XEP-0290: Encapsulated Digital Signatures in XMPP

Abstract:This document provides a technical specification for Encapsulated Digital Signatures in the Extensible Messaging and Presence Protocol (XMPP).
Author:Kurt Zeilenga
Copyright:© 1999 - 2010 XMPP Standards Foundation. SEE LEGAL NOTICES.
Status:Experimental
Type:Standards Track
Version:0.1
Last Updated:2011-01-26

WARNING: This Standards-Track document is Experimental. Publication as an XMPP Extension Protocol does not imply approval of this proposal by the XMPP Standards Foundation. Implementation of the protocol described herein is encouraged in exploratory implementations, but production systems are advised to carefully consider whether it is appropriate to deploy implementations of this protocol before it advances to a status of Draft.

Table of Contents


1. Introduction
2. Signing XMPP Stanzas
3. Transformation Algorithm
4. Stanza Element References
5. Inclusion and Checking of Timestamps
6. Mandatory-to-Implement Cryptographic Algorithms
7. Certificates
8. Security Considerations
9. XMPP Registrar Considerations
    9.1. XML Namespace Name for Signed Data in XMPP

Appendices
    A: Document Information
    B: Author Information
    C: Legal Notices
    D: Relation to XMPP
    E: Discussion Venue
    F: Requirements Conformance
    G: Notes
    H: Revision History

1. Introduction

This document provides a technical specification for Encapsulated Digital Signatures in Extensible Messaging and Presence Protocol (XMPP [1]).

XMPP Digital Signatures may be used to provide signer authentication, data integrity, non-repudiation, and other security services.

This extension is intended to be highly flexible, supporting a wide range of applications. The extension not only supports signing by the originator, but by other entities which handle XMPP stanzas. Multiple entities may independently sign a stanza.

A signed manifest approach is used to allow selective signing (only select elements may be included in the manifest) and to allow flexibility in handling verification errors.

This extension is intended to support optimistic signing.

This document offers an encapsulated signature approach based upon XML Signature [2] (XMLDSIG). Implementations of this extension not required to fully implement the XML DSIG specification, they may implement only the minimal subset necessary to support this extension.

It is noted that a number of object-level XMPP digital signature extensions have been specified over the years. These include RFC 3923 [3] (XMPP E2E), Encrypted Session Negotiation [4] (XMPP PGP), and Digital Signatures in XMPP [5]. The limited applicability of encapsulating signature approaches in XMPP is discussed in Design Considerations for Digital Signatures in XMPP [6].

2. Signing XMPP Stanzas

The process that a sending agent follows for securing stanzas is very similar regardless of the form of stanza (i.e., <iq/>, <message/>, or <presence/>).

The signer begins with the cleartext version of the <message/> stanza "S":

Example 1. 

<message from='juliet@capulet.net/balcony'
         id='183ef129'
         to='romeo@montague.net'>
    <thread>8996aef0-061d-012d-347a-549a200771aa</thread>
    <body>Wherefore art thou, Romeo?</body>
</message>

This is modified prior to signing as follows:

Example 2. 

<message from='juliet@capulet.net'
         id='183ef129'
         to='romeo@montague.net'
         type='chat'>
    <thread xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-1">8996aef0-061d-012d-347a-549a200771aa</thread>
    <body xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-2">Wherefore art thou, Romeo?</body>
</message>

The signer builds a stanza description object containing a signer element, the stanza element, and a timestamp element. The signer element value is the bare JID of the signing entity. When the signing entity is a service entity, the JID may only contain service domain. The stanza element is the stanza prepared above with each of its element replaced by an reference element.

Example 3. 

<stanza id="stanza-desc" xmlns="urn:xmpp:dsig:0">
    <signer>juliet@capulet.net</signer>
    <message from='juliet@capulet.net'
            id='183ef129'
            to='romeo@montague.net'
            type='chat'>            
        <reference>xxxx-1</reference>
        <reference>xxxx-2</reference>
    </message>
    <timestamp>2010-11-11T13:33:00.123Z</timestamp>
</stanza>

The signer then builds an XMLDSIG Manifest object which references each element via the xmpp:dsig:ref:0 URN and provides a digest over the element (after it has been modified to include a d:id attribute) as transformed by the transformation algorithm.

Example 4. 

<Manifest id="manifest">
    <Reference URI="urn:xmpp:dsig:ref:0#xxxx-1">
        <Transforms>
            <Transform Algorithm="urn:xmpp:dsig:transform:0"/>
        </Transform>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <DigestValue>...</DigestValue>
    </Reference>
    <Reference URI="urn:xmpp:dsig:ref:0#xxxx-2">
        <Transforms>
            <Transform Algorithm="urn:xmpp:dsig:transform:0"/>
        </Transform>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <DigestValue>...</DigestValue>
    </Reference>
</Manifest>

The signer then builds a SignedInfo element.

Example 5. 

<SignedInfo>
    <CanonicalizationMethod Algorithm="urn:xmpp:dsig:transform:0"/>
    <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/
    <Reference URI="#stanza-desc">
        <Transforms>
            <Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
        </Transform>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <DigestValue>...</DigestValue>
    </Reference>
    <Reference URI="#manifest" Type="http://www.w3.org/2000/09/xmldsig#Manifest">
        <Transforms>
            <Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
        </Transform>
        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
        <DigestValue>...</DigestValue>
    </Reference>
</SignedInfo>

And then produces a Signature element:

Example 6. 

<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
        <CanonicalizationMethod Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
        <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/
        <Reference URI="#stanza-desc">
            <Transforms>
                <Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
            </Transform>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <DigestValue>...</DigestValue>
        </Reference>
        <Reference URI="#manifest" Type="http://www.w3.org/2000/09/xmldsig#Manifest">
            <Transforms>
                <Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
            <DigestValue>...</DigestValue>
        </Reference>
    </SignedInfo>
    <SignatureValue/>
    <Object>
        <stanza id="stanza-desc" xmlns="urn:xmpp:dsig:0">
            <signer>juliet@capulet.net</signer>
            <message from='juliet@capulet.net'
                     id='183ef129'
                     to='romeo@montague.net'
                     type='chat'>            
                <reference>xxxx-1</reference>
                <reference>xxxx-2</reference>
            </message>
            <timestamp>2010-11-11T13:33:00.123Z</timestamp>
        </stanza>
    </Object>
    <Object>
        <Manifest id="manifest">
            <Reference URI="urn:xmpp:dsig:ref:0#xxxx-1">
                <Transforms>
                    <Transform Algorithm="urn:xmpp:dsig:transform:0"/>
                </Transform>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>...</DigestValue>
            </Reference>
            <Reference URI="urn:xmpp:dsig:ref:0#xxxx-2">
                <Transforms>
                    <Transform Algorithm="urn:xmpp:dsig:transform:0"/>
                </Transform>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>...</DigestValue>
            </Reference>
        </Manifest>
    </Object>
</Signature>

The signer than computes the SignatureValue element, processing the Signature element as a detached signature, and replaces the empty Signature element with it. Finally, the signer inserts the Signature element into stanza and forwards the stanza as it normally would.

Example 7. 

 
<message from='juliet@capulet.net'
         id='183ef129'
         to='romeo@montague.net'
         type='chat'>
    <thread xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-1">8996aef0-061d-012d-347a-549a200771aa</thread>
    <body xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-2">Wherefore art thou, Romeo?</body>
    <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
        <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
            <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/
            <Reference URI="#stanza-desc">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
                </Transform>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>...</DigestValue>
            </Reference>
            <Reference URI="#manifest" Type="http://www.w3.org/2000/09/xmldsig#Manifest">
                <Transforms>
                    <Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"/>
                </Transforms>
                <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                <DigestValue>...</DigestValue>
            </Reference>
        </SignedInfo>
        <SignatureValue>...</SignatureValue>
        <Object>
            <stanza id="stanza-desc" xmlns="urn:xmpp:dsig:0">
                <signer>juliet@capulet.net</signer>
                <message from='juliet@capulet.net'
                         id='183ef129'
                         to='romeo@montague.net'
                         type='chat'>            
                    <reference>xxxx-1</reference>
                    <reference>xxxx-2</reference>
                </message>
                <timestamp>2010-11-11T13:33:00.123Z</timestamp>
            <stanza>
        </Object>
        <Object>
            <Manifest id="manifest">
                <Reference URI="urn:xmpp:dsig:ref:0#xxxx-1">
                    <Transforms>
                        <Transform Algorithm="urn:xmpp:dsig:transform:0"/>
                    </Transform>
                    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                    <DigestValue>...</DigestValue>
                </Reference>
                <Reference URI="urn:xmpp:dsig:ref:0#xxxx-2">
                    <Transforms>
                        <Transform Algorithm="urn:xmpp:dsig:transform:0"/>
                    </Transform>
                    <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
                    <DigestValue>...</DigestValue>
                </Reference>
            </Manifest>
        </Object>
    </Signature>
 </message>

3. Transformation Algorithm

For referenced elements of a stanza, the referenced element is normalized (omitting comments), as detailed in Canonical XML [7], as a document subset of a document containing a stream element containing the appropriate jabber:client stanza element containing the stanza with the referenced elements. Note that jabber:client stanzas are used when constructing this document even when a server is signing a stanza to be sent to another server.

For the stanza in Example 2, the input document would be:

Example 8. 

<stream:stream xmlns='jabber:client" xmlns:stream='http://etherx.jabber.org/streams'>
    <message from='juliet@capulet.net'
             id='183ef129'
             to='romeo@montague.net'
             type='chat'>
        <thread xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-1">8996aef0-061d-012d-347a-549a200771aa</thread>
        <body xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-2">Wherefore art thou, Romeo?</body>
    </message>
</stream:stream>

The canonical form of element referenced by urn:xmpp:dsig:ref:0#xxx-1 would be:

Example 9. 

<thread xmlns="jabber:client" xmlns:d="urn:xmpp:dsig:0" d:id="xxxx-1">8996aef0-061d-012d-347a-549a200771aa</thread>

4. Stanza Element References

The URI 'uri:xmpp:dsig:ref:0#xxxx" refers to the child element of the stanza which contains the 'uri:xmpp:dsig:0' 'id' attribute with the value "xxxx".

5. Inclusion and Checking of Timestamps

Timestamps are included to help prevent replay attacks. All timestamps MUST conform to and be presented as UTC with no offset, always including the seconds and fractions of a second to three digits (resulting in a datetime 24 characters in length). Absent a local adjustment to the sending agent's perceived time or the underlying clock time, the sending agent MUST ensure that the timestamps it sends to the receiver increase monotonically (if necessary by incrementing the seconds fraction in the timestamp if the clock returns the same time for multiple requests). The following rules apply to the receiving application:

The foregoing timestamp checks assume that the recipient is online when the message is received. However, if the recipient is offline then the server will probably store the message for delivery when the recipient is next online (offline storage does not apply to <iq/> or <presence/> stanzas, only <message/> stanzas). As described in Best Practices for Handling Offline Messages [8], when sending an offline message to the recipient, the server SHOULD include delayed delivery data as specified in Delayed Delivery [9] so that the recipient knows that this is an offline message and also knows the original time of receipt at the server. In this case, the recipient SHOULD verify that the timestamp received in the encrypted message is within five minutes of the time stamped by the recipient's server in the <delay/> element.

6. Mandatory-to-Implement Cryptographic Algorithms

All implementations MUST support the following algorithms. Implementations MAY support other algorithms as well.

7. Certificates

To participate in end-to-end signing using the methods defined in this document, a client needs to possess an X.509 certificate. It is expected that many clients will generate their own (self-signed) certificates rather than obtain a certificate issued by a certification authority (CA). In any case the certificate MUST include an XMPP address that is represented using the ASN.1 Object Identifier "id-on-xmppAddr" as specified in Section 5.1.1 of RFC 3920bis.

8. Security Considerations

TBD.

9. XMPP Registrar Considerations

9.1 XML Namespace Name for Signed Data in XMPP

A URN sub-namespace of signed content for the Extensible Messaging and Presence Protocol (XMPP) is defined as follows.

URI:
urn:xmpp:dsig
Specification:
ProtoXEP
Description:
This is an XML namespace name of signed content for the Extensible Messaging and Presence Protocol as defined by ProtoXEP.
Registrant Contact:
XSF

Appendices

Appendix A: Document Information

Series: XEP
Number: 0290
Publisher: XMPP Standards Foundation
Status: Experimental
Type: Standards Track
Version: 0.1
Last Updated: 2011-01-26
Approving Body: XMPP Council
Dependencies: XMPP Core, XEP-0001
Supersedes: None
Superseded By: None
Short Name: N/A
Source Control: HTML  RSS
This document in other formats: XML  PDF

Appendix B: Author Information

Kurt Zeilenga

Email: Kurt.Zeilenga@Isode.COM
JabberID: Kurt.Zeilenga@Isode.COM

Appendix C: Legal Notices

Copyright

This XMPP Extension Protocol is copyright © 1999 - 2010 by the XMPP Standards Foundation (XSF).

Permissions

Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the "Specification"), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specification, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or substantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or publisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation.

Disclaimer of Warranty

## NOTE WELL: This Specification is provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. ##

Limitation of Liability

In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall the XMPP Standards Foundation or any author of this Specification be liable for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising from, out of, or in connection with the Specification or the implementation, deployment, or other use of the Specification (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if the XMPP Standards Foundation or such author has been advised of the possibility of such damages.

IPR Conformance

This XMPP Extension Protocol has been contributed in full conformance with the XSF's Intellectual Property Rights Policy (a copy of which can be found at <http://xmpp.org/extensions/ipr-policy.shtml> or obtained by writing to XMPP Standards Foundation, 1899 Wynkoop Street, Suite 600, Denver, CO 80202 USA).

Appendix D: Relation to XMPP

The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 3920) and XMPP IM (RFC 3921) specifications contributed by the XMPP Standards Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this document has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.

Appendix E: Discussion Venue

The primary venue for discussion of XMPP Extension Protocols is the <standards@xmpp.org> discussion list.

Discussion on other xmpp.org discussion lists might also be appropriate; see <http://xmpp.org/about/discuss.shtml> for a complete list.

Errata can be sent to <editor@xmpp.org>.

Appendix F: Requirements Conformance

The following requirements keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".

Appendix G: Notes

1. Extensible Messaging and Presence Protocol (XMPP) <http://xmpp.org/>.

2. XML Signature Syntax and Processing <http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/>.

3. RFC 3923: End-to-End Signing and Object Encryption for the Extensible Messaging and Presence Protocol (XMPP) <http://tools.ietf.org/html/rfc3923>.

4. XEP-0116: Encrypted Session Negotiation <http://xmpp.org/extensions/xep-0116.html>.

5. XEP-0285: Digital Signatures in XMPP <http://xmpp.org/extensions/xep-0285.html>.

6. XEP-0274: Design Considerations for Digital Signatures in XMPP <http://xmpp.org/extensions/xep-0274.html>.

7. Canonical XML 1.0 <http://www.w3.org/TR/xml-c14n>.

8. XEP-0160: Best Practices for Handling Offline Messages <http://xmpp.org/extensions/xep-0160.html>.

9. XEP-0203: Delayed Delivery <http://xmpp.org/extensions/xep-0203.html>.

Appendix H: Revision History

Note: Older versions of this specification might be available at http://xmpp.org/extensions/attic/

Version 0.1 (2011-01-26)

Initial published version.

(psa)

Version 0.0.1 (2010-11-29)

Proto-XEP draft.

(kdz)

END