XEP-0300: Use of Cryptographic Hash Functions in XMPP

WARNING: This Standards-Track document is Experimental. Publication as an XMPP Extension Protocol does not imply approval of this proposal by the XMPP Standards Foundation. Implementation of the protocol described herein is encouraged in exploratory implementations, but production systems are advised to carefully consider whether it is appropriate to deploy implementations of this protocol before it advances to a status of Draft.

1. Introduction
2. Requirements
3. XML Format
4. Hash Functions
    4.1. MD2
    4.2. MD4
    4.3. MD5
    4.4. SHA-0
    4.5. SHA-1
    4.6. SHA-2
    4.7. SHA-3
5. Algorithm Recommendations
6. Determining Support
7. Security Considerations
8. IANA Considerations
9. XMPP Registrar Considerations
    9.1. Protocol Namespaces
    9.2. Protocol Versioning
    9.3. Service Discovery Features
10. Acknowledgements

Appendices
    A: Document Information
    B: Author Information
    C: Legal Notices
    D: Relation to XMPP
    E: Discussion Venue
    F: Requirements Conformance
    G: Notes
    H: Revision History

1. Introduction

Various XMPP extensions make use of cryptographic hash functions, but they do so in different ways (e.g., some define XML elements and some define XML attributes) and often mandate support for different algorthms (e.g., SI File Transfer [1] uses MD5, Entity Capabilities [2] uses SHA-1, and Encrypted Session Negotiation [3] used SHA-256). The lack of a consistent approach to the use of cryptographic hash functions in XMPP extensions can lead to interoperability problems and security vulnerabilities. Therefore, this document recommends a common approach and XML element that can be re-used in any XMPP protocol extension.

2. Requirements

Agility: It is absolutely necessary to support more secure cryptographic hash functions as they become available, and to stop supporting less secure functions as they are deprecated.
Security: This document needs to be regularly maintained and revisited so that XMPP protocols are using the most up-to-date security technologies.
Reusability: The extension needs to be reusable in any XMPP protocol.

3. XML Format

This document defines a new XML element (and child elements) that can be used in any XMPP protocol extension. An example follows.

<hashes xmlns='urn:xmpp:hashes:0'>
  <hash algo='sha-256'>2XarmwTlNxDAMkvymloX3S5+VbylNrJt/l5QyPa+YoU=</hash>
</hashes>

The <hashes/> element MAY contain more than one <hash/> child, as in the following example.

<hashes xmlns='urn:xmpp:hashes:0'>
  <hash algo='sha-1'>2AfMGH8O7UNPTvUVAM9aK13mpCY=</hash>
  <hash algo='sha-256'>2XarmwTlNxDAMkvymloX3S5+VbylNrJt/l5QyPa+YoU=</hash>
</hashes>

4. Hash Functions

4.1 MD2

The MD2 algorithm is not used in any XMPP protocols and has been deprecated by the IETF (see RFC 6149 [6]).

4.2 MD4

The MD4 algorithm is not used in any XMPP protocols and has been deprecated by the IETF (see RFC 6150 [7]).

4.3 MD5

The MD5 algorithm is used in several XMPP protocols. As explained in RFC 6151 [8], the MD5 algorithm "is no longer acceptable where collision resistance is required" (such as in digital signatures) and "new protocol designs should not employ HMAC-MD5" either. The XSF is working to deprecate the use of MD5 in XMPP protocols.

4.4 SHA-0

The SHA-0 algorithm was developed by the U.S. National Securitiy Agency and first published in 1993. It was never widely deployed and is not used in any XMPP protocols.

4.5 SHA-1

The SHA-1 algorithm was developed by the U.S. National Security Agency and first published in 1995 to fix problems with SHA-0. The SHA-1 algorithm is currently the most widely-deployed hash function. As described in RFC 4270 [9] in 2005, attacks have been found against the collision resistance property of SHA-1. RFC 6194 [10] notes that no published results indicate improvement upon those attacks. In addition, RFC 6194 notes that "[t]here are no known pre-image or second pre-image attacks that are specific to the full round SHA-1 algorithm". However, the U.S. National Institute of Standards and Technology (NIST) has recommended that SHA-1 not be used for generating digital signatures after December 31, 2010. However, there is no indication that attacks on SHA-1 can be extended to HMAC-SHA-1.

The XSF is strongly encouraged to consider migrating its existing uses of SHA-1 to the SHA-2 family of algorithms, and to the SHA-3 family when available.

4.6 SHA-2

The SHA-2 family of algorithms (SHA-224, SHA-256, SHA-384, and SHA-512) were developed by the U.S. National Security Agency and first published in 2001. Because SHA-2 is somewhat similar to SHA-1, it is thought that the security flaws with SHA-1 described above could be extended to SHA-2 (although no such attacks have yet been found on the full-round SHA-2 algorithms).

4.7 SHA-3

The U.S. National Institute of Standards and Technology (NIST) is currently holding a public competition to replace the SHA-1 and SHA-2 functions. The winner and resulting new standard will be announced in 2012. When this "SHA-3" technology is announced, the XSF will update this specification accordingly.

5. Algorithm Recommendations

Table 1: Algorithm Recommendations

Algorithm	Support
MD2	MUST NOT
MD4	MUST NOT
MD5	MAY
SHA-1	MUST
SHA-256	MUST
SHA-512	SHOULD

6. Determining Support

If an entity supports the protocol defined herein, it MUST report that by including a Service Discovery [12] feature of "urn:xmpp:hashes:0" in response to disco#info requests, along with one service discovery feature for each algorithm it supports:

<iq from='romeo@montague.lit/orchard'
    id='uw72g176'
    to='juliet@capulet.lit/balcony'
    type='get'>
  <query xmlns='http://jabber.org/protocol/disco#info'/>
</iq>

<iq from='juliet@capulet.lit/balcony'
    id='uw72g176'
    to='romeo@montague.lit/orchard'
    type='result'>
  <query xmlns='http://jabber.org/protocol/disco#info'>
    <feature var='urn:xmpp:hashes:0'/>
    <feature var='urn:xmpp:hash-function-textual-names:md5'/>
    <feature var='urn:xmpp:hash-function-textual-names:sha-1'/>
    <feature var='urn:xmpp:hash-function-textual-names:sha-256'/>
  </query>
</iq>

In order for an application to determine whether an entity supports this protocol, where possible it SHOULD use the dynamic, presence-based profile of service discovery defined in Entity Capabilities [13]. However, if an application has not received entity capabilities information from an entity, it SHOULD use explicit service discovery instead.

7. Security Considerations

8. IANA Considerations

This document requires no interaction with the IANA. However, it reuses entries from the relevant IANA registry.

9. XMPP Registrar Considerations

9.1 Protocol Namespaces

This specification defines the following XML namespace:

urn:xmpp:hashes:0

The XMPP Registrar [14] shall include the foregoing namespace in its registry at <http://xmpp.org/registrar/namespaces.html>, as governed by XMPP Registrar Function [15].

9.2 Protocol Versioning

If the protocol defined in this specification undergoes a revision that is not fully backwards-compatible with an older version, the XMPP Registrar shall increment the protocol version number found at the end of the XML namespaces defined herein, as described in Section 4 of XEP-0053.

9.3 Service Discovery Features

An entity SHOULD provide one service discovery feature for each algorithm it supports. Ideally these features would be of the form "urn:iana:hash-function-text-names:foo" (where "foo" is the name of an algorithm registered with the IANA); however there is no urn:iana namespace at present. Until there is, we use features of the form "urn:xmpp:hash-function-text-names:foo" instead. Therefore the registry submission is as follows.

Registry Submission

<var>
  <name>urn:xmpp:hash-function-text-names:md5</name>
  <desc>Support for the MD5 hashing algorithm</desc>
  <doc>XEP-xxxx</doc>
</var>
<var>
  <name>urn:xmpp:hash-function-text-names:sha-1</name>
  <desc>Support for the SHA-1 hashing algorithm</desc>
  <doc>XEP-xxxx</doc>
</var>
<var>
  <name>urn:xmpp:hash-function-text-names:sha-224</name>
  <desc>Support for the SHA-224 hashing algorithm</desc>
  <doc>XEP-xxxx</doc>
</var>
<var>
  <name>urn:xmpp:hash-function-text-names:sha-256</name>
  <desc>Support for the SHA-256 hashing algorithm</desc>
  <doc>XEP-xxxx</doc>
</var>
<var>
  <name>urn:xmpp:hash-function-text-names:sha-384</name>
  <desc>Support for the SHA-384 hashing algorithm</desc>
  <doc>XEP-xxxx</doc>
</var>
<var>
  <name>urn:xmpp:hash-function-text-names:sha-512</name>
  <desc>Support for the SHA-512 hashing algorithm</desc>
  <doc>XEP-xxxx</doc>
</var>

10. Acknowledgements

Thanks to Dave Cridland, Waqas Hussain, Glenn Maynard, and Remko Tronçon for their input.

Appendices

Appendix A: Document Information

Series: XEP
Number: 0300
Publisher: XMPP Standards Foundation
Status: Experimental
Type: Standards Track
Version: 0.1
Last Updated: 2011-06-29
Approving Body: XMPP Council
Dependencies: XMPP Core
Supersedes: None
Superseded By: None
Short Name: N/A
Source Control: HTML
This document in other formats: XML PDF

Appendix B: Author Information

Appendix C: Legal Notices

Copyright

Permissions

Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the "Specification"), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specification, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or substantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or publisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation.

Disclaimer of Warranty

## NOTE WELL: This Specification is provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. ##

Limitation of Liability

In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall the XMPP Standards Foundation or any author of this Specification be liable for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising from, out of, or in connection with the Specification or the implementation, deployment, or other use of the Specification (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if the XMPP Standards Foundation or such author has been advised of the possibility of such damages.

IPR Conformance

This XMPP Extension Protocol has been contributed in full conformance with the XSF's Intellectual Property Rights Policy (a copy of which can be found at <http://xmpp.org/about-xmpp/xsf/xsf-ipr-policy/> or obtained by writing to XMPP Standards Foundation, 1899 Wynkoop Street, Suite 600, Denver, CO 80202 USA).

Appendix D: Relation to XMPP

The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 3920) and XMPP IM (RFC 3921) specifications contributed by the XMPP Standards Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this document has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.

Appendix E: Discussion Venue

The primary venue for discussion of XMPP Extension Protocols is the <standards@xmpp.org> discussion list.

Appendix F: Requirements Conformance

The following requirements keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".

Appendix G: Notes

1. XEP-0096: SI File Transfer <http://xmpp.org/extensions/xep-0096.html>.

2. XEP-0115: Entity Capabilities <http://xmpp.org/extensions/xep-0115.html>.

3. XEP-0116: Encrypted Session Negotiation <http://xmpp.org/extensions/xep-0116.html>.

4. IANA registry of Hash Function Textual Names <http://www.iana.org/assignments/hash-function-text-names>.

5. The Internet Assigned Numbers Authority (IANA) is the central coordinator for the assignment of unique parameter values for Internet protocols, such as port numbers and URI schemes. For further information, see <http://www.iana.org/>.

6. RFC 6149: MD2 to Historic Status <http://tools.ietf.org/html/rfc6149>.

7. RFC 6150: MD4 to Historic Status <http://tools.ietf.org/html/rfc6150>.

8. RFC 6151: Updated Security Considerations for the MD5 Message-Digest and the HMAC-MD5 Algorithms <http://tools.ietf.org/html/rfc6151>.

9. RFC 4270: Attacks on Cryptographic Hashes in Internet Protocols <http://tools.ietf.org/html/rfc4270>.

10. RFC 6194: Updated Security Considerations for the SHA-0 and SHA-1 Message-Digest Algorithms <http://tools.ietf.org/html/rfc6194>.

11. The XMPP Council is a technical steering committee, authorized by the XSF Board of Directors and elected by XSF members, that approves of new XMPP Extensions Protocols and oversees the XSF's standards process. For further information, see <http://xmpp.org/council/>.

12. XEP-0030: Service Discovery <http://xmpp.org/extensions/xep-0030.html>.

13. XEP-0115: Entity Capabilities <http://xmpp.org/extensions/xep-0115.html>.

14. The XMPP Registrar maintains a list of reserved protocol namespaces as well as registries of parameters used in the context of XMPP extension protocols approved by the XMPP Standards Foundation. For further information, see <http://xmpp.org/registrar/>.

15. XEP-0053: XMPP Registrar Function <http://xmpp.org/extensions/xep-0053.html>.

Abstract:	This document provides recommendations for the use of cryptographic hash functions in XMPP protocol extensions.
Authors:	Peter Saint-Andre, Matthew Wild, Kevin Smith
Copyright:	© 1999 - 2011 XMPP Standards Foundation. SEE LEGAL NOTICES.
Status:	Experimental
Type:	Standards Track
Version:	0.1
Last Updated:	2011-06-29