Re: NEW: XEP-0516 (XMPP Decentralized ID (XID))

--===============0380887556783754066==
Content-Type: multipart/signed; boundary="nextPartB1E-JcboRC-7IYJqO_B85A";
 micalg="pgp-sha512"; protocol="application/pgp-signature"

--nextPartB1E-JcboRC-7IYJqO_B85A
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
From: Goffi <[email protected]>
To: XMPP Standards <[email protected]>
Subject: Re: [Standards] Re: NEW: XEP-0516 (XMPP Decentralized ID (XID))
Date: Wed, 01 Jul 2026 09:24:23 +0200
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0

Le mercredi 1 juillet 2026, 00:58:52 heure d=E2=80=99=C3=A9t=C3=A9 d=E2=80=
=99Europe centrale Travis Burtrum a =C3=A9crit :
> Hi all,
>=20
> As stated in xsf@ this is trivially MITM'able isn't it ? I can advertise =
your XID at my JID and then when anyone sends me a challenge I just send it=
 to you and reply back with your response to me?
>=20
> Signing just the nonce is clearly inadequate, I think signing the nonce +=
 sender jid + responder jid (separated with something that can't be in any =
of the above, I think a null byte should do?) would work, and you wouldn't =
need to keep timestamp but if you do that should be concatenated+signed too.
>=20
> Thanks,
> moparisthebest

Hi moparisthebest,

yes the current challenge is flawed, it was already pointed out in previous=
 discussion. I was waiting for the XEP to be published to make the change (=
to not change anything during council evaluation). There have been a lot of=
 valuable feedback, I'll try to publish a corrected version soon.


Best,
Goffi
--nextPartB1E-JcboRC-7IYJqO_B85A
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iQEzBAABCgAdFiEEsNZvWyEnjW9SVudbKqmcu6xuKwwFAmpEwKcACgkQKqmcu6xu
Kwwc/wf/cm7IhloOmoLrI9NPu0G7nlcJv3NxWTNosRB2D9zSnCRtenMnxLNhAxpl
e2JGVVhThiAC7n7E4WYSkJXSEhCCQUJNUouNYqSKVLQm0Bk955vylI/WaKirbhQd
qKdLMxIkh/Z9DhTswa7qGHDhfpcTAX5u1LTXYrOn4nNXC/wi0nbCLVUHNG8jmiVF
7frfNc1sts1hkFXlPiu35utXio/ikTOw6TkO4qEMDey6qamz4lcVRaA8qZoZkdB2
DMhU/nBayRygXpiSidYoHb9weoDQaBX00pa5oPaTEVGtXvtCRWLh0ctuCfdVkm/b
F73GyUZqJzrtRo+SkpO2WGC597gDgA==
=wn1y
-----END PGP SIGNATURE-----

--nextPartB1E-JcboRC-7IYJqO_B85A--




--===============0380887556783754066==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Standards mailing list -- [email protected]
To unsubscribe send an email to [email protected]

--===============0380887556783754066==--