Difference between revisions of "XMPP E2E Security"
(No difference)
|
Revision as of 21:23, 5 August 2014
This page aims to provide an overview, comparison and evaluation of existing and proposed end-to-end security solutions for XMPP, after providing the characteristings of the XMPP setting with regard to communication and the security of it.
Security properties
Compatibility of Security Properties with XMPP Features
One-to-One Chat
Multi-User Chat
Multiple resources
Using multiple resources almost certainly contradicts having forward secrecy:
- Forward secrecy uses short-lived (decryption) keys that are negotiated between two endpoints (clients)
- Multiple resources must use the same decryption key to be able to decrypt messages originally sent to the other resource after a spontaneous resource switch
- Multiple resources must use the same signing key to avoid multiple authentications between the same partners using different resources
Either the resources would have to exchange their key material frequently (themselves retaining the forward secrecy) or share a long-living signing key that is used for authentication.
Of course, this assumes that you only have to authenticate the user/JID once and not for every resource. If you are willing to authenticate every resource of your communication partner separately, the problem is reduced to that of a Multi-User Chat.
Proposals
XEP-0027 (PGP)
One of the first proposals for end-to-end security is based on PGP and described in XEP-0027.
The way XEP-0027 uses PGP, it doesn't provide protection from replay attacks. It also only encrypts messages and doesn't sign them, so they could be replaced with different correctly encrypted messages on the wire.(Source: chat in xsf@m.x.o) Thus it has been obsoleted by the XMPP Council in it's meeting on 2014-03-12.
RFC 3923 (S/MIME)
XEP-0200 (Stanza Encryption)
The Stanza Encryption, as described in XEP-0200 is a general framework for securing arbitrary stanzas in a one-to-one established session. It relies on other XEPs to provide the necessary parameters like key material and algorithms, but itself supports re-keying. This XEP as well as those required to use it are very abstract to support a wide range of algorithms and methods.
XEP-0116 (ESession)
For usage between two online partners, the ESession protocol as defined in XEP-0116 specifies how to exchange parameters for XEP-0200 using XEP-0155 (Stanza Session Negotiation). Its support for various methods to authenticate the partner (or letting that be) makes it very complex to implement.
XEP-0217 (Simple ESession)
To simplify implementation, the simpler XEP-0217 defines only a subset of XEP-0116 with exactly one method (Short authentication codes, SAS) to authenticate the partner, and thus is compatible to XEP-0116 implementations.
XEP-0187 (Offline ESession)
For usage with offline messages, the offline version of ESessions as defined in XEP-0187 uses XEP-0189 (Public Key Publishing) via PEP (Personal Eventing Protocol) instead of the active initiation of an ESession.
XTLS
XTLS, as described in draft-meyer-xmpp-e2e-encryption, uses Jingle to negotiate an end-to-end stream between two XMPP clients and establishes a TLS connection over this stream. This stream can also reside within existing connections, with In-Band Bytestreams.
miller-e2e
This is the protocol described in draft-miller-xmpp-e2e, which allows encryption and signing of arbitrary XMPP stanzas.
OTR (Off-the-record Messaging)
OTR is a crypto protocol, specifically designed to secure instant messaging conversations.
TS (Text Secure Protocol)
Text Secure is a rather new open mobile messenger which has an openly specified protocol. This protocol is described here.
SCIMP ( Silent Circle Instant Messaging Protocol)
SCIMP is the cryptographic protocol used by Silent Text, which enables private conversations over standard XMPP.
Comparative Overview
Proposal | Security property | Communication patterns | Compatibility with XMPP | ||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Authenticity | Integrity | Encryption | Forward secrecy | Malleable encryption | One-to-One | Groupchat | Online chats | Offline messages | Multiple resources | Discovery of support | |
XEP-0027 | No (messages only encrypted, not signed) | No | Yes | No | N/A | Yes | No | Yes | Yes | Yes (if same keypair at all resources) | No |
RFC 3923 | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? |
XEP-0200 | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes (XEP-0116/XEP-217) | Yes (XEP-0187) | No | Yes |
XTLS | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? |
miller-e2e | Optional (Nesting signature/encryption) | Yes | Yes | No | No | Yes | Possible | Yes | No | Yes | Yes |
OTR | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes | No | No | No |
TS | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? |
SCIMP | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? | ? |
Related Documents
Discussion
If you have any questions or comments regarding this page, please join the XSF chatroom at xsf@muc.xmpp.org.