XSF Discussion - 2012-08-29

mail

ups sorry

each message comes twice here with the latest Psi version

stpeter, I've looked at DANE and DNA and stuff. It seems to be all about a client verifying a server that it's connecting to. Do you know if anyone tried dealing with the case where a server wants to auth an incoming client connection? I found some thread on the dane list, but it didn't lead anywhere.

Zash: by "auth an incoming client connection" do you mean using SASL EXTERNAL and client certificates?

Yes

For s2s connections mainly

ah, for s2s

I added a bit of text about that to RFC 6125 IIRC, or maybe it just ended up in RFC 6120

in relation to DANE?

no

because DANE didn't exist back then :)

Right

basically, in s2s each server would handle things mostly in the same way, because the connection needs to be validated in each direction -- hold for URL about some more specific text

The undefined bit seems to be where to look for a TLSA record when you have an incomming connection

http://xmpp.org/rfcs/rfc6120.html#security-certificates-validation-server

Zash: right

Zash: Jeff Hodges and I need to update RFC 6125 to incorporate the thinking from DANE, but it was such a lot of work the first time around that we don't want to open the can of worms again