RFC 7590
Use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP)
RFC 7590: Use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP) 🎀
okay so this RFC is literally about how XMPP should use TLS, and it's giving security glow-up 💅✨ It's an Internet Standards Track document from the IETF, published June 2015 (ISSN 2070-1721), and it's written by P. Saint-Andre (&yet) and T. Alkemade. It updates RFC 6120, the core XMPP spec. The header doesn't list anything it obsoletes.
Its whole job is to make TLS recommendations for XMPP stronger, because the threat model on the Internet got way scarier. 😭
Abstract
This doc gives recommendations for using Transport Layer Security (TLS) in XMPP, and it updates RFC 6120 🦋
Status of This Memo
This is an Internet Standards Track document 🌸
It's a product of the IETF, it reflects the consensus of the IETF community, it got public review, and the IESG approved it for publication. If you want more info on Internet Standards, check Section 2 of RFC 5741 📚
Info about the current status, any errata, and how to send feedback lives at http://www.rfc-editor.org/info/rfc7590 🔗
Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved. 🎀
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Read those carefully, because they spell out your rights and restrictions. Any Code Components pulled out of this doc must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License says 💖
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 2
3. Recommendations . . . . . . . . . . . . . . . . . . . . . . . 3
3.1. Support for TLS . . . . . . . . . . . . . . . . . . . . . 3
3.2. Compression . . . . . . . . . . . . . . . . . . . . . . . 3
3.3. Session Resumption . . . . . . . . . . . . . . . . . . . 3
3.4. Authenticated Connections . . . . . . . . . . . . . . . . 4
3.5. Server Name Indication . . . . . . . . . . . . . . . . . 5
3.6. Human Factors . . . . . . . . . . . . . . . . . . . . . . 5
4. Security Considerations . . . . . . . . . . . . . . . . . . . 5
5. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
5.1. Normative References . . . . . . . . . . . . . . . . . . 6
5.2. Informative References . . . . . . . . . . . . . . . . . 7
Appendix A. Implementation Notes . . . . . . . . . . . . . . . . 9
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 9
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 91. Introduction ✨
XMPP [RFC6120] (aka its precursor, the "Jabber protocol") has been using TLS [RFC5246] (and its precursor, SSL) since 1999 🕰️ Both [RFC6120] and its predecessor [RFC3920] gave recommendations on using TLS with XMPP. But the threat landscape is wild now, so this doc gives stronger recommendations 💀
Specifically, this doc updates [RFC6120] by saying XMPP implementations and deployments MUST follow the best current practices in "Recommendations for Secure Use of TLS and DTLS" [RFC7525]. That covers stronger guidance on SSL/TLS protocol versions, fallback to lower versions, TLS-layer compression, TLS session resumption, cipher suites, public key lengths, forward secrecy, and other TLS-with-XMPP stuff too 🔥
2. Terminology 📖
Security terms here mean what [RFC4949] defines them to mean 🧚
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🫶
3. Recommendations 💜
The best current practices in "Recommendations for Secure Use of TLS and DTLS" [RFC7525] are included here by reference. Rather than repeating them, this doc mostly adds extra info about implementing and deploying XMPP tech securely 🌈
3.1. Support for TLS 🔐
Support for TLS (specifically, the XMPP profile of STARTTLS) is mandatory for XMPP implementations, as already specified in [RFC6120] and its predecessor [RFC3920] 💅
Here's the tricky part 👀 The server (the XMPP receiving entity) that a client or peer server (the XMPP initiating entity) connects to might not offer a stream feature of <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>. Usually that feature means the server supports and offers TLS, but an attacker could strip it out (see Section 2.1 of [RFC7457]) 😱 The <required/> child element of the <starttls/> stream feature says TLS negotiation is mandatory, but an attacker could strip that out too.
So the initiating entity MUST NOT be deterred from trying TLS negotiation just because the receiving entity doesn't advertise TLS support. Instead, the initiating entity SHOULD (based on local policy) keep going with stream negotiation and try to negotiate TLS 🙌
3.2. Compression 🗜️
XMPP supports an application-layer compression tech [XEP-0138]. It might have slightly stronger security properties than TLS-layer compression, since it gets turned on after Simple Authentication and Security Layer (SASL) authentication, as described in [XEP-0170]. Still, this doc neither encourages nor discourages using XMPP-layer compression 🤷♀️
3.3. Session Resumption 🔄
To make XMPP communication more reliable, clients and servers commonly implement the stream management extension [XEP-0198]. That spec has a method for resuming XMPP streams at the application layer, but using session resumption at the TLS layer too further optimizes resuming an XMPP session (see [XEP-0198] for the details) ✨
Whether or not XEP-0198 is used for application-layer session resumption, implementations MUST follow the recommendations in [RFC7525] about TLS-layer session resumption 💖
3.4. Authenticated Connections 🪪
Both the core XMPP spec [RFC6120] and the CertID spec [RFC6125] give recommendations and requirements for certificate validation with authenticated connections. This doc doesn't supersede them. For example, it doesn't change the [RFC6120] recommendations about Subject Alternative Names or other certificate details that need support for authenticating XMPP connections with PKIX certificates 🧐
Wherever possible, prefer authenticated connections (along with SASL [RFC4422]), as the core XMPP spec [RFC6120] already says. In particular:
- Clients MUST authenticate servers.
- Servers MUST authenticate clients.
- Servers SHOULD authenticate other servers.
This doc doesn't require servers to authenticate peer servers, although that authentication is strongly preferred. Honestly, though, in multi-tenant environments it can be super hard to get and deploy PKIX certificates with the right Subject Alternative Names (see [XMPP-DNA] and [PKIX-POSH] for details) 😭 To deal with that, the Domain Name Associations (DNAs) spec [XMPP-DNA] describes a framework for XMPP server authentication methods. These include PKIX, DNS-Based Authentication of Named Entities (DANE) as defined in [DANE-SRV], and PKIX over Secure HTTP (POSH) as defined in [PKIX-POSH]. These methods can give a basis for server identity verification when proper PKIX certificates can't be obtained and deployed 🦋
Because eavesdropping is so pervasive [RFC7258], an encrypted but unauthenticated connection might still be better than an unencrypted one in these situations (similar to the "better-than-nothing security" approach for IPsec [RFC5386]). Encrypted but unauthenticated connections include ones negotiated with anonymous Diffie-Hellman mechanisms or with self-signed certificates, among others. Specifically for XMPP server-to-server interactions, it can be reasonable for XMPP server implementations to accept encrypted but unauthenticated connections when Server Dialback keys [XEP-0220] are used. Those keys on their own only provide weak identity verification (made stronger with DNSSEC [RFC4033]), but at least they enable encryption of server-to-server connections 🔒 The DNA prooftypes mentioned above are meant to reduce the leftover need for encrypted but unauthenticated connections in these situations.
3.5. Server Name Indication 🏷️
There's no harm in supporting the TLS Server Name Indication (SNI) extension [RFC6066], but it isn't necessary. XMPP already gets that same function from the 'to' address of the initial stream header, as explained in Section 4.7.2 of [RFC6120] 💁♀️
3.6. Human Factors 👩💻
It's strongly encouraged that XMPP clients give end users (and that XMPP servers give administrators) ways to do the following:
- Determine if a given incoming or outgoing XML stream is encrypted using TLS.
- Determine the version of TLS used for encryption of a given stream.
- If authenticated encryption is used, determine how the connection was authenticated or verified (e.g., via PKI, DANE, POSH, or Server Dialback).
- Inspect the certificate offered by an XMPP server.
- Determine the cipher suite used to encrypt a connection.
- Be warned if the certificate changes for a given server.
Part 1 done 🎀 Part 2 is coming with Security Considerations (the spicy stuff 💀), References, Appendix A, Acknowledgements, and Authors' Addresses. Stay tuned, bestie 🦋
4. Security Considerations ✨
okay bestie, this section is SERIOUS but also iconic, so let's go 💅🔐
TLS is basically our bodyguard for the info we're sending around 🛡️ It can help limit how much stuff someone can connect between the XMPP app layer and the network and transport layers underneath. Here's the tea: in typical XMPP deployments, routing data like the XMPP to and from addresses doesn't just sit around at rest on the middle systems, because there's only one hop between any two XMPP servers 🙈 So if we encrypt all the hops (sender's client to sender's server, sender's server to recipient's server, and recipient's server to recipient's client), we can help cut down on how much metadata might leak 🧚
Now the scary part 😭 It's possible that XMPP servers themselves get compromised. If that happens, per-hop encryption won't protect the XMPP communications, and even end-to-end encryption of (parts of) stanza payloads would leave addressing info and roster data totally exposed 💀 And by the same token, XMPP clients (or the end-user devices where those clients live) could get compromised too, which would leave users completely at the mercy of an attacker. Yikes 🥺
This document and the related efforts to make the XMPP network more secure are built on one big assumption: that XMPP servers and clients haven't been subject to widespread compromise 🫶 If that holds, then using per-hop TLS channel encryption everywhere, plus much more deployment of end-to-end object encryption tech, will protect XMPP communications to a measurable degree compared to the alternatives. Slay that defense plan 👑
Last bit: this document only covers communication over the XMPP network. It does NOT take gateways to non-XMPP networks into account. For example, if you want the security considerations for gateways between XMPP and the Session Initiation Protocol (SIP), check out [RFC7247] and [RFC7572] 🦋
5. References 📚
5.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4949] Shirey, R., "Internet Security Glossary, Version 2",
FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
<http://www.rfc-editor.org/info/rfc4949>.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246,
DOI 10.17487/RFC5246, August 2008,
<http://www.rfc-editor.org/info/rfc5246>.
[RFC6120] Saint-Andre, P., "Extensible Messaging and Presence
Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120,
March 2011, <http://www.rfc-editor.org/info/rfc6120>.
[RFC6125] Saint-Andre, P. and J. Hodges, "Representation and
Verification of Domain-Based Application Service Identity
within Internet Public Key Infrastructure Using X.509
(PKIX) Certificates in the Context of Transport Layer
Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
2011, <http://www.rfc-editor.org/info/rfc6125>.
[RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of Transport Layer
Security (TLS) and Datagram Transport Layer Security
(DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
2015, <http://www.rfc-editor.org/info/rfc7525>.5.2. Informative References
[DANE-SRV] Finch, T., Miller, M., and P. Saint-Andre, "Using DNS-
Based Authentication of Named Entities (DANE) TLSA
records with SRV and MX records.", Work in Progress,
draft-ietf-dane-srv-14, April 2015.
[PKIX-POSH] Miller, M. and P. Saint-Andre, "PKIX over Secure HTTP
(POSH)", Work in Progress, draft-ietf-xmpp-posh-04,
February 2015.
[RFC3920] Saint-Andre, P., Ed., "Extensible Messaging and Presence
Protocol (XMPP): Core", RFC 3920, DOI 10.17487/RFC3920,
October 2004, <http://www.rfc-editor.org/info/rfc3920>.
[RFC4033] Arends, R., Austein, R., Larson, M., Massey, D., and S.
Rose, "DNS Security Introduction and Requirements",
RFC 4033, DOI 10.17487/RFC4033, March 2005,
<http://www.rfc-editor.org/info/rfc4033>.
[RFC4422] Melnikov, A., Ed. and K. Zeilenga, Ed., "Simple
Authentication and Security Layer (SASL)", RFC 4422,
DOI 10.17487/RFC4422, June 2006,
<http://www.rfc-editor.org/info/rfc4422>.
[RFC5386] Williams, N. and M. Richardson, "Better-Than-Nothing
Security: An Unauthenticated Mode of IPsec", RFC 5386,
DOI 10.17487/RFC5386, November 2008,
<http://www.rfc-editor.org/info/rfc5386>.
[RFC6066] Eastlake 3rd, D., "Transport Layer Security (TLS)
Extensions: Extension Definitions", RFC 6066,
DOI 10.17487/RFC6066, January 2011,
<http://www.rfc-editor.org/info/rfc6066>.
[RFC7247] Saint-Andre, P., Houri, A., and J. Hildebrand,
"Interworking between the Session Initiation Protocol
(SIP) and the Extensible Messaging and Presence Protocol
(XMPP): Architecture, Addresses, and Error Handling",
RFC 7247, DOI 10.17487/RFC7247, May 2014,
<http://www.rfc-editor.org/info/rfc7247>.
[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is
an Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May
2014, <http://www.rfc-editor.org/info/rfc7258>.
[RFC7457] Sheffer, Y., Holz, R., and P. Saint-Andre, "Summarizing
Known Attacks on Transport Layer Security (TLS) and
Datagram TLS (DTLS)", RFC 7457, DOI 10.17487/RFC7457,
February 2015, <http://www.rfc-editor.org/info/rfc7457>.
[RFC7572] Saint-Andre, P., Houri, A., and J. Hildebrand,
"Interworking between the Session Initiation Protocol
(SIP) and the Extensible Messaging and Presence Protocol
(XMPP): Instant Messaging", RFC 7572,
DOI 10.17487/RFC7572, June 2015,
<http://www.rfc-editor.org/info/rfc7572>.
[XEP-0138] Hildebrand, J. and P. Saint-Andre, "Stream Compression",
XSF XEP 0138, May 2009,
<http://xmpp.org/extensions/xep-0138.html>.
[XEP-0170] Saint-Andre, P., "Recommended Order of Stream Feature
Negotiation", XSF XEP 0170, January 2007,
<http://xmpp.org/extensions/xep-0170.html>.
[XEP-0198] Karneges, J., Saint-Andre, P., Hildebrand, J., Forno, F.,
Cridland, D., and M. Wild, "Stream Management", XSF XEP
0198, June 2011,
<http://xmpp.org/extensions/xep-0198.html>.
[XEP-0220] Miller, J., Saint-Andre, P., and P. Hancke, "Server
Dialback", XSF XEP 0220, August 2014,
<http://xmpp.org/extensions/xep-0220.html>.
[XMPP-DNA] Saint-Andre, P. and M. Miller, "Domain Name Associations
(DNA) in the Extensible Messaging and Presence Protocol
(XMPP)", Work in Progress, draft-ietf-xmpp-dna-10, March
2015.Appendix A. Implementation Notes 🎀
Some governments enforce legislation prohibiting the export of strong cryptographic technologies. Nothing in this document ought to be taken as advice to violate such prohibitions. Don't be the person who ignores that 🙅♀️
Acknowledgements 🌸
The authors would like to thank the following individuals for their input: Dave Cridland, Philipp Hancke, Olle Johansson, Steve Kille, Tobias Markmann, Matt Miller, and Rene Treffer.
Roni Even caught several important issues in his review on behalf of the General Area Review Team. Literal MVP 🏆
Ben Campbell, Spencer Dawkins, and Barry Leiba provided helpful input during IESG review.
Thanks to Leif Johansson and Orit Levin as chairs of the UTA WG, Ben Campbell and Joe Hildebrand as chairs of the XMPP WG, and Stephen Farrell as the sponsoring Area Director. ✨
Authors' Addresses 💌
Peter Saint-Andre &yet
EMail: peter@andyet.com URI: https://andyet.com/
Thijs Alkemade
EMail: me@thijsalkema.de
📦 where this page comes from
- ietf: rfc7590 2015-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms