Use of Transport Layer Security (TLS) in the Extensible Messaging and Presence Protocol (XMPP)

Support for TLS (specifically, the XMPP profile of STARTTLS) is mandatory for XMPP implementations, as already specified in and its predecessor . If the server to which an XMPP client or peer server connects does not offer a stream feature of <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/> (thus indicating that it is an XMPP 1.0 server that supports TLS), the initiating entity MUST NOT proceed with the stream negotiation and MUST instead abort the connection attempt. Although XMPP servers SHOULD include the <required/> child element to indicate that negotiation of TLS is mandatory, clients and peer servers MUST NOT depend on receiving the <required/> flag in determining whether TLS will be enforced for the stream.

Implementations MUST follow the recommendations in as to supporting various TLS versions and avoiding fallback to SSL.

Implementations MUST follow the recommendations in .

Implementations MUST follow the recommendations in . XMPP supports an application-layer compression technology , which might have slightly stronger security properties than TLS (at least because it is enabled after SASL authentication, as described in ).

Implementations MUST follow the recommendations in . Use of session IDs is RECOMMENDED instead of session tickets , since XMPP does not in general use state management technologies such as tickets or "cookies" . Note that, in XMPP, TLS session resumption can be used in concert with the XMPP Stream Management extension; see for further details.

Both the core XMPP specification and the "CertID" specification provide recommendations and requirements for certificate validation in the context of authenticated connections. This document does not supersede those specifications. Wherever possible, it is best to prefer authenticated connections (along with SASL ), as already stated in the core XMPP specification . In particular, clients MUST authenticate servers.

Given the pervasiveness of passive eavesdropping, even an unauthenticated connection might be better than an unencrypted connection (this is similar to the "better than nothing security" approach for IPsec ). In particular, because of current deployment challenges for authenticated connections between XMPP servers (see for details), it might be reasonable for XMPP server implementations to accept unauthenticated connections when the Server Dialback protocol is used for weak identity verification; this will at least enable encryption of server-to-server connections. Unauthenticated connections include connections negotiated using anonymous Diffie-Hellman algorithms or using self-signed certificates, among other scenarios.

Although there is no harm in supporting the TLS Server Name Indication (SNI) extension , this is not necessary since the same function is served in XMPP by the 'to' address of the initial stream header as explained in Section 4.7.2 of .

It is RECOMMENDED that XMPP clients provide ways for end users (and that XMPP servers provide ways for administators) to complete the following tasks: Determine if a client-to-server or server-to-server connection is encrypted and authenticated. Determine the version of TLS used for a client-to-server or server-to-server connection. Inspect the certificate offered by an XMPP server. Determine the cipher suite used to encrypt a connection. Be warned if the certificate changes for a given server.

As noted in "A Threat Model for Pervasive Passive Surveillance" ), the use of TLS can help limit the information available for correlation to the network and transport layer headers as opposed to the application layer. As typically deployed, XMPP technologies do not leave application-layer routing data (such as XMPP 'to' and 'from' addresses) at rest on intermediate systems, since there is only one hop between any two given XMPP servers. As a result, encrypting all hops (sending client to sender's server, sender's server to recipient's server, recipient's server to recipient's client) can help to limit the amount of "metadata" that might leak. It is possible that XMPP servers themselves might be compromised. In that case, per-hop encryption would not protect XMPP communications, and even end-to-end encryption of (parts of) XMPP stanza payloads would leave addressing information and XMPP roster data in the clear. By the same token, it is possible that XMPP clients (or the end-user devices on which such clients are installed) could also be compromised, leaving users utterly at the mercy of an adversary. This document, along with actions currently being taken to strenthen the security of the XMPP network, do not assume widespread compromise of XMPP servers and clients or their underlying operating systems or hardware. Thus it is assumed that ubiquitous use of per-hop TLS channel encryption and more significant deployment of end-to-end object encryption technologies will serve to protect XMPP communications to a measurable degree, compared to the alternatives.