On Sun, Oct 17, 2010 at 5:32 AM, Kurt Zeilenga <[email protected]> wrote:
> User provides hash: > > <presence > from='[email protected]/pda' > to='[email protected]/thirdwitch'> > <x xmlns='http://jabber.org/protocol/muc'> > <hash algorithm="sha2">hash</hash> > </x> > </presence> > > where hash was the base64 encoded sha2 hash over the concat of subscribers' > normalized bare jid, " ", the room's normalized bare jid, " ", and the shared > password. Yes, this is something like what I'm after. I'm not really looking to have individual identities authenticate. Instead, I'm looking for a more secure way to send the shared credentials for the room. In the end, the work flow I'd like to have is: 1. The user registers with the room where the owner requires the registration stanzas to be signed by a "known" user. 2. Once the user is registered, they join the room using a hash of the shared secret. Ideally, this would also be a signed stanza. 3. Members of the room can now exchange signed stanzas--which the recipients may not may not accept. I'm attempting to use a MUC as a shared trusted exchange. As such, I'd like to up the security around the shared secret. I suppose this should be shared on the muc list ([email protected]) but I haven't heard much come across that yet. -- --Alex Milowski "The excellence of grammar as a guide is proportional to the paucity of the inflexions, i.e. to the degree of analysis effected by the language considered." Bertrand Russell in a footnote of Principles of Mathematics _______________________________________________ JDev mailing list Forum: http://www.jabberforum.org/forumdisplay.php?f=20 Info: http://mail.jabber.org/mailman/listinfo/jdev Unsubscribe: [email protected] _______________________________________________
