November 2025 - Standards

NEW: XEP-0507 (Jingle Content Category)
by Daniel Gultsch 11 Nov '25

11 Nov '25

Version 0.1.0 of XEP-0507 (Jingle Content Category) has been released. Abstract: This specification defines an XMPP extension to negotiate the use of Session Description Protocol (SDP) media- level attribute 'content' as defined by RFC 4796 with Jingle RTP sessions Changelog: Accepted as Experimental by council vote (dg) URL: https://xmpp.org/extensions/xep-0507.html Note: The information in the XEP list at https://xmpp.org/extensions/ is updated by a separate automated process and may be stale at the time this email is sent. The XEP documents linked herein are up-to- date.

1 0

Navigation instructions for Atom Over XMPP (XEP-0277 and XEP-0472)
by Schimon Jehudah 10 Nov '25

10 Nov '25

Good day. About ===== I have recently suggested at project Movim to add navigational instructions to Atom entries (i.e. posts). I am still experimenting it, and it currently seems useful. Technicality ============ The idea is realized in a similar fashion to the classification of comments node with rel='replies' and title='comments'. https://xmpp.org/extensions/xep-0277.xml#comments Navigation ========== I advise to enable navigational instructions with rel='navigation' and title='previous' and title='proceed', and perhaps also title='index'. At the bottom of this page there are proceed or previous links to navigate and are generated from the instructions proposed above. https://journal.woodpeckersnest.eu/posts/2024-11-05-xmpp-as-the-internet/ Advantages ========== Navigational instructions would conveniently facilitate the creation of a CMS even over a single PEP node, without a compulsory need of having a PubSub service with multiple nodes to do so, by relating from post to post from within each posts. Navigational instructions would also incentivise the creation of articles that are segmented into parts of a series of posts, and portability thereof. Kind regards, Schimon

1 1

XEP-0440 No supported channel bindings
by Dave Cridland 05 Nov '25

05 Nov '25

Thilo, sorry! I had somehow missed that SASL2 mandates XEP-0440. It makes a lot of sense. But... Openfire currently doesn't support any channel bindings. It is sometimes used in cases where there is no TLS at all. This is quite deliberate and sensible in this case, please don't argue with this! This means there will always be cases where there are no channel bindings available (because there's no channel to bind to!). The schema doesn't include a minOccurs, and that means minOccurs='1' by default. This means at least one channel binding MUST be included. Is this intentional? I appreciate this is an oddball case (and I can support tls-server-endpoint for most normal cases), but is this the intent here or was the expectation that the minOccurs should be '0'? (I know tls-server-endpoint MUST be implemented, but MTI is not MTD etc). Dave.

3 3

LAST CALL: XEP-0440 (SASL Channel-Binding Type Capability)
by Daniel Gultsch 05 Nov '25

05 Nov '25

This message constitutes notice of a Last Call for comments on XEP-0440. Title: SASL Channel-Binding Type Capability Abstract: This specification allows servers to annouce their supported SASL channel-binding types to clients. URL: https://xmpp.org/extensions/xep-0440.html This Last Call begins today and shall end at the close of business on 2025-10-28. Please consider the following questions during this Last Call and send your feedback to the standards(a)xmpp.org discussion list: 1. Is this specification needed to fill gaps in the XMPP protocol stack or to clarify an existing protocol? 2. Does the specification solve the problem stated in the introduction and requirements? 3. Do you plan to implement this specification in your code? If not, why not? 4. Do you have any security concerns related to this specification? 5. Is the specification accurate and clearly written? Your feedback is appreciated!

6 13

UPDATED: XEP-0474 (SASL SCRAM Downgrade Protection)
by Daniel Gultsch 03 Nov '25

03 Nov '25

Version 0.5.0 of XEP-0474 (SASL SCRAM Downgrade Protection) has been released. Abstract: This specification provides a way to secure the SASL and SASL2 handshakes against method and channel-binding downgrades. Changelog: * Add business rules describing client behavior * Make clear that PLAIN still has to be pinned away, if not disabled entirely (tm) URL: https://xmpp.org/extensions/xep-0474.html Note: The information in the XEP list at https://xmpp.org/extensions/ is updated by a separate automated process and may be stale at the time this email is sent. The XEP documents linked herein are up-to- date.

1 0

UPDATED: XEP-0440 (SASL Channel-Binding Type Capability)
by Daniel Gultsch 03 Nov '25

03 Nov '25

Version 0.5 of XEP-0440 (SASL Channel-Binding Type Capability) has been released. Abstract: This specification allows servers to annouce their supported SASL channel-binding types to clients. Changelog: * Address a possible MITM attack vector by making the tls-server-end- point channel-binding mandatory to implement * Remove the whole 'Interaction with SASL mechanisms' section and replace it with 'Business Rules' * Rework whole 'Security Considerations' section * Some minor editorial changes * Add Thilo Molitor as author (tm) URL: https://xmpp.org/extensions/xep-0440.html Note: The information in the XEP list at https://xmpp.org/extensions/ is updated by a separate automated process and may be stale at the time this email is sent. The XEP documents linked herein are up-to- date.

1 0