30 Jun
2026
30 Jun
'26
4 p.m.
Version 0.1.0 of XEP-0516 (XMPP Decentralized ID (XID)) has been
released.
Abstract:
XMPP Decentralized ID (XID) is a DNS independent XMPP entity
identifier. This specification describes how to generate, use, and
handle them.
Changelog:
Accepted as Experimental by council vote (XEP Editor (dg))
URL: https://xmpp.org/extensions/xep-0516.html
Note: The information in the XEP list at https://xmpp.org/extensions/
is updated by a separate automated process and may be stale at the
time this email is sent. The XEP documents linked herein are up-to-
date.
30 Jun
30 Jun
11:58 p.m.
Hi all,
As stated in xsf@ this is trivially MITM'able isn't it ? I can advertise your XID
at my JID and then when anyone sends me a challenge I just send it to you and reply back
with your response to me?
Signing just the nonce is clearly inadequate, I think signing the nonce + sender jid +
responder jid (separated with something that can't be in any of the above, I think a
null byte should do?) would work, and you wouldn't need to keep timestamp but if you
do that should be concatenated+signed too.
Thanks,
moparisthebest
On June 30, 2026 11:00:34 AM EDT, Daniel Gultsch <daniel(a)gultsch.de> wrote:
Version 0.1.0 of XEP-0516 (XMPP Decentralized ID (XID))
has been
released.
Abstract:
XMPP Decentralized ID (XID) is a DNS independent XMPP entity
identifier. This specification describes how to generate, use, and
handle them.
Changelog:
Accepted as Experimental by council vote (XEP Editor (dg))
URL: https://xmpp.org/extensions/xep-0516.html
Note: The information in the XEP list at https://xmpp.org/extensions/
is updated by a separate automated process and may be stale at the
time this email is sent. The XEP documents linked herein are up-to-
date.
_______________________________________________
Standards mailing list -- standards(a)xmpp.org
To unsubscribe send an email to standards-leave(a)xmpp.org
1 Jul
1 Jul
8:24 a.m.
Le mercredi 1 juillet 2026, 00:58:52 heure d’été d’Europe centrale Travis Burtrum a écrit
:
Hi all,
As stated in xsf@ this is trivially MITM'able isn't it ? I can advertise your XID
at my JID and then when anyone sends me a challenge I just send it to you and reply back
with your response to me?
Signing just the nonce is clearly inadequate, I think signing the nonce + sender jid +
responder jid (separated with something that can't be in any of the above, I think a
null byte should do?) would work, and you wouldn't need to keep timestamp but if you
do that should be concatenated+signed too.
Thanks,
moparisthebest
Hi moparisthebest,
yes the current challenge is flawed, it was already pointed out in previous discussion. I
was waiting for the XEP to be published to make the change (to not change anything during
council evaluation). There have been a lot of valuable feedback, I'll try to publish a
corrected version soon.
Best,
Goffi
20
days inactive
21
days old
2 comments
3 participants
participants (3)
-
Daniel Gultsch -
Goffi -
Travis Burtrum