Trac is being migrated to new services! Issues can be found in our new
YouTrack instance and WIKI pages can be found on our
website.
- Timestamp:
-
Jan 26, 2014, 1:39:37 AM (10 years ago)
- Author:
-
elb
- Comment:
-
--
Legend:
- Unmodified
- Added
- Removed
- Modified
-
|
v1
|
v2
|
|
| 13 | 13 | * '''Reliance on SSL PKI.''' Similar to proprietary protocols, this is an obvious non-starter. Who trusts those guys? |
| 14 | 14 | * '''Limited third-party authentication functionality.''' Most or all existing protocols provide only limited support for authenticating an interlocutor's keys. In some cases the keys are used only for the protocol in question, and verification is provided only by the client itself. Some protocols use exclusively a specific third-party authentication mechanism (e.g., GPG or x.509 certificates with CA signatures). |
| | 15 | |
| | 16 | == Desiderata == |
| | 17 | |
| | 18 | I consider these features essential to a protocol that satisfies this call: |
| | 19 | |
| | 20 | * '''Strong authentication.''' All data exchanged via the protocol should have strong authentication. Not all data may be encrypted, but all data should be authenticated. |
| | 21 | * '''XMPP Presence integration.''' This means that XMPP presence stanzas for a client supporting the protocol should provide, at a minimum: |
| | 22 | * Notification that the client supports e2e encryption |
| | 23 | * Public key material or equivalent information, or a method to retrieve it |
| | 24 | * A cryptographically secured authentication mechanism for the above items (may, in this case, be a self-signature using the key material itself) |
| | 25 | There may be additional room for integration here; for example, authentication of the basic presence information is also desirable, but I do not consider it a strict requirement. |
| | 26 | * '''Streamlined one-on-one Chat.''' An equivalent protocol to the XMPP simple <message> stanza with a cleartext <body>, only encrypted and authenticated. The point of this protocol is to minimize overhead for typical one-on-one chat, for the benefit of mobile and bandwidth- or computationally-constrained clients. |
All information, including names and email addresses, entered onto this website or sent to mailing lists affiliated with this website will be public. Do not post confidential information, especially passwords!
