[JDEV] servers specifying from fields

Fri Mar 2 18:11:09 CST 2001

How's this....

First, I want to make sure that everyone understands the point I'm trying
to make. Currently, there is no way to send encrypted messages where the
encrypted message is a block of xml to be parsed upon decryption. The
jabber:x:encrypted namespace only allows encrpytion of messages which are
to be displayed to the user upon decryption; the decrypted content is not
fed back into the parser. This means that currently, it's not possible to
encrypt an <x> element, have it sent over the jabber network, and have it
decrypted by the client at the other end. X elements contain anything from
URLs to unofficial extentions to allow for transmission of different kinds
of content. If for example I wanted to send a URL to another user but make
sure that it was encrypted all the way to the recipient, I cant right now
(unless I just send the url as a normal message, but that doesnt permit
for special handling of urls on the receiving client's end).

I'm adjusting the proposal to be that only <x> elements can be encrypted
and nested in <x> elements of the proposed namespace. So that the 'tree'
of xml elements is consistant, the decrypted <x> element should be
interpreted in the same context of the <x> element that contained
it. This makes the decrypted structure on the same level as a normally
received, non-encrypted message of the same type. For example:

(encrypted x element is
	<x xmlns='jabber:x:oob'><url>a</url><desc></desc></x> 
)

received:
<message>
	|-<body>This message is encrypted</body>
	|-<x xmlns='draft:x:nestedencrypted'> encrypted x element </x>

once decrypted:
<message>
	|-<body>This message is encrypted</body>
	|-<x xmlns='draft:x:nestedencrypted'> encrypted x element </x>
	|-<x xmlns='jabber:x:oob'><url>a</url><desc></desc></x>

The client probably does not need to keep the original encrypted part
(<x xmlns='draft:x:nestedencrypted'> encrypted x element </x>) around,
but I guess it doesnt need to delete it.

On Fri, 2 Mar 2001, Matthias Wimmer wrote:

> Hi Mathew!
> 
> Mathew A Johnston schrieb am 2001-03-01 19:56:22:
> > Why not just use standard message signing? That would ensure the identity
> > of the sender to the receiver, and require no server side support. Is this
> > not better?
> 
> With signed messages you need a trust center (two expensive) or a "web of
> trust" (doesn't work for all your contacts.
> So personally I do prefere the server checking/setting the from attribute.
> Dialback is less secure but works better in real environment with average
> users.
> 
> > Do you think that encapsulating encrypted jabber messages in
> > other jabber messages is a valid idea? I think that this is required if
> > extentions are to be able to communicate securely. Read my proposal? :)
> 
> I havn't read it ... but I think extensions have to be made in a way that they
> are compatible with the old protocol and old clients.
> Use SSL to communicate encrypted with your server ... and use jabber:x:encrypted
> for end-to-end encryption ...
> The from and to addresses are encrypted that way at the client-server-connection
> and for the server they have to be visible in any case to allow routing and
> bouncing of the messages.
> 
> 
> Tot kijk
>    Matthias
> -- 
> Fon: +49-(0)70 0770 07770               http://matthias-wimmer.de/
> Fax: +49-(0)89 312 88 654               jabber://mawis@charente.de
> 
> 