CPIM changes and XMPP

"Peterson, Jon" <[email protected]> writes:

> A number of changes have been introduced to the new CPIM drafts based on
> recent discussions in the mailing list.

...

> draft-ietf-impp-im-00 has a concept of a hop-count that is used for
> loop detection.

I wonder why the issue of hop counts and loop detection is part of
the document on instant messaging.  Don't we have to worry about the
same thing for subscription requests and notifications?

On another subject, I just read drafts from the Jabber Software
Foundation on the eXtensible Messaging and Presence Protocol (XMPP).
The first issue that that stood out to me is that no request is
time-stamped in this protocol!  Replay attacks seem to be of no
concern to the authors.

XMPP's support for end-to-end security appears to be an afterthought.
I found no end-to-end security for presence information or
subscription requests.  Instant messages can be encrypted using PGP,
as described in Appendix C of the XMPP Core document.  Because XML
syntax is used thoughout the protocol, encrypted data is encoded in
ASCII.  The protocol does not appear to be able to correctly interpret
signed or encrypted messages in the CPIM-MSG format.  My guess is the
authors think that security needs can be satisfied using weak
techniques such as hop-by-hop encryption, which require that a user
trust all servers that route the user's messages.

What is the relation of XMPP to the IMPP working group?

John



  [reminder: [email protected] for non-technical discussions, please]