Re: dialback in DNA

On 10/13/14, 3:53 PM, Philipp Hancke wrote:
> Am 13.10.2014 16:24, schrieb Peter Saint-Andre - &yet:
> [...]
>> Matt and I propose adding the following text to §7:
>>
>>     Although the PKIX prooftype uses the XMPP Server Dialback protocol
>
> reuses?
>
>>     [XEP-0220] for signalling between servers, this framework document
>
> [XEP-0220] _syntax_ for ...?
>
>>     does not define the exchange of dialback keys (also specified in
>>     [XEP-0220]) as a DNA prooftype.  However, a future specification, or
>
> but doesn't use the semantics for the generation and validation of
> dialback keys?

Will fix.

> I'd note that it will still work with server dialback because one of the
> design goals was backward compat.

I propose that we add this clause:

"nothing in this document prevents the continued use of server dialback"

> So we don't need to define anything.

I'd need to double-check XEP-0220, one of our favorite documents. ;-)

>>     an updated version of [XEP-0220], might define a DNA prooftype for
>>     dialback
>
> I just tried that and failed.

How so?

> Let's try to find some time and a
> whiteboard later this year.

Always a pleasure. :-)

>> in a way that is consistent with this framework.
>
> 0220 currently says that dialback-without-dialing-back is not described.
> smart servers should not use the db:verify to do any weak identify
> verification of the dialback keys.
> But if we make any such statements, they belong into the security
> considerations of xep-0220.

Makes sense to me.

Peter

-- 
Peter Saint-Andre
https://andyet.com/