XEP-0344: Impact of TLS and DNSSEC on Dialback

Abstract:This specification provides documentation how Server Dialback is used together with Transport Layer Security, and discusses how the security considerations of Dialback are changed by the introduction of TLS and/or DNSSEC.
Authors:Philipp Hancke, Dave Cridland
Copyright:© 1999 – 2017 XMPP Standards Foundation. SEE LEGAL NOTICES.
Status:Experimental
Type:Standards Track
Version:0.3
Last Updated:2015-03-23

WARNING: This Standards-Track document is Experimental. Publication as an XMPP Extension Protocol does not imply approval of this proposal by the XMPP Standards Foundation. Implementation of the protocol described herein is encouraged in exploratory implementations, but production systems are advised to carefully consider whether it is appropriate to deploy implementations of this protocol before it advances to a status of Draft.

Table of Contents


1. Introduction
2. Protocol
    2.1. Dramatis Personae
    2.2. Classic Dialback Flow
    2.3. XMPP Exchanges in Classic Dialback over TLS
    2.4. Dialback without dialback flow
    2.5. XMPP Exchanges in Dialback without dialback
    2.6. Same Certificate shortcut
    2.7. XMPP Exchanges in Same Certifiate shortcut
3. Security Considerations
    3.1. Dialback without dialback shortcut
    3.2. Same Certificate shortcut
    3.3. DNSSEC
4. IANA Considerations
5. XMPP Registrar Considerations

Appendices
    A: Document Information
    B: Author Information
    C: Legal Notices
    D: Relation to XMPP
    E: Discussion Venue
    F: Requirements Conformance
    G: Notes
    H: Revision History

1. Introduction

Although Server Dialback (XEP-0220) [1] describes dialback as being run before any other negotiation, it is typically run over TLS where supported. This allows it to be used as a simple convenient fallback to X.509 Strong Authentication within the TLS layer, as described in RFC 6120 [2], and also affords greater protection to the exchange.

This document describes these practises, and also describes various functionally equivalent shortcuts to the protocol, including that known as "dialback without dialback".

2. Protocol

2.1 Dramatis Personae

This document will tell a tale of two servers; orchard.capulet.example is trying to contact home.montague.example. Each server operates a single domain; these are capulet.example and montague.example respectively.

2.2 Classic Dialback Flow

The traditional pattern is shown here:

orchard.capulet.     home.montague.
example              example
(as Initiating)      (as Receiving
   Server)              Server)
----------------     -------------
    |                    |
    |  [if necessary,    |
    |   perform DNS      |
    |   lookup on        |
    |   Target Domain,   |
    |   open TCP         |
    |   connection,      |
    |   and establish    |
    |   stream]          |
    | -----------------> |
    |  (ID D60000229F)   |
    |                    |
    |      send          |               capulet.example
    |  dialback key      |             (as Authoritative
    | -----(STEP 1)----> |                 Server)
    |                    |             -----------------
    |                    |  [if necessary,    |
    |                    |   perform DNS      |
    |                    |   lookup on        |
    |                    |   Sender Domain,   |
    |                    |   open TCP         |
    |                    |   connection,      |
    |                    |   and establish    |
    |                    |   stream]          |
    |                    | -----------------> |
    |                    |                    |
    |                    |       send         |
    |                    |   verify request   |
    |                    | ----(STEP 2)-----> |
    |                    |                    |
    |                    |       send         |
    |                    |   verify response  |
    |                    | <----(STEP 3)----- |
    |                    |                    |
    |      report        |                    |
    |  dialback result   |                    |
    | <-----(STEP 4)---- |                    |

2.3 XMPP Exchanges in Classic Dialback over TLS

This traditional pattern involves the following protocol exchanges when dialback over TLS is used:

Example 1. Initiating Server Opens Stream

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        from='capulet.example'
        to='montague.example'
        version='1.0'>

Example 2. Receiving Server Responds with a stream header and advertises TLS feature

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        id='D60000229F'
        from='montague.example'
        to='capulet.example'
        version='1.0'>
<stream:features>
  <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
    <required/>
  </starttls>
</stream:features>

Example 3. Initiating Server Sends STARTTLS command

<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

Example 4. Receiving Server informs Initiating Server to proceed

<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

Example 5. Initiating Server Opens Stream

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        from='capulet.example'
        to='montague.example'
        version='1.0'>

Example 6. Receiving Server Responds with a stream header

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        id='D60000229F'
        from='montague.example'
        to='capulet.example'
        version='1.0'>
<stream:features>
  <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
  </mechanisms>
</stream:features>

Example 7. Initiating Server Sends Dialback Key (Step 1)

<db:result
    from='capulet.example'
    to='montague.example'>
  b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:result>

The Receiving Server may need to establish a connection to the Authoritative Server at this point.

Example 8. Receiving Server Sends Verification Request to Authoritative Server (Step 2)

<db:verify
    from='montague.example'
    id='D60000229F'
    to='capulet.example'>
  b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:verify>

Example 9. Receiving Server is Informed by Authoritative Server that Key is Valid (Step 3)

<db:verify
  from='capulet.example'
  id='D60000229F'
  to='montague.example'
  type='valid'/>

Example 10. Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)

<db:result
  from='montague.example'
  to='capulet.example'
  type='valid'/>

2.4 Dialback without dialback flow

If during the initial connection, home.montague.example is able to determine that the certificate presented is trustworthy, and authenticates orchard.capulet.example as authorized to offer the XMPP service for capulet.example, then the flow can be shortcutted heavily, allowing the entire Authoritative Server process to be elided.

This is particularly useful in cases where the dialback exchange is a subsequent exchange used in piggybacking, as it remains the only solution for piggybacking with strong authentication.

orchard.capulet.     home.montague.
example              example
(as Initiating)      (as Receiving
   Server)              Server)
----------------     -------------
    |                    |
    |  [if necessary,    |
    |   perform DNS      |
    |   lookup on        |
    |   Target Domain,   |
    |   open TCP         |
    |   connection,      |
    |   and establish    |
    |   stream]          |
    | -----------------> |
    |  (ID D60000229F)   |
    |                    |
    |      send          |
    |  dialback key      |
    | -----(STEP 1)----> |
    |                    |
    |                    |  [observe certificate
    |                    |   trustworthy and
    |                    |   correct for capulet.example
    |                    |   as per RFC 6125]
    |                    |
    |      report        |
    |  dialback result   |
    | <-----(STEP 4)---- |

2.5 XMPP Exchanges in Dialback without dialback

This traditional pattern involves the following protocol exchanges when dialback over TLS is used:

Example 11. Initiating Server Opens Stream

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        from='capulet.example'
        to='montague.example'
        version='1.0'>

Example 12. Receiving Server Responds with a stream header and advertises TLS feature

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        id='D60000229F'
        from='montague.example'
        to='capulet.example'
        version='1.0'>
<stream:features>
  <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
    <required/>
  </starttls>
</stream:features>

Example 13. Initiating Server Sends STARTTLS command

<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

Example 14. Receiving Server informs Initiating Server to proceed

<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

Example 15. Initiating Server Opens Stream

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        from='capulet.example'
        to='montague.example'
        version='1.0'>

Example 16. Receiving Server Responds with a stream header

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        id='D60000229F'
        from='montague.example'
        to='capulet.example'
        version='1.0'>
<stream:features>
  <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
    <mechanism name='EXTERNAL'/>
  </mechanisms>
</stream:features>

Note that having authenticated the certificate and found it authorized for capulet.example, montague.example has offered EXTERNAL above. It's not clear why capulet.example does not avail itself of the offer below; however it should be noted that EXTERNAL would not be available with piggybacking for example.

Example 17. Initiating Server Sends Dialback Key (Step 1)

<db:result
    from='capulet.example'
    to='montague.example'>
  b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:result>

Critically, it is at this point that home.montague.example both authenticates and checks authorization on the certificate, or at least ensure that the certificate presented at this stage matches that presented at the initial handshake.

Example 18. Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)

<db:result
  from='montague.example'
  to='capulet.example'
  type='valid'/>
  from='montague.example'
  to='capulet.example'
  type='valid'/>

2.6 Same Certificate shortcut

If during the initial connection, the Receiving Server is unable to determine that the certificate presented is trustworthy but the Authoritative Server presents the same certificate as the Originating Server, the <db:verify/> step can be elided.

Note: the Receiving Server MUST still check that the hostname in the certificate matches.

Essentially, this replaces the Dialback Key Validation step from Dialback Key Generation and Validation (XEP-0185) [3] with the somewhat more elaborate proof of posession of the private key associated with the certificate.

orchard.capulet.     home.montague.
example              example
(as Initiating)      (as Receiving
   Server)              Server)
----------------     -------------
    |                    |
    |  [if necessary,    |
    |   perform DNS      |
    |   lookup on        |
    |   Target Domain,   |
    |   open TCP         |
    |   connection,      |
    |   and establish    |
    |   stream]          |
    | -----------------> |
    |  (ID D60000229F)   |
    |                    |
    |      send          |               capulet.example
    |  dialback key      |             (as Authoritative
    | -----(STEP 1)----> |                 Server)
    |                    |             -----------------
    |                    |  [if necessary,    |
    |                    |   perform DNS      |
    |                    |   lookup on        |
    |                    |   Sender Domain,   |
    |                    |   open TCP         |
    |                    |   connection,      |
    |                    |   and establish    |
    |                    |   stream]          |
    |                    | -----------------> |
    |                    | [observe certificate is for
    |                    |  capulet.example and same as
    |                    |  used by orchard.capulat.example]
    |      report        |
    |  dialback result   |
    | <-----(STEP 4)---- |

2.7 XMPP Exchanges in Same Certifiate shortcut

This pattern involves the following protocol exchanges:

Example 19. Initiating Server Opens Stream

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        from='capulet.example'
        to='montague.example'
        version='1.0'>

Example 20. Receiving Server Responds with a stream header and advertises TLS feature

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        id='D60000229F'
        from='montague.example'
        to='capulet.example'
        version='1.0'>
<stream:features>
  <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'>
    <required/>
  </starttls>
</stream:features>

Example 21. Initiating Server Sends STARTTLS command

<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

Example 22. Receiving Server informs Initiating Server to proceed

<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

Example 23. Initiating Server Opens Stream

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        from='capulet.example'
        to='montague.example'
        version='1.0'>

Example 24. Receiving Server Responds with a stream header

<stream:stream
        xmlns:stream='http://etherx.jabber.org/streams'
        xmlns='jabber:server'
        id='D60000229F'
        from='montague.example'
        to='capulet.example'
        version='1.0'>
<stream:features>
  <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
  </mechanisms>
</stream:features>

Example 25. Initiating Server Sends Dialback Key (Step 1)

<db:result
    from='capulet.example'
    to='montague.example'>
  b4835385f37fe2895af6c196b59097b16862406db80559900d96bf6fa7d23df3
</db:result>

The Receiving Server may need to establish a connection to the Authoritative Server at this point. Here we assume that this connection is using TLS and the certificate presented by the Authoritative Server is the same as the one used by the Originating Server and contains the domain name claimed by the Originating Server.

Example 26. Initiating Server Receives Valid Verification Result from Receiving Server (Step 4)

<db:result
  from='montague.example'
  to='capulet.example'
  type='valid'/>

3. Security Considerations

With respect to XEP-0220's security considerations, the adaptations in this document add at minimum channel encryption and integrity, which forces an attacker into making an active attack, rather than passive eavesdropping. This raises the cost of an attack significantly. However, unless the certificates are authenticated, there is still a man-in-the-middle attack possible, and the reliance on unauthenticated DNS remains problematic.

3.1 Dialback without dialback shortcut

Use of the "Dialback without dialback" shortcut described in section 2.4 raises the level of authentication to that of the TLS/SASL-EXTERNAL process described in RFC 6120, and is thought to be indistinguishable from a security standpoint. As such, the security considerations relating to this in RFC 6120 et al apply.

3.2 Same Certificate shortcut

Use of the "Same Certificate" shortcut described in section 2.6 is not thought to materially alter the security profile beyond that described above. In particular, it does not alter the level of trust an implementation may put in authentication.

3.3 DNSSEC

If both SRV and A/AAAA records are protected by DNSSEC, this means that the correct address for the peer can be proven, removing DNS forgery as an attack vector. Without TLS, it is however still possible to mount an array of attacks, including IP spoofing and eavesdropping.

With TLS, however, the situation improves. Since TLS protects against a naïve IP spoofing attack, a routing protocol attack (such as BGP hijacking) is required to forge the server.

In addition, it is of critical importance to check the certificate at the time when the dialback result is received, and not only in the initial handshake. This protects against an attack based around renegotiation.

4. IANA Considerations

This document requires no interaction with the Internet Assigned Numbers Authority (IANA) [4].

5. XMPP Registrar Considerations

This document requires no interaction with the XMPP Registrar.

Appendices

Appendix A: Document Information

Series: XEP
Number: 0344
Publisher: XMPP Standards Foundation
Status: Experimental
Type: Standards Track
Version: 0.3
Last Updated: 2015-03-23
Approving Body: XMPP Council
Dependencies: XMPP Core, XEP-0220
Supersedes: None
Superseded By: None
Short Name: N/A
Source Control: HTML
This document in other formats: XML  PDF

Appendix B: Author Information

Philipp Hancke

Email: fippo@andyet.com
JabberID: fippo@goodadvice.pages.de

Dave Cridland

Email: dave.cridland@surevine.com
JabberID: dave.cridland@surevine.com

Appendix C: Legal Notices

Copyright

This XMPP Extension Protocol is copyright © 1999 – 2017 by the XMPP Standards Foundation (XSF).

Permissions

Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the "Specification"), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specification, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or substantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or publisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation.

Disclaimer of Warranty

## NOTE WELL: This Specification is provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. ##

Limitation of Liability

In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall the XMPP Standards Foundation or any author of this Specification be liable for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising from, out of, or in connection with the Specification or the implementation, deployment, or other use of the Specification (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if the XMPP Standards Foundation or such author has been advised of the possibility of such damages.

IPR Conformance

This XMPP Extension Protocol has been contributed in full conformance with the XSF's Intellectual Property Rights Policy (a copy of which can be found at <https://xmpp.org/about/xsf/ipr-policy> or obtained by writing to XMPP Standards Foundation, P.O. Box 787, Parker, CO 80134 USA).

Appendix D: Relation to XMPP

The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 6120) and XMPP IM (RFC 6121) specifications contributed by the XMPP Standards Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this document has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.

Appendix E: Discussion Venue

The primary venue for discussion of XMPP Extension Protocols is the <standards@xmpp.org> discussion list.

Discussion on other xmpp.org discussion lists might also be appropriate; see <http://xmpp.org/about/discuss.shtml> for a complete list.

Errata can be sent to <editor@xmpp.org>.

Appendix F: Requirements Conformance

The following requirements keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".

Appendix G: Notes

1. XEP-0220: Server Dialback <https://xmpp.org/extensions/xep-0220.html>.

2. RFC 6120: Extensible Messaging and Presence Protocol (XMPP): Core <http://tools.ietf.org/html/rfc6120>.

3. XEP-0185: Dialback Key Generation and Validation <https://xmpp.org/extensions/xep-0185.html>.

4. The Internet Assigned Numbers Authority (IANA) is the central coordinator for the assignment of unique parameter values for Internet protocols, such as port numbers and URI schemes. For further information, see <http://www.iana.org/>.

Appendix H: Revision History

Note: Older versions of this specification might be available at http://xmpp.org/extensions/attic/

Version 0.3 (2015-03-23)

Described same-certificate flow.

(dwd/ph)

Version 0.2 (2014-03-19)

Editorial fixes.

(editor (mam))

Version 0.1 (2014-03-14)

Initial published version approved by the XMPP Council.

(editor (mam))

Version 0.0.3 (2014-02-28)

Changed title and added more security considerations.

(dwd)

Version 0.0.2 (2013-11-13)

Added some narrative and a section on dwd.

(dwd)

Version 0.0.1 (2013-11-04)

First draft.

(ph)

END