[Security] XEP-0166, XEP-0167, XTLS - crypto and other stories.

Dirk Meyer dmeyer at tzi.de
Fri Dec 19 06:26:08 CST 2008

Justin Karneges wrote:
> Then the list reduces to:
>   ICE-TCP <-> TLS <-> File Transfer
>   PsuedoTcp <-> TLS <-> File Transfer
>   PsuedoTcp <-> TLS <-> Client-to-client stream
>   ICE-UDP <-> RTP (+SRTP)
>   ICE-UDP <-> DTLS <-> VPN
> Now we're getting somewhere.  

That looks good.

> We just need to do something about those mysterious crypto layers in
> the middle.  Maybe XEP-166 (Jingle itself) could simply define the
> optional usage of TLS and DTLS over reliable and unreliable
> transports, respectively? 

The question is where to add additional information required for the
crypto layer? I don't know SRTP, but it looks to me it uses a master key
to encrypt the traffic. Where does this key come from? The same applies
for (D)TLS: what kind of authentication do we want? X.509? OpenGPG? SRP?
XEP-0250 tries to fix that problem for TLS and adds an additional
handshake. What is the SRTP way of doing this?

I guess Jingle should include the following information: application
(e.g. file transfer), transport, and (optional) security layer. Similar
to transports, the security layer MAY have a handshake. So if we open
file transfer with IBB and TLS, the IBB open and XEP-0250 for TLS can
happen at the same time.

| <iq from='kingclaudius at shakespeare.lit/castle'
|     id='jingle1'
|     to='laertes at shakespeare.lit/castle'
|     type='set'>
|   <jingle xmlns='urn:xmpp:jingle:0'
|           action='session-initiate'
|           initiator='kingclaudius at shakespeare.lit/castle'
|           sid='851ba2'>
|     <content creator='initiator' name='a-file-offer'>
|       <description xmlns='urn:xmpp:jingle:apps:file-transfer:0'>
|         ...
|       </description>
|       <transport xmlns='urn:xmpp:jingle:transports:bytestreams:0'/>
|       <crypto xmlns='urn:xmpp:jingle:crypto:tls:0'/>
|     </content>
|   </jingle>
| </iq>

Now the clients exchange XEP-0250 stanzas and at the same time open the
SOCKS5 bytestream. After the TLS handshake on the bytestream is
complete, the Jingle session is open and the file transfer can start.

Like you can not combine any transport to any application (e.g. ICE-UDP
and file transfer does not work), you can not use any crypto layer in
any application. VoIP would use SRTP crypto, VPN DTLS. In the future we
may have something different.


Hard work often pays off after time.  But laziness always pays off now.

More information about the Security mailing list