Hi
I was reading XEP-0440 and noticed that since 2022-08 it requires
support for tls-server-end-point channel bindings.
I believe this is unfortunate because tls-server-end-point channel
binding are worse than either of tls-unique or tls-exporter.
Mandating support for this weak channel binding will detract from
efforts to implement the stronger tls-unique and tls-exporter. When
deciding what to prioritize, it may be that someone believes that since
XEP-0440 requires tls-server-end-point, it is more important to
implement it than spend time getting tls-exporter implemented. That
would be a bad outcome.
I suggest changing XEP-0440 to require tls-unique when TLS <= 1.2 is
used and tls-exporter when TLS >= 1.3 is used.
If you have already given up on supporting TLS <= 1.2 I think you
should only mandate tls-exporter as this is the best available channel
binding available.
I believe tls-server-end-point is generally best left unimplemented to
guide efforts towards supporting the stronger tls-exporter.
/Simon
