IRC over TLS Port: Default Port for Internet Relay Chat (IRC) via TLS/SSL
Writes down the common practice of running encrypted IRC on TCP port 6697.
Hartmann, R., "Default Port for Internet Relay Chat (IRC) via TLS/SSL", RFC 7194, DOI 10.17487/RFC7194, August 2014, <https://www.rfc-editor.org/info/rfc7194>.
@misc{rfc7194,
series = {Request for Comments},
number = 7194,
howpublished = {RFC 7194},
publisher = {RFC Editor},
doi = {10.17487/RFC7194},
url = {https://www.rfc-editor.org/info/rfc7194},
author = {R. Hartmann},
title = {{Default Port for Internet Relay Chat (IRC) via TLS/SSL}},
pagetotal = 6,
year = 2014,
month = aug,
} RFC text
Contents
Independent Submission R. Hartmann
Request for Comments: 7194 August 2014
Updates: 1459
Category: Informational
ISSN: 2070-1721
Default Port for Internet Relay Chat (IRC) via TLS/SSL
Abstract
This document describes the commonly accepted practice of listening
on TCP port 6697 for incoming Internet Relay Chat (IRC) connections
encrypted via TLS/SSL.
Status of This Memo
This document is not an Internet Standards Track specification; it is
published for informational purposes.
This is a contribution to the RFC Series, independently of any other
RFC stream. The RFC Editor has chosen to publish this document at
its discretion and makes no statement about its value for
implementation or deployment. Documents approved for publication by
the RFC Editor are not a candidate for any level of Internet
Standard; see Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc7194.
Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document.
Table of Contents
1. Rationale .......................................................2
2. Technical Details ...............................................2
2.1. Connection Establishment ...................................2
2.2. Certificate Details ........................................3
2.2.1. Server Certificate ..................................3
2.2.2. Client Certificate ..................................3
3. Security Considerations .........................................3
4. IANA Considerations .............................................4
5. Normative References ............................................4
6. Informative References ..........................................4
7. Acknowledgements ................................................5
Appendix A. Supporting Data ........................................6
1. Rationale
Although system port assignments exist for IRC traffic that is plain
text (TCP/UDP port 194) or TLS/SSL encrypted (TCP/UDP port 994)
[IANALIST], it is common practice amongst IRC networks not to use
them for reasons of convenience and general availability on systems
where no root access is granted or desired.
IRC networks have defaulted to listening on TCP port 6667 for plain
text connections for a considerable time now. This is covered by the
IRCU assignment of TCP/UDP ports 6665-6669.
Similar consensus has been reached within the IRC community about
listening on TCP port 6697 for incoming IRC connections encrypted via
TLS/SSL [RFC5246].
2. Technical Details
2.1. Connection Establishment
An IRC client connects to an IRC server. Immediately after that, a
normal TLS/SSL handshake takes place. Once the TLS/SSL connection
has been established, a normal IRC connection is established via the
tunnel. Optionally, the IRC server may set a specific user mode
(umode) for the client, marking it as using TLS/SSL. Again,
optionally, an IRC server might offer the option to create channels
in such a way that only clients connected via TLS/SSL may join.
For details on how IRC works, see [RFC1459], [RFC2810], [RFC2811],
[RFC2812], and [RFC2813]. Please note that IRC is extremely
fragmented, and implementation details can vary wildly. Most
implementations regard the latter RFCs as suggestions, not as
binding.
2.2. Certificate Details
2.2.1. Server Certificate
The IRC server's certificate should be issued by a commonly trusted
certification authority (CA).
The Common Name should match the Fully Qualified Domain Name (FQDN)
of the IRC server or have appropriate wildcards, if applicable.
The IRC client should verify the certificate.
2.2.2. Client Certificate
If the client is using a certificate as well, it should be issued by
a commonly trusted CA or a CA designated by the IRC network.
The certificate's Common Name should match the main IRC nickname.
If the network offers nick registration, this nick should be used.
If the network offers grouped nicks, the main nick or account name
should be used.
If the network offers nick registration, the client certificate
should be used to identify the user against the nick database. See
[CERTFP] for a possible implementation.
3. Security Considerations
The lack of a common, well-established listening port for IRC via
TLS/SSL could lead to end users being unaware of their IRC network of
choice supporting TLS/SSL. Thus, they might not use encryption even
if they wanted to.
It should be noted that this document merely describes client-to-
server encryption. There are still other attack vectors like
malicious administrators, compromised servers, insecure server-to-
server communication, channels that do not enforce encryption for all
channel members, malicious clients, or comprised client machines on
which logs are stored.
Those attacks can by their very nature not be addressed by client-to-
server encryption. Additional safeguards are needed if a user fears
any of the threats above.
This document does not address server links as there are no commonly
accepted ports or even back-end protocols. Ports and back-end
protocols are normally established in a bilateral agreement. All
operators are encouraged to use strong encryption for back-end
traffic, no matter if they offer IRC via TLS/SSL to end users.
4. IANA Considerations
An assignment of TCP port 6697 for IRC via TLS/SSL has been made.
The service name is "ircs-u" and the description "Internet Relay Chat
via TLS/SSL":
ircs-u 6697/tcp Internet Relay Chat via TLS/SSL
5. Normative References
[RFC1459] Oikarinen, J. and D. Reed, "Internet Relay Chat Protocol",
RFC 1459, May 1993.
[RFC2810] Kalt, C., "Internet Relay Chat: Architecture", RFC 2810,
April 2000.
[RFC2811] Kalt, C., "Internet Relay Chat: Channel Management", RFC
2811, April 2000.
[RFC2812] Kalt, C., "Internet Relay Chat: Client Protocol", RFC
2812, April 2000.
[RFC2813] Kalt, C., "Internet Relay Chat: Server Protocol", RFC
2813, April 2000.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008.
6. Informative References
[IANALIST] IANA, "Service Name and Transport Protocol Port Number
Registry", <http://www.iana.org/assignments/
service-names-port-numbers>.
[TOP100] netsplit.de, "IRC Networks - Top 100",
<http://irc.netsplit.de/networks/top100.php>.
[MAVERICK] netsplit.de, "IRC Networks - in alphabetical order",
<http://irc.netsplit.de/networks/
lists.php?query=maverick>.
[CERTFP] The Open and Free Technology Community, "OFTC -
NickServ/CertFP",
<http://www.oftc.net/oftc/NickServ/CertFP>.
7. Acknowledgements
Thanks go to the IRC community at large for reaching a consensus.
Special thanks go to the IRC operators who were eager to support port
6697 on their respective networks.
Special thanks also go to Nevil Brownlee and James Schaad for working
on this document in their capacities as Independent Submissions
Editor and Reviewer, respectively.
Appendix A. Supporting Data
As of October 2010, out of the top twenty IRC networks [TOP100]
[MAVERICK], ten support TLS/SSL. Only one of those networks does not
support TLS/SSL via port 6697 and has no plans to support it. All
others supported it already or are supporting it since being
contacted by the author. A more detailed analysis is available but
does not fit within the scope of this document.
Authors' Address
Richard Hartmann
Munich
Germany
EMail: richih.mailinglist@gmail.com
URI: http://richardhartmann.de
AI ELI5
On this page
§1Why a Common Port Was Needed
System port assignments already exist for IRC: TCP/UDP port 194 for plain text and TCP/UDP port 994 for TLS/SSL encrypted traffic. The RFC says IRC networks commonly do not use them, for reasons of convenience and general availability on systems where no root access is granted or desired.
Instead, IRC networks have long defaulted to TCP port 6667 for plain text, which falls inside the IRCU assignment of TCP/UDP ports 6665-6669. The IRC community reached a similar consensus about TCP port 6697 for IRC encrypted with TLS/SSL, and this RFC records that practice.
There were official door numbers for chat, but nobody used them because they were awkward. People settled on their own numbers instead, and this document writes down the one for private chats.
- 194Plain text IRC — System port assignment (TCP/UDP), rarely used by IRC networks.
- 994TLS/SSL IRC — System port assignment (TCP/UDP), rarely used by IRC networks.
- 6665-6669IRCU assignment — Covers port 6667, the long-time default for plain text.
- 6697IRC via TLS/SSL — Common practice, now assigned by IANA as ircs-u (TCP).
§2.1How a TLS Connection Starts
An IRC client connects to an IRC server. Right after that, a normal TLS/SSL handshake takes place. Once the TLS/SSL connection is established, a normal IRC connection is set up through the tunnel. There is no special IRC-level negotiation to switch encryption on.
Two optional extras are mentioned. The server may set a specific user mode (umode) marking the client as using TLS/SSL, and a server may let users create channels that only clients connected via TLS/SSL can join.
The RFC points to RFC 1459, RFC 2810, RFC 2811, RFC 2812 and RFC 2813 for how IRC itself works, and warns that IRC is extremely fragmented. Most implementations treat the later RFCs as suggestions, not as binding.
You knock on the private door, you and the server first agree on a secret code, and only then do you start chatting. Some servers also put a little badge on you to show you came in the private way.
§2.2Certificate Details
The server's certificate should be issued by a commonly trusted certification authority (CA). Its Common Name should match the server's fully qualified domain name (FQDN) or use appropriate wildcards, and the client should verify the certificate.
If a client also uses a certificate, it should come from a commonly trusted CA or one designated by the IRC network. Its Common Name should match the main IRC nickname, or the registered nick or account name where the network offers nick registration or grouped nicks. Where nick registration exists, the client certificate should be used to identify the user against the nick database.
All of these are should in lower case; the RFC does not use RFC 2119 keywords.
The server shows an ID card from someone everybody trusts, and your app checks it. If you have your own ID card, it should carry your chat nickname.
§3What This Does and Does Not Protect
Without a well-established port for IRC over TLS/SSL, users may not realize their network supports encryption and so may not use it even if they wanted to.
The document describes only client-to-server encryption. It lists threats that this cannot address: malicious administrators, compromised servers, insecure server-to-server communication, channels that do not enforce encryption for all members, malicious clients, and compromised client machines where logs are stored. Users who fear these need additional safeguards.
Server links are out of scope because there are no commonly accepted ports or back-end protocols; these are normally set by bilateral agreement. All operators are encouraged to use strong encryption for back-end traffic.
A private door keeps people in the hallway from listening. It does not help if the person you are chatting with, or the room itself, is not trustworthy.
§4The IANA Port Assignment
IANA assigned TCP port 6697 for IRC via TLS/SSL, with the service name ircs-u and the description "Internet Relay Chat via TLS/SSL".
Appendix A adds supporting data: as of October 2010, ten of the top twenty IRC networks supported TLS/SSL. Only one of those did not support it on port 6697 and had no plans to. All the others supported it already or did so after being contacted by the author.
The official list of door numbers now has an entry saying that 6697 is the private chat door.