module XMPP::TLSChannelBindingDowngradeProtection

Overview

XEP-0515: TLS Channel-Binding Downgrade Protection

The server's t attribute is part of the signed SCRAM server-first-message. Comparing it with the locally negotiated TLS version prevents a MITM from using different TLS versions on each side in order to downgrade the available channel-binding types.

Defined in:

xmpp/auth/tls_downgrade_protection.cr

Constant Summary

TLS_VERSION_CODES = {"TLSv1.3" => "0304", "TLSv1.2" => "0303", "TLSv1.1" => "0302", "TLSv1" => "0301", "TLSv1.0" => "0301"}

Class Method Summary

Class Method Detail

def self.verify!(server_version : String | Nil, negotiated_tls_version : String | Nil) : Nil #

Verifies the optional XEP-0515 SCRAM attribute.

A missing t attribute means that the server does not implement XEP-0515. If an implementing server's attribute were removed in transit, the SCRAM proof would still fail because the original server-first-message is included in SCRAM's AuthMessage.


[View source]
def self.version_code(tls_version : String) : String | Nil #

Returns the four lower-case hexadecimal characters assigned to a TLS protocol version by the TLS specifications.


[View source]