rust-imap
rust-imap copied to clipboard
RFC 9266: Channel Bindings for TLS 1.3 support
Dear @jonhoo,
Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?
- https://datatracker.ietf.org/doc/html/rfc9266
Channel Bindings for TLS: https://datatracker.ietf.org/doc/html/rfc5929
- XEP-0388: Extensible SASL Profile: https://xmpp.org/extensions/xep-0388.html
- XEP-0440: SASL Channel-Binding Type Capability: https://xmpp.org/extensions/xep-0440.html
- XEP-0474: SASL SCRAM Downgrade Protection: https://xmpp.org/extensions/xep-0474.html
- XEP-0480: SASL Upgrade Tasks: https://xmpp.org/extensions/xep-0480.html
Little details, to know easily:
- tls-unique for TLS =< 1.2
- tls-server-end-point
- tls-exporter for TLS = 1.3
I think that you have seen the jabber.ru MITM and Channel Binding is the solution:
- https://notes.valdikss.org.ru/jabber.ru-mitm/
- https://snikket.org/blog/on-the-jabber-ru-mitm/
- https://www.devever.net/~hl/xmpp-incident
- https://blog.jmp.chat/b/certwatch
Thanks in advance.
Linked to:
- https://github.com/scram-sasl/info/issues/1
- https://github.com/jonhoo/rust-imap/issues/275
Hi there! Channel binding would be a fairly substantial addition to the crate, and I'm not in a position to take on that work at the moment. I know @dequbed also wants them, and started some of the work required to get there in https://github.com/jonhoo/rust-imap/pull/243, but I think that has stalled out a little (though it's quite close!). If you would like to see this land, I suggest helping with getting that over the finish line, and then potentially looking to file a follow-up PR that incorporates channel binding.