Tech pages/XMPP E2E Security
This page aims to provide an overview, comparison and evaluation of existing and proposed end-to-end security solutions for XMPP.
Proposals
XEP-0384: OMEMO Encryption (Signal / Text Secure)
OMEMO is based on the Signal Double Ratchet and provides forward secrecy, history retrieval for devices already in the ratchet, and some other benefits over legacy encryption mechanisms. Despite currently being an experimental XEP, it is probably the most widely-used encryption scheme of XMPP nowadays. It has had an independent third party audit (see related links at bottom).
See the OMEMO Tech pages and its sub-pages for more implementation details.
Recommendation: Implement for modern instant messaging solutions, where you need multi-device support and forward secrecy.
XEP-0373: OpenPGP for XMPP / XEP-0374: OpenPGP for XMPP Instant Messaging
The OpenPGP for XMPP (OX) specification currently consists of a baseline specification: XEP-0373 and a profile for Instant Messaging specification XEP-0374. It is under active development and thus subject to change although can be considered pretty stable regarding most parts.
OX attempts to fix the various security design flaws of XEP-0027, and additionally specifies features like "arbitrary extension element" verification and protection.
Implementations are available for Gajim and Smack, and have been successfully tested against each other for interoperability.
Recommendation: Exploratory implementations are encouraged.
XEP-0027 (Legacy OpenPGP)
One of the first proposals for end-to-end security is based on PGP and described in XEP-0027.
XEP-0027 doesn't provide protection from replay attacks. It also only encrypts messages without signing, so they could be replaced with different correctly encrypted messages on the wire.(Source: chat in xsf@m.x.o) Thus it has been obsoleted by the XMPP Council in it's meeting on 2014-03-12.
Recommendation: Do not implement due to serious security issues.
OTR (Off-the-record Messaging)
OTR is a crypto protocol, specifically designed to secure instant messaging conversations. It also ensures forward secrecy, and include in-band verification via a shared secret. Its usage in XMPP is documented (but not standardized) in XEP-0364.
There is ongoing development for a new version of the protocol, called OTRv4
Recommendation: Implement for compatibility with some clients.
Comparative Overview
| Proposal | Security property | Communication patterns | Compatibility with XMPP | |||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Authenticity | Integrity | Encryption | Forward secrecy | Malleability | One-to-One | Groupchat | Offline messages | Multiple resources | Discovery of support | |
| OMEMO (XEP-0384) | Yes | Except in the case of a malicious authenticated device | Yes | Yes | By authenticated devices | Yes | Yes (Non-anonymous only) | Yes | Yes | Yes |
| XEP-0374: OpenPGP for XMPP Instant Messaging | Yes | Yes | Yes | No | N/A | Yes | Possible and planned, but currently unspecified | Yes | Yes | Yes |
| Legacy PGP (XEP-0027) | No (messages only encrypted, not signed) | No | Yes | No | N/A | Yes | No | Yes | Yes (if same keypair at all resources) | No |
| OTR | Yes | Yes | Yes | Yes | Yes | Yes | No | No | No | No |
Related Documents
- https://developer.pidgin.im/wiki/EndToEndXMPPCrypto
- http://trevp.net/talk_2014_04_02.pdf
- https://conversations.im/omemo/audit.pdf
- An odyssey of encryption in XMPP (3rd party blogpost)
Discussion
If you have any questions or comments regarding this page, please join the XSF chatroom at xsf@muc.xmpp.org.
Abandoned and Legacy E2EE specifications
Those specifications are very likely not relevant any more and are listed only for completeness:
- draft-miller-xmpp-e2e - https://datatracker.ietf.org/doc/draft-miller-xmpp-e2e/
- ESessions: XEP-0187 and XEP-0188
- RFC 3923: End-to-End Signing and Object Encryption for the Extensible Messaging and Presence Protocol (XMPP)