RFC 7194

Default Port for Internet Relay Chat (IRC) via TLS/SSL

📅 published August 2014, from ietf

RFC 7194 🎀

okay bestie, this is RFC 7194 and it's giving tiny but mighty 💅 It's titled "Default Port for Internet Relay Chat (IRC) via TLS/SSL" and it was written by R. Hartmann (Richard Hartmann) back in August 2014 🌸 It's an Independent Submission with the category Informational, ISSN 2070-1721. The title block says it updates RFC 1459 ✨ There's no Obsoletes line, so it doesn't list anything it replaces.

Abstract ✨

so the big idea is this: it describes the commonly accepted practice of listening on TCP port 6697 for incoming Internet Relay Chat (IRC) connections that are encrypted with TLS/SSL 🔐 that's the whole vibe!!

Status of This Memo 📝

this one is not an Internet Standards Track specification. It's published purely for informational purposes 🧚

this is a contribution to the RFC Series, done independently of any other RFC stream. The RFC Editor chose to publish it at their discretion and makes no statement about its value for implementation or deployment 🙈 Documents approved for publication by the RFC Editor are not a candidate for any level of Internet Standard. (See Section 2 of RFC 5741 for that.)

info about this doc's current status, any errata, and how to give feedback lives at http://www.rfc-editor.org/info/rfc7194 💜

Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.

this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the date of publication. Please read these carefully, bestie, because they describe your rights and restrictions with respect to this document 🫶

Table of Contents 🍓

1. Rationale .......................................................2
2. Technical Details ...............................................2
   2.1. Connection Establishment ...................................2
   2.2. Certificate Details ........................................3
        2.2.1. Server Certificate ..................................3
        2.2.2. Client Certificate ..................................3
3. Security Considerations .........................................3
4. IANA Considerations .............................................4
5. Normative References ............................................4
6. Informative References ..........................................4
7. Acknowledgements ................................................5
Appendix A. Supporting Data ........................................6

1. Rationale ✨

okay so IRC has system port assignments for plain text (TCP/UDP port 194) and for TLS/SSL encrypted traffic (TCP/UDP port 994) [IANALIST]. But the IRC networks don't really use them, and that's common practice 💅 The reason is convenience and general availability on systems where you don't get root access, or don't want it.

IRC networks have been defaulting to TCP port 6667 for plain text connections for a looong time now 🦋 That's covered by the IRCU assignment of TCP/UDP ports 6665-6669.

the IRC community reached a similar consensus about listening on TCP port 6697 for incoming IRC connections encrypted with TLS/SSL [RFC5246]. Iconic 👑

2. Technical Details 🔥

2.1. Connection Establishment

here's the flow bestie 🧚 An IRC client connects to an IRC server. Right after that, a normal TLS/SSL handshake happens. Once the TLS/SSL connection is up, a normal IRC connection gets established through that tunnel 🔐 Optionally, the IRC server may set a specific user mode (umode) for the client to mark it as using TLS/SSL. Also optionally, an IRC server might offer the option to create channels so that only clients connected via TLS/SSL can join them. Main character energy 💖

for details on how IRC works, check out [RFC1459], [RFC2810], [RFC2811], [RFC2812], and [RFC2813]. But heads up: IRC is extremely fragmented, and implementation details can vary wildly 💀 Most implementations regard the latter RFCs as suggestions, not as binding. Not me, I'd be shook 😭

2.2. Certificate Details 🎀

2.2.1. Server Certificate

the IRC server's certificate should be issued by a commonly trusted certification authority (CA) ✨

the Common Name should match the Fully Qualified Domain Name (FQDN) of the IRC server, or have appropriate wildcards if applicable 🌸

the IRC client should verify the certificate 💅

2.2.2. Client Certificate

if the client is using a certificate as well, it should be issued by a commonly trusted CA or a CA designated by the IRC network 🦋

the certificate's Common Name should match the main IRC nickname 🍓

if the network offers nick registration, this nick should be used 🧚

if the network offers grouped nicks, the main nick or account name should be used 🌈

and if the network offers nick registration, the client certificate should be used to identify the user against the nick database. See [CERTFP] for a possible implementation ✨

3. Security Considerations 🔐

okay this part is SERIOUS bestie 😭 The lack of a common, well-established listening port for IRC via TLS/SSL could lead to end users being unaware that their IRC network of choice supports TLS/SSL. So they might not use encryption even if they wanted to. Tragic 💀

it should be noted that this document merely describes client-to-server encryption. There are still other attack vectors, like:

  • malicious administrators
  • compromised servers
  • insecure server-to-server communication
  • channels that do not enforce encryption for all channel members
  • malicious clients
  • compromised client machines on which logs are stored
those attacks can't, by their very nature, be addressed by client-to-server encryption. If a user fears any of the threats above, additional safeguards are needed. Stay alert, babe 🚨

this document does not address server links, because there are no commonly accepted ports or even back-end protocols for them. Ports and back-end protocols are normally set up through a bilateral agreement. All operators are encouraged to use strong encryption for back-end traffic, no matter whether they offer IRC via TLS/SSL to end users 🫶

4. IANA Considerations 📋

an assignment of TCP port 6697 for IRC via TLS/SSL has been made 🎉 The service name is "ircs-u" and the description is "Internet Relay Chat via TLS/SSL":

ircs-u  6697/tcp       Internet Relay Chat via TLS/SSL

5. Normative References 📚

  • [RFC1459] Oikarinen, J. and D. Reed, "Internet Relay Chat Protocol", RFC 1459, May 1993.
  • [RFC2810] Kalt, C., "Internet Relay Chat: Architecture", RFC 2810, April 2000.
  • [RFC2811] Kalt, C., "Internet Relay Chat: Channel Management", RFC 2811, April 2000.
  • [RFC2812] Kalt, C., "Internet Relay Chat: Client Protocol", RFC 2812, April 2000.
  • [RFC2813] Kalt, C., "Internet Relay Chat: Server Protocol", RFC 2813, April 2000.
  • [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.

6. Informative References 🦋

7. Acknowledgements 💜

thanks go to the IRC community at large for reaching a consensus 🌸

special thanks go to the IRC operators who were eager to support port 6697 on their respective networks 🙌

special thanks also go to Nevil Brownlee and James Schaad for working on this document in their capacities as Independent Submissions Editor and Reviewer, respectively ✨

Appendix A. Supporting Data 📊

as of October 2010, out of the top twenty IRC networks [TOP100] [MAVERICK], ten support TLS/SSL. Only one of those networks does not support TLS/SSL via port 6697 and has no plans to support it. All the others supported it already or started supporting it after being contacted by the author 🫶 A more detailed analysis exists, but it doesn't fit within the scope of this document.

Authors' Address 🖋️

Richard Hartmann Munich Germany

EMail: richih.mailinglist@gmail.com URI: http://richardhartmann.de

📦 where this page comes from