 10
       A.6.  Security Considerations  . . . . . . . . . . . . . . . . 10
       A.7.  Relevant Publications  . . . . . . . . . . . . . . . . . 11
       A.8.  Person & Email Address to Contact for Further
             Information. . . . . . . . . . . . . . . . . . . . . . . 11
       A.9.  Author/Change Controller . . . . . . . . . . . . . . . . 11
       A.10. Applications and/or Protocols which use this URI Scheme
             Name . . . . . . . . . . . . . . . . . . . . . . . . . . 11
   B.  Issues of Interest . . . . . . . . . . . . . . . . . . . . . . 11
       B.1.  Address Mapping  . . . . . . . . . . . . . . . . . . . . 11
       B.2.  Source-Route Mapping . . . . . . . . . . . . . . . . . . 11
   C.  Acknowledgments  . . . . . . . . . . . . . . . . . . . . . . . 12
   Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 12
   Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 13

1. Introduction ✨

okay so instant messaging is defined in RFC2778 [5]. at the time this was written, loads of instant messaging protocols are in use, and there's still very little interoperability between services built on them 💀. this spec defines semantics and data formats for the common services of instant messaging so gateways can be made between IM services. that's the common profile for instant messaging, or CPIM 🎀.

service behavior is described abstractly, as operations invoked between the consumer and provider of a service 🧠. because of that, each IM service must specify how this behavior gets mapped onto its own protocol interactions. the strategy is a local matter, as long as there's a clear relation between the abstract behaviors of the service (as this memo specifies) and how a particular instant messaging service faithfully realizes them 🦋. one strategy might send an instant message as textual key/value pairs, another might use a compact binary representation, and a third might use nested containers 📦.

the attributes for each operation are defined using an abstract syntax 🧩. the syntax specifies the range of possible data values, but each IM service must specify how well-formed instances of the abstract representation are encoded as a concrete series of bits 💜.

to keep end-to-end features (especially security) alive when messages pass through instant messaging interoperability gateways, this specification also gives recommendations for instant messaging document formats that instant messaging protocols could use 🔐✨.

2. Terminology 📖

in this document, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" are interpreted as described in RFC 2119 [1]. they tell you the requirement levels for compliant implementations 🫶.

this memo uses the vocabulary defined in RFC 2778 [5]. terms like CLOSED, INSTANT INBOX, INSTANT MESSAGE, and OPEN mean the same thing here as they do there 💅.

the term 'gateway' in this document means a network element responsible for interworking between diverse instant messaging protocols 🌉. even though the instant messaging protocols are diverse, under the model used here they can carry a common payload that the gateway relays 🎁. honestly, whether these interworking intermediaries should be called 'gateways' or 'relays' is somewhat debatable 🙈. for this document, they're called 'CPIM gateways' 💖.

the term 'instant messaging service' also comes from RFC 2778, but its meaning shifts a little because CPIM gateways exist in the model 🦋. when a client sends an operation to an instant messaging service, that service might be an endpoint or an intermediary like a CPIM gateway. in fact, the client shouldn't have to know which one it's addressing, because responses from either will look the same 🧚.

this document defines operations and attributes of an abstract instant messaging protocol 🧠. for a compliant protocol to interface with an instant messaging gateway, it must support all of the operations described here. that means the instant messaging protocol must have some message or capability that provides the function described by each operation. similarly, the attributes defined for these operations must correspond to information available in the instant messaging protocol, so the protocol can interface with gateways defined by this specification 🎀. note that these attributes provide only the minimum possible information needed for interoperability. the functions in an instant messaging protocol that match the operations here can contain extra information that CPIM won't map 🌈.

3. Abstract Instant Messaging Service 🧚

3.1. Overview of Instant Messaging Service

when an application wants to send a message to an INSTANT INBOX, it invokes the message operation 💌. e.g.,

   +-------+                    +-------+
   |       |                    |       |
   | appl. | -- message ------> |  IM   |
   |       |                    | svc.  |
   +-------+                    +-------+

the message operation has these attributes: source, destination, MaxForwards and TransID. source and destination identify the originator and recipient of an instant message, respectively, and each one consists of an INSTANT INBOX identifier (as described in Section 3.2) 💖. MaxForwards is a hop counter used to avoid loops through gateways. its usage is detailed in Section 3.4.2, and its initial value is set by the originator 🔁. TransID is a unique identifier used to correlate message operations to response operations. gateways should be capable of handling TransIDs up to 40 bytes in length 🦋.

the message operation also has some content, which is the instant message itself. it might be textual, or it might consist of other data 💜. the content details are specified in Section 3.3 ✨.

note that this specification assumes instant messaging protocols provide reliable message delivery. there are no application-layer message delivery assurance provisions in this specification 🙈.

when a message operation is received, the service immediately responds by invoking the response operation, which contains the same transaction-identifier 💨. e.g.,

   +-------+                    +-------+
   |       |                    |       |
   | appl. | <----- response -- |  IM   |
   |       |                    |  svc. |
   +-------+                    +-------+

the response operation contains these attributes: TransID and status. TransID is used to correlate the response to a particular instant message. status indicates whether delivery of the message succeeded or failed. valid status values are described in Section 3.4.1 🫶.

3.2. Identification of INSTANT INBOXes

an INSTANT INBOX is specified using an instant messaging URI with the 'im:' URI scheme. the full syntax of the IM URI scheme is given in Appendix A. for example: "im:fred@example.com" 💌✨

3.2.1. Address Resolution

an IM service client figures out the next hop to forward the IM to by resolving the domain name portion of the service destination 🗺️. compliant implementations SHOULD follow the guidelines for dereferencing URIs given in [2] 🎀.

3.3. Format of Instant Messages 💅

this specification defines an abstract interoperability mechanism for instant messaging protocols. the message content definition here is about semantics, not syntax 🧠. still, some important properties for interoperability can only be provided if the interoperating instant messaging protocols use a common end-to-end format, especially for security 🔐. to keep those end-to-end security properties, applications that send message operations to a CPIM gateway MUST implement the format defined in MSGFMT [4] 🛡️. applications MAY support other content formats too 🌈.

CPIM gateways MUST be capable of relaying the content of a message operation between supported instant messaging protocols without needing to modify or inspect the content 💖. no peeking, no touching, just vibes 🫣.

3.4. The Messaging Service 🎀

3.4.1. The Message Operation 💌

Okay so when an application wants to send an INSTANT MESSAGE, it invokes the message operation. ✨

When an instant messaging service gets that message operation, it runs some preliminary checks first. Think of it as the bouncer at the door 💅

  1. If the source or destination does not refer to a syntactically valid INSTANT INBOX, a response operation having status "failure" is invoked.
  2. If the destination of the operation cannot be resolved by the recipient, and the recipient is not the final recipient, a response operation with the status "failure" is invoked.
  3. If access control does not permit the application to request this operation, a response operation having status "failure" is invoked.
  4. Provided these checks are successful:
    • If the instant messaging service is able to successfully deliver the message, a response operation having status "success" is invoked.
    • If the service is unable to successfully deliver the message, a response operation having status "failure" is invoked.
    • If the service must delegate responsibility for delivery (i.e., if it is acting as a gateway or proxying the operation), and if the delegation will not result in a future authoritative indication to the service, a response operation having status "indeterminant" is invoked.
    • If the service must delegate responsibility for delivery, and if the delegation will result in a future authoritative indication to the service, then a response operation is invoked immediately after the indication is received.

When the service invokes the response operation, the transID parameter is identical to the value found in the message operation invoked by the application. 🫶

3.4.2. Looping 🔁

Dynamic routing can make an instant message loop around through a relay, and ngl that's chaos 😭 Spotting loops isn't always obvious, because aliasing and group list expansions can legitimately cause a message to pass through a relay more than one time.

This document assumes that instant messaging protocols which can be gatewayed by CPIM support some semantic equivalent to an integer value. That integer is the maximum number of hops a message can pass through. Once that number of hops has been reached, the message is assumed to have looped. 🌀

When a CPIM gateway relays an instant message, it decrements the value of the MaxForwards attribute. This document does not mandate any particular initial setting for the MaxForwards element in instant messaging protocols, but it is recommended that the value be reasonably large (over one hundred). 💜

If a CPIM gateway receives an instant message operation that has a MaxForwards attribute of 0, it discards the message and invokes a failure operation. Bye bye, message 👋

4. Security Considerations 🔐

Okay, this section is serious, bestie, so read it carefully 🥺 Detailed security considerations for instant messaging protocols are given in RFC 2779 [6] (in particular, requirements are given in section 5.4 and some motivating discussion with 8.1).

CPIM defines an interoperability function that is employed by gateways between instant messaging protocols. CPIM gateways MUST be compliant with the minimum security requirements of the instant messaging protocols with which they interface.

The introduction of gateways to the security model of instant messaging in RFC 2779 also introduces some new risks. End-to-end security properties (especially confidentiality and integrity) between instant messaging user agents that interface through a CPIM gateway can only be provided if a common instant message format (such as the format described in MSGFMT [4]) is supported by the protocols interfacing with the CPIM gateway. It's giving "the chain is only as strong as its weakest link" 🔗

When end-to-end security is required, the message operation MUST use MSGFMT, and MUST secure the MSGFMT MIME body with S/MIME [8], with encryption (CMS EnvelopeData) and/or S/MIME signatures (CMS SignedData). 🔒

The S/MIME algorithms are set by CMS [9]. The AES [11] algorithm should be preferred, as it is expected that AES best suits the capabilities of many platforms. Implementations MAY use AES as an encryption algorithm, but are REQUIRED to support only the baseline algorithms mandated by S/MIME and CMS.

When IM URIs are placed in instant messaging protocols, they convey the identity of the sender and/or the recipient. Certificates that are used for S/MIME IM operations SHOULD, for the purposes of reference integrity, contain a subjectAltName field containing the IM URI of their subject. Note that such certificates may also contain other identifiers, including those specific to particular instant messaging protocols. In order to further facilitate interoperability of secure messaging through CPIM gateways, users and service providers are encouraged to employ trust anchors for certificates that are widely accepted rather than trust anchors specific to any particular instant messaging service or provider. 🦋

In some cases, anonymous messaging may be desired. Such a capability is beyond the scope of this specification. 🙈

5. IANA Considerations 🗂️

The IANA has assigned the "im" scheme. ✅

5.1. The IM URI Scheme

The Instant Messaging (IM) URI scheme designates an Internet resource, namely an INSTANT INBOX.

The syntax of an IM URI is given in Appendix A. 📝

6. Contributors 🌸

Dave Crocker edited earlier versions of this document. Iconic behaviour 👑

The following individuals made substantial textual contributions to this document:

  • Athanassios Diacakis (thanos.diacakis@openwave.com)
  • Florencio Mazzoldi (flo@networkprojects.com)
  • Christian Huitema (huitema@microsoft.com)
  • Graham Klyne (gk@ninebynine.org)
  • Jonathan Rosenberg (jdrosen@dynamicsoft.com)
  • Robert Sparks (rsparks@dynamicsoft.com)
  • Hiroyasu Sugano (suga@flab.fujitsu.co.jp)

7. References 📚

7.1. Normative References

  • [1] Bradner, S., "Key words for use in RFCs to indicate requirement levels", BCP 14, RFC 2119, March 1997.
  • [2] Peterson, J., "Address Resolution for Instant Messaging and Presence", RFC 3861, August 2004.
  • [3] Resnick, P., "Internet Message Format", STD 11, RFC 2822, April 2001.
  • [4] Atkins, D. and G. Klyne, "Common Presence and Instant Messaging: Message Format", RFC 3862, August 2004.
  • [5] Day, M., Rosenberg, J., and H. Sugano, "A Model for Presence and Instant Messaging", RFC 2778, February 2000.
  • [6] Day, M., Aggarwal, S., and J. Vincent, "Instant Messaging / Presence Protocol Requirements", RFC 2779, February 2000.
  • [7] Allocchio, C., "GSTN Address Element Extensions in Email Services", RFC 2846, June 2000.
  • [8] Ramsdell, B., "Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.1 Message Specification", RFC 3851, July 2004.
  • [9] Housley, R., "Cryptographic Message Syntax (CMS)", RFC 3852, July 2004.
  • [10] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifiers (URI): Generic Syntax", RFC 2396, August 1998.

7.2. Informative References

  • [11] Schaad, J., "Use of the Advanced Encryption Standard (AES) Encryption Algorithm and in Cryptographic Message Syntax (CMS)", RFC 3565, August 2003.

Appendix A. IM URI IANA Registration Template 🎀

This section provides the information to register the im: instant messaging URI.

A.1. URI Scheme Name

im

A.2. URI Scheme Syntax

The syntax follows the existing mailto: URI syntax specified in RFC 2368. The ABNF is:

IM-URI         = "im:" [ to ] [ headers ]
to             =  mailbox
headers        =  "?" header *( "&" header )
header         =  hname "=" hvalue
hname          =  *uric
hvalue         =  *uric

Here the symbol "mailbox" represents an encoded mailbox name as defined in RFC 2822 [3], and the symbol "uric" denotes any character that is valid in a URL (defined in RFC 2396 [10]). 🧩

A.3. Character Encoding Considerations

Representation of non-ASCII character sets in local-part strings is limited to the standard methods provided as extensions to RFC 2822 [3].

A.4. Intended Usage

Use of the im: URI follows closely usage of the mailto: URI. That is, invocation of an IM URI will cause the user's instant messaging application to start, with destination address and message headers fill-in according to the information supplied in the URI. 🚀

A.5. Applications and/or Protocols which use this URI Scheme Name

It is anticipated that protocols compliant with RFC 2779, and meeting the interoperability requirements specified here, will make use of this URI scheme name.

A.6. Security Considerations

See Section 4.

A.7. Relevant Publications

RFC 2779, RFC 2778

A.8. Person & Email Address to Contact for Further Information

Jon Peterson [mailto:jon.peterson@neustar.biz]

A.9. Author/Change Controller

This scheme is registered under the IETF tree. As such, IETF maintains change control.

A.10. Applications and/or Protocols which use this URI Scheme Name

Instant messaging service

Appendix B. Issues of Interest 🧭

This appendix briefly discusses issues that may be of interest when designing an interoperation gateway.

B.1. Address Mapping

When mapping the service described in this memo, mappings that place special information into the im: address local-part MUST use the meta-syntax defined in RFC 2846 [7].

B.2. Source-Route Mapping

The easiest mapping technique is a form of source-routing and usually is the least friendly to humans having to type the string. Source-routing also has a history of operational problems. 😬

Use of source-routing for exchanges between different services is by a transformation that places the entire, original address string into the im: address local part and names the gateway in the domain part.

For example, if the destination INSTANT INBOX is "pepp://example.com/fred", then, after performing the necessary character conversions, the resulting mapping is:

im:pepp=example.com/fred@relay-domain

where "relay-domain" is derived from local configuration information.

Experience shows that it is vastly preferable to hide this mapping from end-users - if possible, the underlying software should perform the mapping automatically. Hide the plumbing, bestie 🧚

Appendix C. Acknowledgments 🙏

The author would like to acknowledge John Ramsdell for his comments, suggestions and enthusiasm. Thanks to Derek Atkins for editorial fixes.

Author's Address 📮

Jon Peterson
NeuStar, Inc.
1800 Sutter St
Suite 570
Concord, CA  94520
US

Phone: +1 925/363-8720
EMail: jon.peterson@neustar.biz

Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property ✨

okay so the IETF is NOT saying whether any patents or other IP rights tied to the tech in this doc are valid, how far they reach, or whether you can get a license for them 🫠 it also hasn't gone hunting for any of those rights itself, so don't assume it did 💅 if you want the rules on rights in RFC docs, check BCP 78 and BCP 79 🎀

copies of IPR disclosures sent to the IETF Secretariat are a thing, and so are any promises to license, or what happened when someone tried to get a general license or permission for implementers or users. you can find all of that in the IETF's online IPR repository at http://www.ietf.org/ipr 🦋

and the IETF literally invites everyone to speak up! if you know about any copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard, tell them. send it to ietf-ipr@ietf.org 💌 main character energy, but make it helpful 💜

Acknowledgement 🫶

funding for the RFC Editor function is currently provided by the Internet Society 🌈

📦 where this page comes from