RFC 7712

Domain Name Associations (DNA) in the Extensible Messaging and Presence Protocol (XMPP)

📅 published November 2015, from ietf

Domain Name Associations (DNA) in the Extensible Messaging and Presence Protocol (XMPP) 💖

Part 1 of 5

RFC 7712 🎀 is a Standards Track doc, so it's the real deal. Its status is "Internet Standards Track," and it went through the whole IETF process: public review, consensus, and approval from the IESG. It was published in November 2015 and has ISSN 2070-1721.

The authors are P. Saint-Andre (&yet), M. Miller (Cisco Systems, Inc.), and P. Hancke (&yet). 🫶 The header doesn't list anything this one obsoletes or updates.

Abstract ✨

Okay so this doc makes XMPP way more secure in two ways 🔥. First, it explains how to build a strong link between a domain name and an XML stream, using something called "prooftypes" 🦋. Second, it shows how to securely delegate a service domain name (think example.com) to a target server hostname (like hosting.example.net) 💅. This matters a LOT in multi-tenanted setups, where one server hosts a ton of domains at once 😭.

Status of This Memo 🌸

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 5741.

Want the current status, any errata, or a way to send feedback? Head to http://www.rfc-editor.org/info/rfc7712. 🧚

Copyright (c) 2015 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Read these carefully, because they spell out your rights and restrictions for this doc. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License.

Table of Contents 🍓

   1. Introduction ....................................................3
   2. Terminology .....................................................4
   3. Client-to-Server (C2S) DNA ......................................4
      3.1. C2S Flow ...................................................4
      3.2. C2S Description ............................................5
   4. Server-to-Server (S2S) DNA ......................................5
      4.1. S2S Flow ...................................................6
      4.2. A Simple S2S Scenario .....................................10
      4.3. No Mutual PKIX Authentication .............................12
      4.4. Piggybacking ..............................................13
           4.4.1. Assertion ..........................................13
           4.4.2. Supposition ........................................15
   5. Alternative Prooftypes .........................................16
      5.1. DANE ......................................................16
      5.2. POSH ......................................................17
   6. Secure Delegation and Multi-Tenancy ............................18
   7. Prooftype Model ................................................18
   8. Guidance for Server Operators ..................................19
   9. IANA Considerations ............................................20
      9.1. POSH Service Name for xmpp-client Service .................20
      9.2. POSH Service Name for xmpp-server Service .................20
   10. Security Considerations .......................................20
   11. References ....................................................21
      11.1. Normative References .....................................21
      11.2. Informative References ...................................23
   Acknowledgements ..................................................24
   Authors' Addresses ................................................24

1. Introduction ✨

Picture this: systems that use XMPP [RFC6120] need a strong link between the DNS domain name of an XMPP service (like example.com) and the XML stream that a client or peer server starts with that service 🦋. Basically, the client or peer server has to verify the identity of the server it's connecting to. Servers also need to verify incoming connections from other servers 🔥.

Up to now, that verification has been built on info from the Domain Name System (DNS), the Public Key Infrastructure (PKI), or similar sources 💅. XMPP as defined in [RFC6120] assumed that Domain Name Associations (DNA) are proved using the "PKIX prooftype." So the server's proof is a PKIX certificate, checked against the XMPP profile of the matching rules from [RFC6125] and the overall validation rules from [RFC5280]. The client gets its verification material out of band, as a trusted root, and secure DNS isn't needed 🫶.

This doc extends the domain name association idea inside XMPP and does three things 👑:

  1. It generalizes the current model so more prooftypes can be defined if needed.
  2. It gives a basis for modernizing some prooftypes to keep up with progress in underlying tech, like DNS Security [RFC4033] 🌈.
  3. It describes the flow of operations for setting up a domain name association.

This doc also gives guidelines for securely delegating a service domain name (like example.com) to a target server hostname (like hosting.example.net) 🎀. Why does secure delegation even matter? Because turning the domain name of an XMPP service into the IP address where an XML stream gets negotiated (see [RFC6120]) can involve delegating the service domain name to a target server hostname, using stuff like DNS SRV records [RFC2782] 😭. There's a more detailed explanation of this delegation problem in [RFC7711]. The domain name association can only be verified if the delegation is done securely 🔒.

2. Terminology 📚

This doc borrows XMPP terminology from [RFC6120] and [XEP-0220], DNS terminology from [RFC1034], [RFC1035], [RFC2782], and [RFC4033], and security terminology from [RFC4949] and [RFC5280] 💜. The terms "reference identity" and "presented identity" are used as defined in the "CertID" specification [RFC6125]. For consistency with [RFC7673], this doc uses the terms "service domain name" and "target server hostname" to refer to the same entities that [RFC6125] calls "source domain" and "derived domain" 🧠.

3. Client-to-Server (C2S) DNA 🌸

Client-to-server is way simpler than server-to-server, because the client doesn't assert a domain name. That means verification only happens in one direction 🦋. So we're covering this case first, to help you get how domain name associations work in XMPP 🧚.

3.1. C2S Flow 💅

Here's the flow chart for setting up a domain name association for an XML stream from a client (C) to a server (S), using the standard PKIX prooftype from [RFC6120] 🌈:

                           |
                   DNS RESOLUTION ETC.
                           |
   +-----------------STREAM HEADERS---------------------+
   |                                                    |
   |  C: <stream to='a.example'>                        |
   |                                                    |
   |  S: <stream from='a.example'>                      |
   |                                                    |
   +----------------------------------------------------+
                           |
   +-----------------TLS NEGOTIATION--------------------+
   |                                                    |
   |  S: Server Certificate                             |
   |                                                    |
   +----------------------------------------------------+
                           |
             (client checks certificate and
              establishes DNA for a.example)

3.2. C2S Description 🫶

Here's the simplified order of events (see [RFC6120] for the full details) for setting up an XML stream from a client (user@a.example) to a server (a.example) 💖:

  1. The client resolves the service _xmpp-client._tcp.a.example via DNS.
  2. The client opens a TCP connection to the resolved IP address.
  3. The client sends an initial stream header to the server: <stream:stream to='a.example'>
  4. The server sends a response stream header back to the client, asserting that it is a.example: <stream:stream from='a.example'>
  5. The parties try TLS negotiation, during which the XMPP server (acting as a TLS server) presents a PKIX certificate proving that it is a.example 🔐.
  6. The client checks the PKIX certificate the server gave it. If the proof is consistent with the XMPP profile of the matching rules from [RFC6125] and the certificate is otherwise valid under [RFC5280], then the client accepts that there's a strong domain name association between its stream to the target server and the DNS domain name of the XMPP service ✅.
⚠️ The server's certificate might not be acceptable to the client, and that's a real thing to plan for. One example: the server might host multiple domains, and then secure delegation as described in Section 6 is necessary. Another example: the server might present a self-signed certificate. That means the client has to either (1) apply the fallback process described in Section 6.6.4 of [RFC6125], or (2) prompt the user to accept an unauthenticated connection, as described in Section 3.4 of [RFC7590] 🙈.

4. Server-to-Server (S2S) DNA 💜

Server-to-server is a lot more complex than client-to-server 😭. It involves checking domain name associations in both directions, plus other "wrinkles" covered in the following sections 🌈. In some parts of the flow, server-to-server communication uses the Server Dialback protocol, which was first specified in the now-obsolete [RFC3920] and has since moved to [XEP-0220] 🦋. For considerations when using it with TLS and DNSSEC, check "Impact of TLS and DNSSEC on Dialback" [XEP-0344] 🔒. Also, "Bidirectional Server-to-Server Connections" [XEP-0288] gives you a way to use server-to-server connections for bidirectional exchange of XML stanzas, which cuts down the complexity of some of these processes 👑.

4.1. S2S Flow ✨

Okay bestie, these flow charts are about to change your whole understanding of server handshakes 🦋 They show how two servers set up domain name associations (DNA) when Server 1 (the initiating entity) and Server 2 (the receiving entity) meet, and the rest of the doc unpacks every step 💅

A simple S2S scenario goes like this:

                       |
                DNS RESOLUTION ETC.
                       |
   +-------------STREAM HEADERS--------------------+
   |                                               |
   |  A: <stream from='a.example' to='b.example'>  |
   |                                               |
   |  B: <stream from='b.example' to='a.example'>  |
   |                                               |
   +-----------------------------------------------+
                       |
   +-------------TLS NEGOTIATION-------------------+
   |                                               |
   |  B: Server Certificate                        |
   |  B: Certificate Request                       |
   |  A: Client Certificate                        |
   |                                               |
   +-----------------------------------------------+
                       |
       (A establishes DNA for b.example)
                       |

After the domain name association has been set up in one direction, the servers can do mutual authentication with the Simple Authentication and Security Layer (SASL) [RFC4422], which means DNAs get created in both directions 🙌

                       |
   +-------------AUTHENTICATION--------------------+
   |                   |                           |
   |       {valid client certificate?} --+         |
   |                   |                 |         |
   |                   | yes         no  |         |
   |                   v                 |         |
   |             SASL EXTERNAL           |         |
   |             (mutual auth)           |         |
   |   (B establishes DNA for a.example) |         |
   +-------------------------------------|---------+
                                         |

But if mutual authentication can't be completed using SASL, the receiving server still needs a DNA somehow, just a different way 😭 That plot twist is covered in Section 4.3.

                                         |
                       +-----------------+
                       |
           (Section 4.3: No Mutual PKIX Authentication)
                       |
                       | B needs to establish DNA
                       | for this stream from a.example,
                       | so A asserts its identity
                       |
   +----------DIALBACK IDENTITY ASSERTION----------+
   |                                               |
   |  A: <db:result from='a.example'               |
   |                to='b.example'>                |
   |       some-dialback-key                       |
   |     </db:result>                              |
   |                                               |
   +-----------------------------------------------+
                       |

                DNS RESOLUTION ETC.
                       |
   +-------------STREAM HEADERS--------------------+
   |                                               |
   |  B: <stream from='b.example' to='a.example'>  |
   |                                               |
   |  A: <stream from='a.example' to='b.example'>  |
   |                                               |
   +-----------------------------------------------+
                       |
   +-------------TLS NEGOTIATION-------------------+
   |                                               |
   |  A: Server Certificate                        |
   |                                               |
   +-----------------------------------------------+
                       |
   +----------DIALBACK IDENTITY VERIFICATION-------+
   |                                               |
   |  B: <db:verify from='b.example'               |
   |                to='a.example'                 |
   |                id='...'>                      |
   |       some-dialback-key                       |
   |     </db:verify>                              |
   |                                               |
   |  A: <db:verify from='a.example'               |
   |                to='b.example'                 |
   |                type='valid'                   |
   |                id='...'>                      |
   |                                               |
   +-----------------------------------------------+
                       |
       (B establishes DNA for a.example)
                       |

Now, what if one server hosts extra service names? Say Server 2 also hosts c.example next to b.example, and Server 1 hosts rooms.a.example next to a.example. Then the servers can use Server Dialback "piggybacking" to set up extra DNAs on the same stream, as described in Section 4.4 🧚

There are two flavours of piggybacking. The first one is called "assertion" here 💜

                       |
         (Section 4.4.1: Piggybacking Assertion)
                       |
   +----------DIALBACK IDENTITY ASSERTION----------+
   |                                               |
   |  B: <db:result from='c.example'               |
   |                to='a.example'/>               |
   |                                               |
   +-----------------------------------------------+
                       |
   +-------DNA ESTABLISHMENT AS ABOVE--------------+
   |                                               |
   |    DNS RESOLUTION, STREAM HEADERS,            |
   |    TLS NEGOTIATION, AUTHENTICATION            |
   |                                               |
   +-----------------------------------------------+
                       |
   +----------DIALBACK IDENTITY VERIFICATION-------+
   |                                               |
   |  A: <db:result from='a.example'               |
   |                to='c.example'                 |
   |                type='valid'/>                 |
   |                                               |
   +-----------------------------------------------+
                       |

The second flavour is called "supposition" 🌸

                       |
         (Section 4.4.2: Piggybacking Supposition)
                       |
   +-----------SUBSEQUENT CONNECTION---------------+
   |                                               |
   |  B: <stream from='c.example'                  |
   |             to='rooms.a.example'>             |
   |                                               |
   |  A: <stream from='rooms.a.example'            |
   |             to='c.example'>                   |
   |                                               |
   +-----------------------------------------------+
                       |
   +-------DNA ESTABLISHMENT AS ABOVE--------------+
   |                                               |
   |    DNS RESOLUTION, STREAM HEADERS,            |
   |    TLS NEGOTIATION, AUTHENTICATION            |
   |                                               |
   +-----------------------------------------------+
                       |
   +-----------DIALBACK OPTIMIZATION---------------+
   |                                               |
   |  B: <db:result from='c.example'               |
   |                to='rooms.a.example'/>         |
   |                                               |
   |  B: <db:result from='rooms.a.example'         |
   |                to='c.example'                 |
   |                type='valid'/>                 |
   |                                               |
   +-----------------------------------------------+

4.2. A Simple S2S Scenario 🎀

Let's walk through the happy path so the problem makes sense. This is the simplified order of events (see [RFC6120] for the full details) for setting up an XML stream between Server 1 (a.example) and Server 2 (b.example) 💖

  1. Server 1 resolves the service _xmpp-server._tcp.b.example via DNS.
  2. Server 1 opens a TCP connection to the resolved IP address.
  3. Server 1 sends an initial stream header to Server 2, saying that it is a.example:

<stream:stream from='a.example' to='b.example'>

  1. Server 2 sends a response stream header to Server 1, saying that it is b.example:

<stream:stream from='b.example' to='a.example'>

  1. The servers try TLS negotiation. Server 2 (acting as the TLS server) shows a PKIX certificate proving it is b.example, and Server 1 (acting as the TLS client) shows a PKIX certificate proving it is a.example 🔐
  2. Server 1 checks the PKIX certificate from Server 2, and Server 2 checks the PKIX certificate from Server 1. If those proofs line up with the XMPP profile of the matching rules from [RFC6125] and are otherwise valid under [RFC5280], each server accepts that there is a strong domain name association between its stream to the other party and the other party's DNS domain name. In other words, mutual authentication is achieved 🙌

A few simplifying assumptions hold up this "happy path" scenario, and honestly they're doing a lot of work:

  • The PKIX certificate Server 2 presents during TLS negotiation is acceptable to Server 1 and matches the expected identity.
  • The PKIX certificate Server 1 presents during TLS negotiation is acceptable to Server 2, which lets the parties finish mutual authentication.
  • There are no extra domains tied to Server 1 or Server 2. (Say, a sub-domain rooms.a.example on Server 1, or a second domain c.example on Server 2.)
  • The server administrators can get PKIX certificates from a widely accepted Certification Authority (CA) in the first place.
  • The server administrators run their own XMPP servers, rather than using hosting services.

Let's look at each of these "wrinkles" in turn 💅✨

4.3. No Mutual PKIX Authentication ✨

okay so what if the PKIX cert Server 1 shows during TLS isn't good enough for Server 2? 😭 Then Server 2 can't mutually authenticate Server 1, so it has to verify the asserted identity of Server 1 some other way 🫶

  1. Server 1 asserts that it is a.example using the Server Dialback protocol:
<db:result from='a.example' to='b.example'>
           some-dialback-key</db:result>
  1. Server 2 resolves via DNS the service _xmpp-server._tcp.a.example.
  2. Server 2 opens a TCP connection to the resolved IP address.
  3. Server 2 sends an initial stream header to Server 1, asserting that it is b.example:
<stream:stream from='b.example' to='a.example'>
  1. Server 1 sends a response stream header to Server 2, asserting that it is a.example:
<stream:stream from='a.example' to='b.example'>
  1. The servers attempt TLS negotiation, during which Server 1 (acting as a TLS server) presents a PKIX certificate.
  2. Server 2 checks the PKIX certificate that Server 1 provided (this might be the same certificate presented by Server 1 as a client certificate in the initial connection). However, Server 2 does not accept this certificate as proving that Server 1 is authorized as a.example and therefore uses another method (here, the Server Dialback protocol) to establish the domain name association. 🙈
  3. Server 2 proceeds with Server Dialback in order to establish the domain name association. In order to do this, it sends a request for verification as described in [XEP-0220]:
<db:verify from='b.example' to='a.example'
           id='...'>some-dialback-key</db:verify>
  1. Server 1 responds to this:
<db:verify from='a.example' to='b.example' id='...' type='valid/>

allowing Server 2 to establish the domain name association. 🎀

In some situations (e.g., if the Authoritative Server in Server Dialback presents the same certificate as the Originating Server), it is the practice of some XMPP server implementations to skip steps 8 and 9. These situations are discussed in "Impact of TLS and DNSSEC on Dialback" [XEP-0344]. 🦋

4.4. Piggybacking 🍓

4.4.1. Assertion

okay so picture the super common setup where Server 2 hosts not only b.example but also a second domain c.example (aka a "multi-tenanted" environment) 🏠 If a user of Server 2 who's on c.example wants to talk to a friend at a.example, Server 2 needs to send XMPP stanzas from the domain c.example instead of b.example. Server 2 could open a brand new TCP connection and negotiate new XML streams for the c.example and a.example domain pair, but that is wasteful (especially if Server 2 hosts a large number of domains) 💀 Server 2 already has a connection to a.example, so how can it say "hey, I'd like to add a new domain pair to the existing connection"? 🤔

The traditional method for doing so is the Server Dialback protocol [XEP-0220]. Here, Server 2 can send a <db:result/> element for the new domain pair over the existing stream.

<db:result from='c.example' to='a.example'>
  some-dialback-key
</db:result>

This <db:result/> element functions as Server 2's assertion that it is (also) c.example (thus, the element is functionally equivalent to the 'from' address of an initial stream header as previously described). 💅

In response to this assertion, Server 1 needs to obtain some kind of proof that Server 2 really is also c.example. If the certificate presented by Server 2 is also valid for c.example, then no further action is necessary. However, if not, then Server 1 needs to do a bit more work. Specifically, Server 1 can pursue the same strategy it used before:

  1. Server 1 resolves via DNS the service _xmpp-server._tcp.c.example.
  2. Server 1 opens a TCP connection to the resolved IP address (which might be the same IP address as for b.example).
  3. Server 1 sends an initial stream header to Server 2, asserting that it is a.example:
<stream:stream from='a.example' to='c.example'>
  1. Server 2 sends a response stream header to Server 1, asserting that it is c.example:
<stream:stream from='c.example' to='a.example'>
  1. The servers attempt TLS negotiation, during which Server 2 (acting as a TLS server) presents a PKIX certificate proving that it is c.example.
  2. At this point, Server 1 needs to establish that, despite different certificates, c.example is associated with the origin of the request. This is done using Server Dialback [XEP-0220]:
<db:verify from='a.example' to='c.example'
           id='...'>some-dialback-key</db:verify>
  1. Server 2 responds to this:
<db:verify from='c.example' to='a.example' id='...' type='valid/>

allowing Server 1 to establish the domain name association. 🌈

Now that Server 1 accepts the domain name association, it informs Server 2 of that fact:

<db:result from='a.example' to='c.example' type='valid'/>

The parties can then terminate the second connection, because it was used only for Server 1 to associate a stream with the domain name c.example (the dialback key links the original stream to the new association). 🧚

4.4.2. Supposition

Piggybacking can also happen in the other direction! 🔄 Picture the common setup where Server 1 provides XMPP services not only for a.example but also for a sub-domain such as a Multi-User Chat [XEP-0045] service at rooms.a.example. If a user from c.example at Server 2 wants to join a room on that groupchat service, Server 2 needs to send XMPP stanzas from the domain c.example to the domain rooms.a.example instead of a.example.

First, Server 2 needs to determine whether it can piggyback the domain rooms.a.example on the connection to a.example:

  1. Server 2 resolves via DNS the service _xmpp-server._tcp.rooms.a.example.
  2. Server 2 determines that this resolves to an IP address and port to which it is already connected.
  3. Server 2 determines that the PKIX certificate for that active connection would also be valid for the rooms.a.example domain and that Server 1 has announced support for dialback errors.

Server 2 sends a dialback key to Server 1 over the existing connection:

<db:result from='c.example' to='rooms.a.example'>
  some-dialback-key
</db:result>

Server 1 then informs Server 2 that it accepts the domain name association:

<db:result from='rooms.a.example' to='c.example' type='valid'/>

5. Alternative Prooftypes 🦄

The foregoing protocol flows assumed that domain name associations were proved using the PKIX prooftype. However, sometimes XMPP server administrators are unable or unwilling to obtain valid PKIX certificates for all of the domains they host at their servers. For example:

  • In order to issue a PKIX certificate, a CA might try to send email messages to authoritative mailbox names [RFC2142], but the administrator of a subsidiary service such as im.cs.podunk.example cannot receive email sent to hostmaster@podunk.example. 📧
  • A hosting provider such as hosting.example.net might not want to take on the liability of holding the certificate and private key for a tenant such as example.com (or the tenant might not want the hosting provider to hold its certificate and private key). 🔐
  • Even if PKIX certificates for each tenant can be obtained, the management of so many certificates can introduce a large administrative load. 😮‍💨

(Additional discussion can be found in [RFC7711].)

In these circumstances, prooftypes other than PKIX are desirable or necessary. As described below, two alternatives have been defined so far: DNS-Based Authentication of Named Entities (DANE) and PKIX over Secure HTTP (POSH). 💖

5.1. DANE

The DANE prooftype is defined as follows:

  1. The server's proof consists of either a service certificate or domain-issued certificate (TLSA usage PKIX-EE or DANE-EE; see [RFC6698] and [RFC7218]).
  2. The proof is checked by verifying an exact match or a hash of either the SubjectPublicKeyInfo or the full certificate.
  3. The client's verification material is obtained via secure DNS [RFC4033] as described in [RFC7673].
  4. Secure DNS is necessary in order to effectively establish an alternative chain of trust from the service certificate or domain-issued certificate to the DNS root.

The DANE prooftype makes use of DNS-Based Authentication of Named Entities [RFC6698], specifically the use of DANE with DNS SRV records [RFC7673]. For XMPP purposes, the following rules apply:

  • If there is no SRV resource record, pursue the fallback methods described in [RFC6120].
  • Use the 'to' address of the initial stream header to determine the domain name of the TLS client's reference identifier (because the use of the Server Name Indication extension (TLS SNI) [RFC6066] is purely discretionary in XMPP, as mentioned in [RFC6120]). ✨

5.2. POSH

The POSH prooftype is defined as follows:

  1. The server's proof consists of a PKIX certificate.
  2. The proof is checked according to the rules from [RFC6120] and [RFC6125].
  3. The client's verification material is obtained by retrieving a hash of the PKIX certificate over HTTPS at a well-known URI [RFC5785].
  4. Secure DNS is not necessary, because the HTTPS retrieval mechanism relies on the chain of trust from the public key infrastructure.

POSH is defined in [RFC7711]. For XMPP purposes, the following rules apply:

  • If no verification material is found via POSH, pursue the fallback methods described in [RFC6120].
  • Use the 'to' address of the initial stream header to determine the domain name of the TLS client's reference identifier (because the use of TLS SNI [RFC6066] is purely discretionary in XMPP, as mentioned in [RFC6120]). 🫶

The well-known URIs [RFC5785] to be used for POSH are:

  • "/.well-known/posh/xmpp-client.json" for client-to-server connections
  • "/.well-known/posh/xmpp-server.json" for server-to-server connections

6. Secure Delegation and Multi-Tenancy ✨

okay so one super common way to run XMPP is multi-tenancy 🏠 basically, XMPP services for example.com actually live on a server called hosting.example.net. This is pretty convenient in XMPP because of DNS SRV records [RFC2782], which can point to the hosting provider with a delegation like this:

_xmpp-server._tcp.example.com. 0 IN SRV 0 0 5269 hosting.example.net

Secure connections for multi-tenancy can totally work with the PKIX prooftype 🔐 if the provider only hosts a few domains (like related ones, e.g., jabber-de.example and jabber-ch.example). BUT 😭 it gets messy when the provider hosts tons of XMPP services for lots of different tenants (see [RFC7711] for the full tea ☕). There are two possible outcomes: either (1) server-to-server communication to example.com is unencrypted, or (2) it's TLS-encrypted but the certificates aren't checked, which is functionally the same as an anonymous key exchange. This is also true for client-to-server communication, so end users end up overriding certificate warnings or configuring their clients to accept or "pin" certificates for hosting.example.net instead of example.com. The root problem is that if DNSSEC isn't used, delegation via DNS SRV records is inherently insecure 💀

The specification for using SRV records with DANE [RFC7673] explains how to use DNSSEC for secure delegation with the DANE prooftype 🦋 and the POSH specification [RFC7711] explains how to use HTTPS redirects for secure delegation with the POSH prooftype 🌸

7. Prooftype Model 🧚

so generally speaking, a Domain Name Association (DNA) prooftype follows this definition 💜

prooftype: A mechanism for proving an association between a domain name and an XML stream, where the mechanism defines (1) the nature of the server's proof, (2) the matching rules for comparing the client's verification material against the server's proof, (3) how the client obtains its verification material, and (4) whether or not the mechanism depends on secure DNS.

PKIX, DANE, and POSH all follow this model 👑 (some prooftypes depend on, or get enhanced by, secure DNS [RFC4033] and so they also need to explain how they make sure delegation is secure). Other prooftypes are possible too, like TLS with Pretty Good Privacy (PGP) keys [RFC6091], a token mechanism such as Kerberos [RFC4120] or OAuth [RFC6749], and Server Dialback keys [XEP-0220] ✨

Now, the PKIX prooftype reuses the syntax of the XMPP Server Dialback protocol [XEP-0220] for signaling between servers, but this framework doc does NOT define how generating and validating Server Dialback keys (also specified in [XEP-0220]) counts as a DNA prooftype 🙈 that said, nothing here stops you from continuing to use Server Dialback for signaling, and a future spec (or an updated [XEP-0220]) might define a DNA prooftype for Server Dialback keys in a way that fits this framework 🫶

8. Guidance for Server Operators 🛠️

this document introduces the prooftype concept to explain and generalize how you build a strong association between the DNS domain name of an XMPP service and the XML stream that a client or peer server starts with that service 💅

The operations and management side of DNA prooftypes depends on which prooftypes an operator supports. For example:

  • To support the PKIX prooftype [RFC6120], an operator needs to get certificates for the XMPP server from a Certification Authority (CA). DNS Security is not required though 🎀
  • To support the DANE prooftype [RFC7673], an operator can generate its own certificates for the XMPP server or get them from a CA. On top of that, DNS Security is required 🔒
  • To support the POSH prooftype [RFC7711], an operator can generate its own certificates for the XMPP server or get them from a CA, but they ALSO need to deploy the web server for POSH files with certificates from a CA 🌐 DNS Security is not required here either

For considerations on using these prooftypes, check the relevant specs. Especially Section 13.7 of [RFC6120], Section 6 of [RFC7673], and Section 7 of [RFC7711] 📚

Also, these ops considerations stack up 📈 if an operator wants multiple prooftypes, the deployment gets more complex (e.g., the operator might get a PKIX certificate from a CA for the PKIX prooftype and generate their own certificate for the DANE prooftype). It's an unavoidable part of supporting as many prooftypes as needed so domain name associations can be set up in the biggest possible percentage of cases 💖

9. IANA Considerations 📝

The POSH specification [RFC7711] creates the "POSH Service Names" registry for use in well-known URIs [RFC5785]. This spec registers two service names for use in XMPP: xmpp-client and xmpp-server. The completed registration templates are below 👇

9.1. POSH Service Name for xmpp-client Service

Service name: xmpp-client

Change controller: IETF

Definition and usage:  Specifies the location of a POSH file
   containing verification material or a reference thereto that
   enables a client to verify the identity of a server for a
   client-to-server stream in XMPP

Specification: RFC 7712 (this document)

9.2. POSH Service Name for xmpp-server Service

Service name: xmpp-server

Change controller: IETF

Definition and usage:  Specifies the location of a POSH file
   containing verification material or a reference thereto that
   enables a server to verify the identity of a peer server for a
   server-to-server stream in XMPP

Specification: RFC 7712 (this document)

10. Security Considerations 🚨

okay this part is SERIOUS bestie 😤

For the PKIX prooftype, this document supplements but does NOT supersede the security considerations of [RFC6120] and [RFC6125] 🔐

For the DANE and POSH prooftypes, go read [RFC7673] and [RFC7711] respectively 📖

Any future prooftypes need to thoroughly describe how they conform to the prooftype model in Section 7 of this document 🫡

11. References 📚

11.1. Normative References

[RFC1034]   Mockapetris, P., "Domain names - concepts and
            facilities", STD 13, RFC 1034, DOI 10.17487/RFC1034,
            November 1987, <http://www.rfc-editor.org/info/rfc1034>.

[RFC1035]   Mockapetris, P., "Domain names - implementation and
            specification", STD 13, RFC 1035, DOI 10.17487/RFC1035,
            November 1987, <http://www.rfc-editor.org/info/rfc1035>.

[RFC2782]   Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for
            specifying the location of services (DNS SRV)", RFC 2782,
            DOI 10.17487/RFC2782, February 2000,
            <http://www.rfc-editor.org/info/rfc2782>.

[RFC4033]   Arends, R., Austein, R., Larson, M., Massey, D., and S.
            Rose, "DNS Security Introduction and Requirements",
            RFC 4033, DOI 10.17487/RFC4033, March 2005,
            <http://www.rfc-editor.org/info/rfc4033>.

[RFC4422]   Melnikov, A., Ed., and K. Zeilenga, Ed., "Simple
            Authentication and Security Layer (SASL)", RFC 4422,
            DOI 10.17487/RFC4422, June 2006,
            <http://www.rfc-editor.org/info/rfc4422>.

[RFC4949]   Shirey, R., "Internet Security Glossary, Version 2",
            FYI 36, RFC 4949, DOI 10.17487/RFC4949, August 2007,
            <http://www.rfc-editor.org/info/rfc4949>.

[RFC5280]   Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
            Housley, R., and W. Polk, "Internet X.509 Public Key
            Infrastructure Certificate and Certificate Revocation
            List (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280,
            May 2008, <http://www.rfc-editor.org/info/rfc5280>.

[RFC5785]   Nottingham, M. and E. Hammer-Lahav, "Defining Well-Known
            Uniform Resource Identifiers (URIs)", RFC 5785,
            DOI 10.17487/RFC5785, April 2010,
            <http://www.rfc-editor.org/info/rfc5785>.

[RFC6120]   Saint-Andre, P., "Extensible Messaging and Presence
            Protocol (XMPP): Core", RFC 6120, DOI 10.17487/RFC6120,
            March 2011, <http://www.rfc-editor.org/info/rfc6120>.

[RFC6125]   Saint-Andre, P. and J. Hodges, "Representation and
            Verification of Domain-Based Application Service Identity
            within Internet Public Key Infrastructure Using X.509
            (PKIX) Certificates in the Context of Transport Layer
            Security (TLS)", RFC 6125, DOI 10.17487/RFC6125,
            March 2011, <http://www.rfc-editor.org/info/rfc6125>.

[RFC6698]   Hoffman, P. and J. Schlyter, "The DNS-Based
            Authentication of Named Entities (DANE) Transport Layer
            Security (TLS) Protocol: TLSA", RFC 6698,
            DOI 10.17487/RFC6698, August 2012,
            <http://www.rfc-editor.org/info/rfc6698>.

[RFC7218]   Gudmundsson, O., "Adding Acronyms to Simplify
            Conversations about DNS-Based Authentication of Named
            Entities (DANE)", RFC 7218, DOI 10.17487/RFC7218,
            April 2014, <http://www.rfc-editor.org/info/rfc7218>.

[RFC7673]   Finch, T., Miller, M., and P. Saint-Andre, "Using
            DNS-Based Authentication of Named Entities (DANE) TLSA
            Records with SRV Records", RFC 7673,
            DOI 10.17487/RFC7673, October 2015,
            <http://www.rfc-editor.org/info/rfc7673>.

[RFC7711]   Miller, M. and P. Saint-Andre, "PKIX over Secure HTTP
            (POSH)", RFC 7711, DOI 10.17487/RFC7711, November 2015,
            <http://www.rfc-editor.org/info/rfc7711>.

[XEP-0220]  Miller, J., Saint-Andre, P., and P. Hancke, "Server
            Dialback", XSF XEP 0220, August 2014,
            <http://xmpp.org/extensions/xep-0220.html>.

11.2. Informative References ✨

Okay, bestie, here are the informative refs 📚 (the "good to know, not required to build it" stuff):

Acknowledgements 🫶

Richard Barnes, Stephen Farrell, and Jonas Lindberg were co-authors on earlier draft versions of this document. Iconic. 👑

Derek Atkins, Mahesh Jethanandani, and Dan Romascanu reviewed the document on behalf of the Security Directorate, the Operations and Management Directorate, and the General Area Review Team, respectively. Reviewers doing the lord's work 💅

During IESG review, Stephen Farrell and Barry Leiba gave super helpful input that made the spec better. ✨

Thanks to Dave Cridland (document shepherd), Joe Hildebrand (working group chair), and Ben Campbell (area director). 🎀

Peter Saint-Andre wants to acknowledge Cisco Systems, Inc., for employing him while he worked on earlier draft versions of this document. Thank you, Cisco! 💖

Authors' Addresses 📍

Peter Saint-Andre
&yet

Email: peter@andyet.com
URI:   https://andyet.com/


Matthew Miller
Cisco Systems, Inc.
1899 Wynkoop Street, Suite 600
Denver, CO  80202
United States

Email: mamille2@cisco.com


Philipp Hancke
&yet

Email: fippo@andyet.com
URI:   https://andyet.com/
📦 where this page comes from