Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does anyone know how ssl ciphers are nogitiated via the xmpp protocol. When I capture packets, I see:

<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

There is no hello server/client or cipher negotiation, like http. Can anyone point to somewhere I can get more information

share|improve this question
up vote 3 down vote accepted

As explained in RFC 3920 (section 5), a machine will send the "<starttls>" tag to indicate that it supports SSL/TLS, and then, when the final ">" of a subsequent "<proceed/>" XML element is sent and received, the underlying connection is immediately hijacked to begin a TLS handshake. The handshake consists in TLS messages (which are not XML at all), beginning with ClientHello (from the TLS "client") and then ServerHello (from the TLS "server") which includes cipher suite negotiation.

There is no method in XMPP to advertise specific TLS cipher suite support before the TLS handshake. From a packet capture view, you will see the ClientHello and ServerHello right after the "<proceed/>" tag, not where the "<starttls>" element occurs.

A consequence is that machines who use XMPP to talk to each other cannot know whether they will be able to find a TLS cipher suite that they both support before actually committing to TLS usage. It is not a big issue in practice, because SSL/TLS implementations support some fallback cipher suites which all implementations know of (RSA+RC4+SHA-1 and RSA+3DES+SHA-1, namely), even if they usually prefer some other cipher suites.

share|improve this answer
Small note, the latest XMPP specification is RFC6120. – MattJ Aug 29 '13 at 14:37
Also, regarding the concern about not having a common cipher, RFC 6120 makes implementation of at least TLS_RSA_WITH_AES_128_CBC_SHA mandatory: – MattJ Aug 29 '13 at 14:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.