Subject: [Stox] Stephen Farrell's IESG feedback on draft-ietf-stox-core

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 10 Feb 2014 11:24:19 -0700

( + STOX WG since one of the issues might deserve broader discussion )

Hi Stephen, thanks for your review:

https://datatracker.ietf.org/doc/draft-ietf-stox-core/ballot/

You wrote in part:

    - I wondered why you didn't just say that (D)TLS SHOULD
    be used/supported between gateways. Given that all the
    relevant bits of code are likely to support that, wouldn't
    it be a good thing?

Yes, that seems eminently reasonable.

    - Has anyone thought about confusability in the name
    mappings? I expected to see a bit of text in the
    security considerations but didn't see it.

Confusion is always possible. :-) Were you thinking about confusable 
characters from Unicode, or something else?

    - It seems a shame to not be able to gateway when the To is
    a sips URI at all but I understand that some loss of
    security is inevitable for cases like this. Is there any
    work planned for an update that would allow gatewaying for
    such cases, e.g. if the 1st XMPP server is the one to which
    the user is connected and the user is connected using
    XMPP/TLS?

Hmm. I cannot say that I am aware of planning for updates to provide 
more secure gatewaying, although folks active in the STOX WG might be 
thinking along those lines.

Depending on the deployment architecture, I think there are cases where 
it is *possible* to TLS-protect all the hops. For instance, if 
sip.example.org has a direct server-to-server connection to 
xmpp.example.com (no intermediate hops) and both organizations agree to 
force the use of TLS for client connections (e.g., via SLA), then I 
suppose that sip.example.com could honor 'sips' URIs when sending 
traffic to xmpp.example.com. However, such an arrangement is rare enough 
right now that I don't know if it is worth mentioning.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Stephen Farrell <[email-masked]>
Date: Mon, 10 Feb 2014 22:20:34 +0000

Hi Peter,

> Yes, that seems eminently reasonable.

Just to be clear - the above is the only DISCUSS point.

> characters from Unicode, or something else?

Right. Maybe its all there already and I just didn't see
if in the mapping stuff, or maybe not. I'm not sure.

> right now that I don't know if it is worth mentioning.

Fair enough. I can see that detecting that you (probably) have
all (D)TLS hops might be tricky and error prone.

Cheers,
S.

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 10 Feb 2014 15:52:11 -0700

> Just to be clear - the above is the only DISCUSS point.

Yep.

> if in the mapping stuff, or maybe not. I'm not sure.

Section 10.5 of draft-ietf-precis-framework has some very nice text 
about visually similar characters. We could borrow from that.

> all (D)TLS hops might be tricky and error prone.

That's how I see it.

Oh, and we at least need to mention DTLS for the UDP cases, though (see 
Section 5 of draft-ietf-stox-core).

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 11 Feb 2014 08:49:47 -0700

> Section 5 of draft-ietf-stox-core).

Hi Stephen,

We've posted an updated version:

https://datatracker.ietf.org/doc/draft-ietf-stox-core/

http://tools.ietf.org/rfcdiff?url2=draft-ietf-stox-core-10.txt

We haven't yet added any text about visually similar characters, though. 
Let me know what you think of the rest.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Feb 2014 15:54:53 +0000

> Let me know what you think of the rest.

Its lovely:-)

I've cleared the discuss, happy to chat more about
confusability stuff though I'm pretty sure you and
the WG know lots more about that than I do so I'll
be almost certainly be fine with whatever you think
is right. (Incl. if doing nothing is right.)

Thanks,
S.

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 11 Feb 2014 09:05:07 -0700

> is right. (Incl. if doing nothing is right.)

Having just re-read Section 10.5 of draft-ietf-precis-framework, I think 
we might point to that for a helpful treatment of the issues.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 11 Feb 2014 16:06:16 +0000

> we might point to that for a helpful treatment of the issues.

WFM,
Thanks,
S.

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 11 Feb 2014 11:33:14 -0700

>> we might point to that for a helpful treatment of the issues.

OK, I'll quickly spin a new version that contains the pointer.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/