[Standards] Re: XEP-0440 No supported channel bindings

Hi Dave! I'd argue that not supporting channel-binding means that you don't send any XEP-0440 related elements, rather than sending an empty XEP-0440 cb-list (and also don't advertise any *-PLUS methods, of course). Imho that's fine with XEP-0388 which states: Channel-Binding Type Capability (XEP-0440) [1]. So a server without cb, doesn't need to implement or send a XEP-0440 list at all. Per my reasoning above, I'd say: yes. -tmolitor Am Mittwoch, 5. November 2025, 11:57:38 CET schrieb Dave Cridland: > Thilo, sorry! > > I had somehow missed that SASL2 mandates XEP-0440. It makes a lot of sense. > > But... > > Openfire currently doesn't support any channel bindings. > > It is sometimes used in cases where there is no TLS at all. This is quite > deliberate and sensible in this case, please don't argue with this! This > means there will always be cases where there are no channel bindings > available (because there's no channel to bind to!). > > > I appreciate this is an oddball case (and I can support tls-server-endpoint > for most normal cases), but is this the intent here or was the expectation > that the minOccurs should be '0'? > > (I know tls-server-endpoint MUST be implemented, but MTI is not MTD etc). > > Dave.