Re: NEW: XEP-0516 (XMPP Decentralized ID (XID))
Travis Burtrum <[email protected]> Tue, 30 Jun 2026 18:58:52 -0400
| Newsgroups | gmane.network.jabber.standards-jig |
|---|---|
| Message-ID | <[email protected]> |
--===============4108121417116166588== Content-Type: multipart/alternative; boundary=----NK6C59ASM5808O2WXNOW0DTNIQ0J2N Content-Transfer-Encoding: 7bit ------NK6C59ASM5808O2WXNOW0DTNIQ0J2N Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, As stated in xsf@ this is trivially MITM'able isn't it ? I can advertise y= our XID at my JID and then when anyone sends me a challenge I just send it = to you and reply back with your response to me? Signing just the nonce is clearly inadequate, I think signing the nonce + = sender jid + responder jid (separated with something that can't be in any o= f the above, I think a null byte should do?) would work, and you wouldn't n= eed to keep timestamp but if you do that should be concatenated+signed too= =2E Thanks, moparisthebest On June 30, 2026 11:00:34 AM EDT, Daniel Gultsch <daniel@gultsch=2Ede> wro= te: >Version 0=2E1=2E0 of XEP-0516 (XMPP Decentralized ID (XID)) has been >released=2E > >Abstract: >XMPP Decentralized ID (XID) is a DNS independent XMPP entity >identifier=2E This specification describes how to generate, use, and >handle them=2E > >Changelog: >Accepted as Experimental by council vote (XEP Editor (dg)) > >URL: https://xmpp=2Eorg/extensions/xep-0516=2Ehtml > >Note: The information in the XEP list at https://xmpp=2Eorg/extensions/ >is updated by a separate automated process and may be stale at the >time this email is sent=2E The XEP documents linked herein are up-to- >date=2E >_______________________________________________ >Standards mailing list -- standards@xmpp=2Eorg >To unsubscribe send an email to standards-leave@xmpp=2Eorg ------NK6C59ASM5808O2WXNOW0DTNIQ0J2N Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div dir=3D"auto">Hi all,<br><br>As stated in xsf@= this is trivially MITM'able isn't it ? I can advertise your XID at my JID = and then when anyone sends me a challenge I just send it to you and reply b= ack with your response to me?<br><br>Signing just the nonce is clearly inad= equate, I think signing the nonce + sender jid + responder jid (separated w= ith something that can't be in any of the above, I think a null byte should= do?) would work, and you wouldn't need to keep timestamp but if you do tha= t should be concatenated+signed too=2E<br><br>Thanks,<br>moparisthebest</di= v><br><br><div class=3D"gmail_quote"><div dir=3D"auto">On June 30, 2026 11:= 00:34 AM EDT, Daniel Gultsch <daniel@gultsch=2Ede> wrote:</div><block= quote class=3D"gmail_quote" style=3D"margin: 0pt 0pt 0pt 0=2E8ex; border-le= ft: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <pre class=3D"com-fsck-k9__plain-text-message-pre"><div dir=3D"auto">Versi= on 0=2E1=2E0 of XEP-0516 (XMPP Decentralized ID (XID)) has been<br>released= =2E<br><br>Abstract:<br>XMPP Decentralized ID (XID) is a DNS independent XM= PP entity<br>identifier=2E This specification describes how to generate, us= e, and<br>handle them=2E<br><br>Changelog:<br>Accepted as Experimental by c= ouncil vote (XEP Editor (dg))<br><br>URL: <a href=3D"https://xmpp=2Eorg/ext= ensions/xep-0516=2Ehtml">https://xmpp=2Eorg/extensions/xep-0516=2Ehtml</a><= br><br>Note: The information in the XEP list at <a href=3D"https://xmpp=2Eo= rg/extensions/">https://xmpp=2Eorg/extensions/</a><br>is updated by a separ= ate automated process and may be stale at the<br>time this email is sent=2E= The XEP documents linked herein are up-to-<br>date=2E<hr>Standards mailing= list -- standards@xmpp=2Eorg<br>To unsubscribe send an email to standards-= leave@xmpp=2Eorg<br></div></pre></blockquote></div></body></html> ------NK6C59ASM5808O2WXNOW0DTNIQ0J2N-- --===============4108121417116166588== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Standards mailing list -- [email protected] To unsubscribe send an email to [email protected] --===============4108121417116166588==--