XEP-0420: Stanza Content Encryption

The Stanza Content Encryption (SCE) protocol is intended as a way to allow clients to securely exchange arbitrary extension elements using different end-to-end encryption schemes.
Paul Schaub
© 2019 – 2021 XMPP Standards Foundation. SEE LEGAL NOTICES.


WARNING: This Standards-Track document is Experimental. Publication as an XMPP Extension Protocol does not imply approval of this proposal by the XMPP Standards Foundation. Implementation of the protocol described herein is encouraged in exploratory implementations, but production systems are advised to carefully consider whether it is appropriate to deploy implementations of this protocol before it advances to a status of Draft.
Standards Track
0.4.1 (2021-11-18)
Document Lifecycle
  1. Experimental
  2. Proposed
  3. Stable
  4. Final

1. Introduction

There is a number of different end-to-end encryption mechanisms that can be used to secure user communication against unauthorized access from malicious third parties. Popular examples for this are OMEMO Encryption (XEP-0384) [1] and OpenPGP for XMPP (XEP-0373) [2].

While the latter allows for encryption of arbitrary extension elements, protocols such as OMEMO Encryption (XEP-0384) [1] are limited to only encrypt the body of a message. This approach is not very flexible and prevents the combined usage with XMPP extension protocols such as Stateless Inline Media Sharing (XEP-0385) [3] or Last Message Correction (XEP-0308) [4] as their extension elements cannot be included in the encrypted part of the message, therefore leaking information about the message content.

This extension protocol proposes a solution to aforementioned issues by generalizing the OpenPGP Content Elements (eg. <signcrypt>) introduced by OpenPGP for XMPP (XEP-0373) [2] for the use with other encryption protocols.

2. Requirements

This proposal widens the scope of the security guarantees given by the used encryption mechanism from just the body of the message to various extension elements. It is intended to serve as a "one size fits all" solution for extension element encryption in XMPP.

In order to achieve its goal, Stanza Content Encryption does the following:

3. Glossary

Envelope Element <envelope/>
An XMPP extension element which is used to hold the <content/> element and the affix elements. The XML representation of this element is encrypted and then embedded as the payload of the message being sent.
Content Element <content/>
An element which is used to contain all extension elements which need to be encrypted.

4. Affix Elements

In order to prevent certain attacks, different affix elements MAY be added as direct child elements of the <envelope/> element.

Table 1: Overview about different crypto property elements
Element Description Usage Verification
<rpad/> Random-length random-content padding Prevent known ciphertext and message length correlation attacks. The content of this element is a randomly generated sequence of random length between 0 and 200 characters. TODO: sane boundaries? None. This element is only used to change the length of the ciphertext and doesn't need to be verified
<time/> Timestamp Prevent replay attacks using old messages. This element MUST have one attribute 'stamp', whose value is a timestamp following the format described in XMPP Date and Time Profiles (XEP-0082) [5]. The timestamp represents the time at which the message was encrypted by the sender. Receiving clients MUST check whether the difference between the timestamp and the sending time derived from the stanza itself lays within a reasonable margin. The client SHOULD use the content of the timestamp element when displaying the send date of the message
<to/> Recipient of the message Prevent spoofing of the recipient. This element MUST have one attribute 'jid' whose value is the bare JID of the message's recipient. Receiving clients MUST check if the JID matches the to attribute of the enclosing stanza and otherwise alert the user/reject the message
<from/> Sender of the message Prevent spoofing of the sender. This element MUST have one attribute 'jid' whose value is the bare JID of the message's sender. Receiving clients MUST check if the value matches the from attribute of the enclosing stanza and otherwise alert the user/reject the message
Example 1. Examples of Affix Elements
<time stamp='2004-01-25T06:05:00+01:00'/>
<to jid='missioncontrol@houston.nasa.gov'/>
<from jid='opportunity@mars.planet'/>


Encryption protocols that make use of Stanza Content Encryption MUST define their own profiles that describe mandatory behaviour of which of these elements are used. They MAY also define and add their own specific affix elements.

5. Motivation

Some end-to-end encryption protocols like OMEMO Encryption (XEP-0384) [1] are historically limited to encryption of the message body only. This approach excludes other extension elements from the protected domain of the payload element, exposing them to potential attackers.

Example 2. An imperfectly encrypted message which leaks dangerous information about the conversation through the plaintext OOB extension element
<message from='narrator@jabber.org'
  <encrypted xmlns='eu.siacs.conversations.axolotl'>
    <header sid='27183'>
  <x xmlns='jabber:x:oob'>


The example above obviously leaks information about the communication through the unencrypted OOB extension element.

Most end-to-end encryption mechanisms are also focussed solely on message content encryption and do not tackle <iq/> requests/replies at all. Stanza Content Encryption can be applied to those as well.

Example 3. Unencrypted IQ request
<iq from='doctor@shakespeare.lit/pda'
  <data xmlns='urn:xmpp:bob'

Example 4. Likewise unencrypted reply
<iq from='ladymacbeth@shakespeare.lit/castle'
  <data xmlns='urn:xmpp:bob'


6. Use Cases

6.1 Use in <message/> stanzas

The main use case of Stanza Content Encryption is the use of end-to-end encryption protocols in combination with extension protocols that store sensitive information in other places than the message body.

This applies to many extension elements that add additional information to <message/> stanzas, such as those of Out-of-Band Data (XEP-0066) [6].

Example 5. Envelope element containing the messages body and the OBB element.
<envelope xmlns='urn:xmpp:sce:1'>
    <body xmlns='jabber:client'>[...]</body>
    <x xmlns='jabber:x:oob'>
Example 6. Finished message stanza containing the <envelope/> element from the previous example, inside of its payload element, encrypted using a hypothetical encryption protocol and SCE.
<message from='narrator@jabber.org'
  <encrypted xmlns='urn:xmpp:encryption:stub:sce:1'>

6.2 Use in <iq/> stanzas

Stanza Content Encryption thrives not only to allow for rich content encryption in <message/> stanzas, but is also applicable to <iq/> queries. A resource might want to query sensitive information from another resource capable of Stanza Content Encryption.

Example 7. Sender prepares a <content/> element containing the query subject.
<envelope xmlns='urn:xmpp:sce:1'>
    <data xmlns='urn:xmpp:bob'
  <from jid='doctor@shakespeare.lit/pda'/>
  <to jid='ladymacbeth@shakespear.lit/castle'/>

Example 8. The sender then encrypts the <envelope/> element for the recipient and sends the <iq/> containing the result of the encryption.
<iq from='doctor@shakespeare.lit/pda'
  <encrypted xmlns='urn:xmpp:encryption:stub:sce:1'>
Example 9. The recipient prepares the reply to the request by assembling the <envelope/> element.
<envelope xmlns='urn:xmpp:sce:1'>
    <data xmlns='urn:xmpp:bob'
  <from jid='ladymacbeth@shakespear.lit/castle'/>
  <to jid='doctor@shakespeare.lit/pda'/>
Example 10. The <envelope/> element is then encrypted and sent as a reply to the initiator of the request.
<iq from='ladymacbeth@shakespeare.lit/castle'
  <encrypted xmlns='urn:xmpp:encryption:stub:sce:1'>

7. Sending an encrypted stanza

In order to send an encrypted message without leaking extension elements, the sender prepares the message by placing the sensitive extension elements inside a <content/> element and that inside an <envelope/> element.

Depending on the encryption-specific SCE-profile, some affix elements are added as child elements of the <envelope/> element.

The <envelope/> element is then serialized into XML and encrypted using the SCE-specific profile of the encryption mechanism in place. The result is appended to the message.

Since the outer message element does not contain a <body/> element the sender appends an unencrypted <store/> hint as specified in Message Processing Hints (XEP-0334) [7].

The message can then be sent to the recipient.

8. Receiving an encrypted stanza

The recipient of the message decrypts its encrypted payload. The result is the <envelope/> element containing the <content/> element and the affix elements as direct child elements. Depending on the affix profiles specified by the used encryption protocol, the affix elements are verified to prevent certain attacks from taking place.

Afterwards, the extension elements inside the <content/> element are checked against the permitted list and any disallowed elements are discarded.

As a last step, the original unencrypted stanza is recreated by replacing the <envelope/> element of the stanza with the elements inside of the <content/> element.

9. Server-processed Elements

There are certain extension elements which are required to be available to the server in order to do message routing and processing. Additionally there are some elements that MUST be filtered by the server. Allowing for those elements to be included in, and parsed from the encrypted payload would allow a malicious client to perform a number of attacks.

Contrary to this, other elements are considered sensitive and MUST NOT be available in plaintext outside the <envelope/> element.

It is hard to come up with a complete list of exceptional elements at this point, as there is no practical implementation experience.

Below is a non-exhaustive list of elements that are definitely forbidden inside the <envelope/> element and permitted as direct child elements of the message.

Table 2: Examples for exceptional elements that MUST NOT be included in, or read from the <envelope/> element and MUST instead be sent traditionally as direct child elements of the stanza.
Element Reason
Elements of Message Processing Hints (XEP-0334) [7] Message Processing Hints are addressed to the server and MUST therefore be accessible in plaintext. A receiving client MUST ignore any message processing hints encountered inside the encrypted <envelope/> element
Stanza-ID elements of Unique and Stable Stanza IDs (XEP-0359) [8] Sending clients MUST NOT include Stanza-ID elements inside the <envelope/> element, as this would prevent the server from filtering it. A client MUST ignore Stanza-ID elements encountered inside the <envelope/> element
Elements of Extended Stanza Addressing (XEP-0033) [9] The server MUST be able to access the <addresses/> and <address/> elements in order to do message routing, so they MUST NOT be encrypted.
TODO: Other elements?

10. Business Rules

Unencrypted <envelope/> elements are NOT ALLOWED as child elements of the stanza and MUST be dropped.

Elements in the <content/> element MUST be identified using an element name and namespace. Notably the <body/> element MUST contain a valid namespace (i.e. "jabber:client").

The recipient MUST verify that the decrypted <envelope/> element contains valid XML before processing it any further. Invalid XML must be rejected.

After verifying the integrity of the <envelope/> element, the recipient needs to make sure that no server-processed elements are found inside of it. Any forbidden elements MUST be dropped before the message is processed any further.

Furthermore the receiving client MUST ignore any extension elements considered as sensitive which are found outside of the <envelope/> element, especially as direct unencrypted child elements of the enclosing stanza.

Since a chat message encrypted with SCE MUST NOT contain a <body/> element, it is not eligible for MAM message storage (Message Archive Management (XEP-0313) [10]). Therefore sending entities MUST append an unencrypted Message Processing Hints (XEP-0334) [7] <store/> hint as a direct child element to the message.

11. Implementation Notes

As a first, naïve approach a recipient of a message containing an <envelope/> element could simply reinject the reassambled unencrypted stanza into the XML stream. This might introduce some security issues. Most notably, depending on the clients implementation it may become ambiguous which elements were received end-to-end encrypted and which were received unencrypted.

Implementations should rather handle encrypted elements explicitly.

12. Security Considerations

For the sake of simplicity, the examples in this document are not encrypted. A real-world implementation MUST make use of real cryptographic protocols.

12.1 Encryption Profiles

This specification presents a set of affix elements which can be used to counter certain attacks. However it does not dictate any behaviour regarding what elements MUST be used/verified or when.

Different cryptographic protocols come with different possible attack scenarios which must be taken into consideration, so it is left up to those cryptographic protocols to define profiles that describe the use of affix elements.

13. XMPP Registrar Considerations

TODO: Maybe the Registrar should handle a list of elements that are forbidden as child elements of the <content/> element?

14. XML Schema


15. Acknowledgements

Big thanks to the authors of OpenPGP for XMPP (XEP-0373) [2] (Florian Schmaus, Dominik Schürmann and Vincent Breitmoser) which heavily inspired the idea of this protocol.

Also thanks to Marvin Wißfeld, Tim Henkes, Daniel Gultsch, Melvin Keskin and Andreas Straub for their feedback.


Appendix A: Document Information

XMPP Standards Foundation
Standards Track
Last Updated
Approving Body
XMPP Council
XMPP Core, XEP-0001, Etc.
Superseded By
Short Name
Source Control

This document in other formats: XML  PDF

Appendix B: Author Information

Paul Schaub


This XMPP Extension Protocol is copyright © 1999 – 2024 by the XMPP Standards Foundation (XSF).


Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the "Specification"), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specification, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or substantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or publisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation.

Disclaimer of Warranty

## NOTE WELL: This Specification is provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. ##

Limitation of Liability

In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall the XMPP Standards Foundation or any author of this Specification be liable for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising from, out of, or in connection with the Specification or the implementation, deployment, or other use of the Specification (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if the XMPP Standards Foundation or such author has been advised of the possibility of such damages.

IPR Conformance

This XMPP Extension Protocol has been contributed in full conformance with the XSF's Intellectual Property Rights Policy (a copy of which can be found at <https://xmpp.org/about/xsf/ipr-policy> or obtained by writing to XMPP Standards Foundation, P.O. Box 787, Parker, CO 80134 USA).

Visual Presentation

The HTML representation (you are looking at) is maintained by the XSF. It is based on the YAML CSS Framework, which is licensed under the terms of the CC-BY-SA 2.0 license.

Appendix D: Relation to XMPP

The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 6120) and XMPP IM (RFC 6121) specifications contributed by the XMPP Standards Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this document has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.

Appendix E: Discussion Venue

The primary venue for discussion of XMPP Extension Protocols is the <standards@xmpp.org> discussion list.

Discussion on other xmpp.org discussion lists might also be appropriate; see <https://xmpp.org/community/> for a complete list.

Errata can be sent to <editor@xmpp.org>.

Appendix F: Requirements Conformance

The following requirements keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".

Appendix G: Notes

1. XEP-0384: OMEMO Encryption <https://xmpp.org/extensions/xep-0384.html>.

2. XEP-0373: OpenPGP for XMPP <https://xmpp.org/extensions/xep-0373.html>.

3. XEP-0385: Stateless Inline Media Sharing (SIMS) <https://xmpp.org/extensions/xep-0385.html>.

4. XEP-0308: Last Message Correction <https://xmpp.org/extensions/xep-0308.html>.

5. XEP-0082: XMPP Date and Time Profiles <https://xmpp.org/extensions/xep-0082.html>.

6. XEP-0066: Out of Band Data <https://xmpp.org/extensions/xep-0066.html>.

7. XEP-0334: Message Processing Hints <https://xmpp.org/extensions/xep-0334.html>.

8. XEP-0359: Unique and Stable Stanza IDs <https://xmpp.org/extensions/xep-0359.html>.

9. XEP-0033: Extended Stanza Addressing <https://xmpp.org/extensions/xep-0033.html>.

10. XEP-0313: Message Archive Management <https://xmpp.org/extensions/xep-0313.html>.

Appendix H: Revision History

Note: Older versions of this specification might be available at https://xmpp.org/extensions/attic/

  1. Version 0.4.1 (2021-11-18)

    Clarify bare JID usage and improve sentences:

  2. Version 0.4.0 (2021-04-07)

    Use 'envelope' and 'content' consistently by renaming elements

    Update namespace to urn:xmpp:sce:1

  3. Version 0.3.2 (2021-03-04)

    Cross-document editorial adjustments for inclusive language.

  4. Version 0.3.1 (2020-11-03)

    Fix misspelling of 'whose'

  5. Version 0.3.0 (2020-07-03)

    Allow origin-id elements, disallow stanza-id and extended stanza addressing elements inside the payload element

    Clarify wording on stanza processed elements and improve XEP formatting

    Remove limitation of random padding content to base64 characters alone

    Chat messages MUST contain message processing store hint

    Credit where credit is due

  6. Version 0.2.0 (2019-10-04)

    Specify IQ encryption

    Add examples and addenda

  7. Version 0.1.0 (2019-07-30)
    Accepted by vote of Council on 2019-06-26.
    XEP Editor (jsc)
  8. Version 0.0.1 (2019-06-03)

    First draft.


Appendix I: Bib(La)TeX Entry

  title = {Stanza Content Encryption},
  author = {Schaub, Paul},
  type = {XEP},
  number = {0420},
  version = {0.4.1},
  institution = {XMPP Standards Foundation},
  url = {https://xmpp.org/extensions/xep-0420.html},
  date = {2019-06-03/2021-11-18},