[Standards] XMPP and W3C Digital Signature Specification

Boyd Fletcher boyd.fletcher at je.jfcom.mil
Wed Apr 2 15:53:27 UTC 2008


Over the last couple of years we have discussed various approaches to add
digital signature support to XMPP that did not violate the XML nature of
XMPP like RFC3923. We would like to propose a method of using W3C¹s XML
Digital Signature specification. Below is description of how we use the W3C
spec with XMPP. We have been using this approach for about 3 years and it
seems to work quite well though it is a bit expensive in terms of message
size but with digital signatures, I¹m not sure that can be avoided.

We are curious what other people think and if its worth moving forward with
a XEP to formally describe the approach.

boyd



details:

We chose to use the W3C because its standardized, well understood, and
widely implemented. We were not planning to address how the public keys
between the users are exchanged or how the certificates are validated.

A digital signature is encapsulated in the <ds:Signature/> element. This
signature element is a child element of either <message/>, <presence/>,
<iq/>.  A client or server would use JID in XMPP stanzas to lookup a
client's X509 certificate. When multiple certificates are available for that
JID, the <ds:KeyName/> will identify which to use.
 
The <ds:KeyName/> carries a X509 fingerprint which is a MD5 digest of the
X509 certificate and formatted as hex characters, each byte separated by a
colon. For example,
<ds:Key-Name>94:01:67:A6:45:70:B3:AD:8D:A3:8D:B9:2F:46:AA:52</ds:KeyName>
 
A digitally signed IQ stanza. Note this does cause a slight incompatibility
with the current IQ schema as we would like to put the digital signature as
a 2nd child node of IQ to make it consistent with message and presence
stanzas. 


<iq xmlns="jabber:client" from="coallog1 at rel-cg.rel.je.joint.us/TransVerse"
id="MUCServiceInterface.roomInfo16"
to="log at conference.rel-cg.rel.je.joint.us" type="get"><query
xmlns="http://jabber.org/protocol/disco#info"></query><x
xmlns="jabber:x:tstamp" tstamp="2008-03-11T17:36:18.150Z"></x>
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></ds:Canonicaliz
ationMethod>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod>
<ds:Reference URI="">
<ds:Transforms>
<ds:Transform 
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Trans
form>
<ds:Transform 
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>FVBU+ucCf8bPWdiJbo7RXXGJhcI=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
usN4/Zb+eufe8lOIGez+TuxEiVGwOg3QZNzzx1Ld6fKBjYIIgB2Z9X1KuGkrWbrqcQg5EvOyhopa
RkgaWyRNtbYT6h2uw8C6af07iWR5Plwiv36r8Fiutcyx+ZSRzzF03uL8KfuKOvgerhjUS/ntAmHa
zvMrE37A5N39h/S6ZZIGZrmK2/2JxZRKEdnQtmgLMrccmfgmCUrSSEgs52kQ1Bt7PB5PW2Lxoj04
T5lU92o2f4QIxqLkND+rHYY09KzG28Vb9ImXg0vfhs1oWqP5j5HtxGoNfJ1eXQIQt/Mk9NOQFUHa
Zh8pwvfjbWeY2z7FW5x2RuYFGnpkd9OphBSwNw==
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIDwzCCAqugAwIBAgIBADANBgkqhkiG9w0BAQQFADCBpDELMAkGA1UEBhMCVVMxGDAWBgNVBAoT
D1UuUy4gR292ZXJubWVudDEMMAoGA1UECxMDRG9EMQwwCgYDVQQLEwNQS0kxDjAMBgNVBAsTBUNE
Q0lFMR8wHQYDVQQDExZyZWwtY2cucmVsLmplLmpvaW50LnVzMS4wLAYJKoZIhvcNAQkBFh9jb2Fs
bG9nMUByZWwtY2cucmVsLmplLmpvaW50LnVzMB4XDTA4MDIxOTE5NTczN1oXDTA5MDIxODE5NTcz
N1owgaQxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAKBgNVBAsTA0Rv
RDEMMAoGA1UECxMDUEtJMQ4wDAYDVQQLEwVDRENJRTEfMB0GA1UEAxMWcmVsLWNnLnJlbC5qZS5q
b2ludC51czEuMCwGCSqGSIb3DQEJARYfY29hbGxvZzFAcmVsLWNnLnJlbC5qZS5qb2ludC51czCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOsouVSsIFZMqQOYCBiDgyfQG3g2Z47MDm+e
qhJ1xqcvZfrvuIg/wPGYxiA/C3WOXN/aMmoTHkapP0K/wtXQQ4Csm1D7iwkN4UnKlccoh7EwqAOi
0ED+PGxjP8JB5VxDib6SWUKA0acE5NAgX0PX/KaMG1rrl5wDsFUtpt5r8j6RSx95ARGlYBZQWuWd
NBuy03vukiyuIT5fbSVqPKU9NCQIvJTjNFgemECdyQanrFdqQR8oBWXZ9uoWHa5+lKrnYWHHTUE/
ylTd05nlW725w9aNGFbkZNh/eYPOFtUuDOtxC7Uu2ii+gaKbjDK5NcqJwM3XgfNgU9mykqvU4zGJ
uukCAwEAATANBgkqhkiG9w0BAQQFAAOCAQEAmY+M5lV//+qL5JczL9vrdZCnxOxt3N3uw7JE4tIb
+oHC+TMHxLPEGoLOSb6muTpDiKLDeJBsrFf3KkvhnJZyU+dF3OPutm2nI8r9KsXIzF/mWHBPbZOE
HJHmenvR0v+7gcW4PJLQogb8sgdhIJmdo3ANPahppo+QyqDu4EeIFtf+qSNb7OA6EYDwNZCR67tO
ApA9dEOHtkGEIdoHAdmzYu6uIP3EhmYRSGulVqaVBB6OZdoq6OPlh6ER90xeDba2O5t7GkdbKdD9
vN3Qo9ZUVY9KkOP5wYgW6lvaD1xKf9LM/Er9dEVrJFPtPJFVOuTZlGIfQGSVz70Grv1Dwc2cIw==
</ds:X509Certificate>
</ds:X509Data>
<ds:KeyName>82:9D:A9:E4:0B:B2:A5:A2:77:D3:A5:D1:43:C0:79:CA</ds:KeyName>
</ds:KeyInfo>
</ds:Signature></iq>

 

A digitally signed PRESENCE stanza

 <presence xmlns="jabber:client"
from="coallog1 at rel-cg.rel.je.joint.us/TransVerse" xml:lang="en"
id="iq7DP-81" 
to="log at conference.rel-cg.rel.je.joint.us/coallog1"><status>Online</status><
priority>0</priority><x xmlns="http://jabber.org/protocol/muc"></x><x
xmlns="jabber:x:tstamp" tstamp="2008-03-11T17:36:19.338Z"></x><ds:Signature
xmlns="jabber:client" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xml:lang="en">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></ds:Canonicaliz
ationMethod>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod>
<ds:Reference URI="">
<ds:Transforms>
<ds:Transform 
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Trans
form>
<ds:Transform 
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>+Ux4t7g6eXoNzYQdMlI5lnAuAfQ=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
4bVVbgHaekPhBVAeDm8Fku6kLLiyy3Duvhy5BaJ9QDN4qyC7kwqxjd3SFzQ4NxtGqno1/QEjJBwG
371fTzxsYMBjSsDVSU2JdGJttsNs9vVF5CHvvqVugnHFBt2LQWaPKfxGLI9aEGwCrkkmtdMMGMBz
3q/JUzbG0PeG41SzUXpvnpiC/4PmhJv2G5pjrVXRTOyyi6DbeQY9bVOrcD4annwPKcSlAVvXOsRR
k6VhxtwTXqDl9/jOyktMfiFYcAQzyi6xvKRY/KBbybUhie9Mq5f1O88AJipr4+B2u8pNyCDvGNiW
zRuzG4bw7QlXuKUH8PcWDVbtXcXE+aJELTucwg==
</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>
MIIDwzCCAqugAwIBAgIBADANBgkqhkiG9w0BAQQFADCBpDELMAkGA1UEBhMCVVMxGDAWBgNVBAoT
D1UuUy4gR292ZXJubWVudDEMMAoGA1UECxMDRG9EMQwwCgYDVQQLEwNQS0kxDjAMBgNVBAsTBUNE
Q0lFMR8wHQYDVQQDExZyZWwtY2cucmVsLmplLmpvaW50LnVzMS4wLAYJKoZIhvcNAQkBFh9jb2Fs
bG9nMUByZWwtY2cucmVsLmplLmpvaW50LnVzMB4XDTA4MDIxOTE5NTczN1oXDTA5MDIxODE5NTcz
N1owgaQxCzAJBgNVBAYTAlVTMRgwFgYDVQQKEw9VLlMuIEdvdmVybm1lbnQxDDAKBgNVBAsTA0Rv
RDEMMAoGA1UECxMDUEtJMQ4wDAYDVQQLEwVDRENJRTEfMB0GA1UEAxMWcmVsLWNnLnJlbC5qZS5q
b2ludC51czEuMCwGCSqGSIb3DQEJARYfY29hbGxvZzFAcmVsLWNnLnJlbC5qZS5qb2ludC51czCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOsouVSsIFZMqQOYCBiDgyfQG3g2Z47MDm+e
qhJ1xqcvZfrvuIg/wPGYxiA/C3WOXN/aMmoTHkapP0K/wtXQQ4Csm1D7iwkN4UnKlccoh7EwqAOi
0ED+PGxjP8JB5VxDib6SWUKA0acE5NAgX0PX/KaMG1rrl5wDsFUtpt5r8j6RSx95ARGlYBZQWuWd
NBuy03vukiyuIT5fbSVqPKU9NCQIvJTjNFgemECdyQanrFdqQR8oBWXZ9uoWHa5+lKrnYWHHTUE/
ylTd05nlW725w9aNGFbkZNh/eYPOFtUuDOtxC7Uu2ii+gaKbjDK5NcqJwM3XgfNgU9mykqvU4zGJ
uukCAwEAATANBgkqhkiG9w0BAQQFAAOCAQEAmY+M5lV//+qL5JczL9vrdZCnxOxt3N3uw7JE4tIb
+oHC+TMHxLPEGoLOSb6muTpDiKLDeJBsrFf3KkvhnJZyU+dF3OPutm2nI8r9KsXIzF/mWHBPbZOE
HJHmenvR0v+7gcW4PJLQogb8sgdhIJmdo3ANPahppo+QyqDu4EeIFtf+qSNb7OA6EYDwNZCR67tO
ApA9dEOHtkGEIdoHAdmzYu6uIP3EhmYRSGulVqaVBB6OZdoq6OPlh6ER90xeDba2O5t7GkdbKdD9
vN3Qo9ZUVY9KkOP5wYgW6lvaD1xKf9LM/Er9dEVrJFPtPJFVOuTZlGIfQGSVz70Grv1Dwc2cIw==
</ds:X509Certificate>
</ds:X509Data>
<ds:KeyName>82:9D:A9:E4:0B:B2:A5:A2:77:D3:A5:D1:43:C0:79:CA</ds:KeyName>
</ds:KeyInfo>
</ds:Signature></presence>



A digitally signed MESSAGE stanza


<message xmlns="jabber:client"
from="coallog1 at rel-cg.rel.je.joint.us/TransVerse" xml:lang="en"
id="iq7DP-82" to="log at conference.rel-cg.rel.je.joint.us"
type="groupchat"><body>Hello, here is a test message</body><x
xmlns="jabber:x:tstamp" tstamp="2008-03-11T17:36:39.635Z"></x>
<ds:Signature xmlns="jabber:client"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xml:lang="en">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></ds:Canonicaliz
ationMethod>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></ds:SignatureMethod>
<ds:Reference URI="">
<ds:Transforms>
<ds:Transform 
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></ds:Trans
form>
<ds:Transform 
Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></ds:Transform>
</ds:Transforms>
<ds:DigestMethod 
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></ds:DigestMethod>
<ds:DigestValue>Hqo9Q47nZsSR0hmEijPujc0Ix/Y=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
yylIVYLGfRMa/YIBO7LGqz5OfeJ7SfZX27cwZD+JhYybXvyzO5rbWnJDcPjS2yMmmzBQGL+MLFYm
rbOxdaTD0p/zaK9ohUb8LBZPWx0fFR9EMUoEL/0O01yAoRvfbllCnG1HpHcI6BElcnDS03DxGVOi
KfmxcGZBl9WPjoX70q2O6p2wB7sDMaeaKXy7vsysaaLAtnmxP42yXjd9zlESEtY4G50qkMzF84+Q
R2Fb+Yt+2AOxNKTmUPJYtKpjXZg/fYlquoSeC2ft0ILF0e1+kFdfgaBYwVKamcygFasXNtagUgrN
vIOTnr2HSOgGfDP59OkCOaR5xWrTMyJatjjWGw==
</ds:SignatureValue>
<ds:KeyInfo>
<ds:KeyName>82:9D:A9:E4:0B:B2:A5:A2:77:D3:A5:D1:43:C0:79:CA</ds:KeyName>
</ds:KeyInfo></ds:Signature></message>






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.jabber.org/pipermail/standards/attachments/20080402/c3dbc6bd/attachment.html>


More information about the Standards mailing list