< draft-ietf-dice-profile-00.txt   draft-ietf-dice-profile-01.txt >
dice K. Hartke dice K. Hartke
Internet-Draft Universitaet Bremen TZI Internet-Draft Universitaet Bremen TZI
Intended status: Informational H. Tschofenig Intended status: Informational H. Tschofenig
Expires: October 2, 2014 ARM Ltd. Expires: November 7, 2014 ARM Ltd.
March 31, 2014 May 6, 2014
A DTLS 1.2 Profile for the Internet of Things A DTLS 1.2 Profile for the Internet of Things
draft-ietf-dice-profile-00 draft-ietf-dice-profile-01.txt
Abstract Abstract
This document defines a DTLS profile that is suitable for Internet of This document defines a DTLS profile that is suitable for Internet of
Things applications and is reasonably implementable on many Things applications and is reasonably implementable on many
constrained devices. constrained devices.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
skipping to change at page 1, line 33 skipping to change at page 1, line 33
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on October 2, 2014. This Internet-Draft will expire on November 7, 2014.
Copyright Notice Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. The Communication Model . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 5 3. The Communication Model . . . . . . . . . . . . . . . . . . . 4
4. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 6 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6
5. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 8 5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8
6. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 10 6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9
7. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 11 7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11
8. Session Resumption . . . . . . . . . . . . . . . . . . . . . 12 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 13
9. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 13 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 13
10. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 13 10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14
11. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 14 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14
12. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 14 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15
13. Privacy Considerations . . . . . . . . . . . . . . . . . . . 14 13. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 15
14. Security Considerations . . . . . . . . . . . . . . . . . . . 15 14. Privacy Considerations . . . . . . . . . . . . . . . . . . . 15
15. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 15. Security Considerations . . . . . . . . . . . . . . . . . . . 16
16. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15 16. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
17. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 17. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 16
17.1. Normative References . . . . . . . . . . . . . . . . . . 16 18. References . . . . . . . . . . . . . . . . . . . . . . . . . 17
17.2. Informative References . . . . . . . . . . . . . . . . . 17 18.1. Normative References . . . . . . . . . . . . . . . . . . 17
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19 18.2. Informative References . . . . . . . . . . . . . . . . . 18
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20
1. Introduction 1. Introduction
This document defines a DTLS 1.2 [RFC6347] profile that offers This document defines a DTLS 1.2 [RFC6347] profile that offers
communication security for Internet of Things (IoT) applications and communication security for Internet of Things (IoT) applications and
is reasonably implementable on many constrained devices. It aims to is reasonably implementable on many constrained devices. It aims to
meet the following goals: meet the following goals:
o One-stop shop for implementers through the specification jungle. o Serve as a one-stop shop for implementers to know which pieces of
the specification jungle contain relevant details.
o This document does not alter the DTLS 1.2 specification. o Not alter the DTLS specification.
o This document does not introduce new extensions. o Not introduce any new extensions.
o This profile aligns with the DTLS security modes of the o Align with the DTLS security modes of the Constrained Application
Constrained Application Protocol (CoAP) [I-D.ietf-core-coap]. Protocol (CoAP) [I-D.ietf-core-coap].
DTLS is used to secure a number of applications run over an DTLS is used to secure a number of applications run over an
unreliable datagram transport. CoAP [I-D.ietf-core-coap] is one such unreliable datagram transport. CoAP [I-D.ietf-core-coap] is one such
protocol and has been designed specifically for use in IoT protocol and has been designed specifically for use in IoT
environments. CoAP can be secured using a number of different ways, environments. CoAP can be secured a number of different ways, also
also called security modes. These security modes are: called security modes. These security modes are as follows, see
Section 5, Section 6, Section 7 for additional details:
No Security Protection at the Transport Layer: No DTLS is used but No Security Protection at the Transport Layer: No DTLS is used but
instead application layer security functionality is assumed. instead application layer security functionality is assumed.
Shared Secret-based DTLS Authentication: DTLS supports the use of Shared Secret-based DTLS Authentication: DTLS supports the use of
shared secrets [RFC4279]. This credential is useful if the number shared secrets [RFC4279]. This mode is useful if the number of
of communication relationships between the IoT device and servers communication relationships between the IoT device and servers is
is small and for very constrained devices. Shared secret-based small and for very constrained devices. Shared secret-based
authentication mechanisms offer good performance and require a authentication mechanisms offer good performance and require a
minimum of data to be exchanged. minimum of data to be exchanged.
DTLS Authentication using Asymmetric Credentials: TLS supports DTLS Authentication using Asymmetric Cryptography: TLS supports
client and server authentication using asymmetric credentials. client and server authentication using asymmetric cryptography.
Two approaches for validating these public key are available. Two approaches for validating these public keys are available.
First, [I-D.ietf-tls-oob-pubkey] allows raw public keys to be used First, [I-D.ietf-tls-oob-pubkey] allows raw public keys to be used
in TLS without the overhead of certificates. This approach in TLS without the overhead of certificates. This approach
requires out-of-band validation of the public key. Second, the requires out-of-band validation of the public key. Second, the
use of X.509 certificates [RFC5280] with TLS is common on the Web use of X.509 certificates [RFC5280] with TLS is common on the Web
today (at least for server-side authentication) and certain IoT today (at least for server-side authentication) and certain IoT
environments may also re-use those capabilities. Certificates environments may also re-use those capabilities. Certificates
bind an identifier to the public key signed by a certification bind an identifier to the public key signed by a certification
authority (CA). A trust anchor store has to be provisioned on the authority (CA). A trust anchor store has to be provisioned on the
device to indicate what CAs are trusted. Furthermore, the device to indicate what CAs are trusted. Furthermore, the
certificate may contain a wealth of other information used to make certificate may contain a wealth of other information used to make
authorization decisions. authorization decisions.
As described in [I-D.ietf-lwig-tls-minimal] an application designer As described in [I-D.ietf-lwig-tls-minimal], an application designer
developing an IoT device needs to think about the security threats developing an IoT device needs to consider the security threats and
that need to be mitigated. For many Internet connected devices it the security services that can be used to mitigate the threats.
is, however, likely that authentication of the device and the server Enabling devices to upload data and retrieve configuration
infrastructure will be required. Along with the ability to upload information, inevitably requires that Internet-connected devices be
sensor data and to retrieve configuration information the need for able to authenticate themselves to servers and vice versa as well as
integrity and confidentiality protection will arise. While these to ensure that the data and information exchanged is integrity and
security services can be provided at different layers in the protocol confidentiality protected. While these security services can be
stack the use of channel security, as offered by DTLS, has been very provided at different layers in the protocol stack the use of
popular on the Internet and it is likely to be useful for IoT communication security, as offered by DTLS, has been very popular on
scenarios as well. In case the channel security features offered by the Internet and it is likely to be useful for IoT scenarios as well.
DTLS meet the security requirements of your application the remainder In case the communication security features offered by DTLS meet the
of the document might offer useful guidance. security requirements of your application the remainder of the
document might offer useful guidance.
Not every IoT deployment will use CoAP but the discussion regarding Not every IoT deployment will use CoAP but the discussion regarding
choice of credentials and cryptographic algorithms will be very choice of credentials and cryptographic algorithms will be very
similar. As such, the discussions in this document are applicable similar. As such, the discussions in this document are applicable
beyond the use of the CoAP protocol. beyond the use of the CoAP protocol.
The design of DTLS is intentionally very similar to TLS. Since DTLS The design of DTLS is intentionally very similar to TLS. Since DTLS
operates on top of an unreliable datagram transport a few operates on top of an unreliable datagram transport a few
enhancements to the TLS structure are, however necessary. RFC 6347 enhancements to the TLS structure are, however necessary. RFC 6347
explains these differences in great detail. As a short summary, for explains these differences in great detail. As a short summary, for
those familiar with TLS the differences are: those not familiar with DTLS the differences are:
o An explicit sequence number and an epoch field is included in the o An explicit sequence number and an epoch field is included in the
TLS Record Layer. Section 4.1 of RFC 6347 explains the processing TLS Record Layer. Section 4.1 of RFC 6347 explains the processing
rules for these two new fields. The value used to compute the MAC rules for these two new fields. The value used to compute the MAC
is the 64-bit value formed by concatenating the epoch and the is the 64-bit value formed by concatenating the epoch and the
sequence number. sequence number.
o Stream ciphers must not be used with DTLS. The only stream cipher o Stream ciphers must not be used with DTLS. The only stream cipher
defined for TLS 1.2 is RC4. defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it
is not recommended anymore even for use with TLS.
o The TLS Handshake Protocol has been enhanced to include a o The TLS Handshake Protocol has been enhanced to include a
stateless cookie exchange for Denial of Service (DoS) resistance. stateless cookie exchange for Denial of Service (DoS) resistance.
Furthermore, the header has been extended to deal with message Furthermore, the header has been extended to deal with message
loss, reordering, and fragmentation. Retransmission timers have loss, reordering, and fragmentation. Retransmission timers have
been included to deal with message loss. For DoS protection a new been included to deal with message loss. For DoS protection a new
handshake message, the HelloVerifyRequest, was added to DTLS. handshake message, the HelloVerifyRequest, was added to DTLS.
This handshake message is sent by the server and includes a This handshake message is sent by the server and includes a
stateless cookie, which is returned in a ClientHello message back stateless cookie, which is returned in a ClientHello message back
to the server. This type of DoS protection mechanism has also to the server. This type of DoS protection mechanism has also
been incorporated into the design of IKEv2. Although the exchange been incorporated into the design of IKEv2. Although the exchange
is optional for the server to execute, a client implementation has is optional for the server to execute, a client implementation has
to be prepared to respond to it. to be prepared to respond to it.
2. The Communication Model 2. Terminology
This document describes a profile of DTLS 1.2 and to be useful it has The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
to make assumptions about the envisioned communication architecture. "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
The architecture shown in Figure 1 assumes a uni-cast communication document are to be interpreted as described in [RFC2119].
interaction with an IoT device acting as a client and the client
interacts with one or multiple servers. Which server to contact is Note that "Client" and "Server" in this document refer to TLS roles,
based on pre-configuration onto the client (e.g., as part of the where the Client initiates the TLS handshake. This does not restrict
firmware). This configuration information also includes information the interaction pattern of the protocols carried inside TLS as the
about the PSK identity and the corresponding secret to be used with record layer allows bi-directional communication. In the case of
that specific server (in case of symmetric credentials). For CoAP the "Client" can act as a CoAP Server or Client.
asymmetric cryptography mutual authentication is assumed in this
profile. For raw public keys the public key or the hash of the 3. The Communication Model
public key is assumed to be available to both parties. For
certificate-based authentication the client may have a trust anchor This document describes a profile of DTLS 1.2 and, to be useful, it
store pre-populated, which allows the client to perform path has to make assumptions about the envisioned communication
validation for the certificate obtained during the handshake with the architecture.
server. The client also needs to know which certificate or raw
public key it has to use with a specific server. The communication architecture shown in Figure 1 assumes a uni-cast
communication interaction with an IoT device utilizing a DTLS client
and that client interacts with one or multiple DTLS servers.
Clients are preconfigured with the address or addresses of servers
(e.g., as part of the firmware) they will communicate with as well as
authentication information:
o For PSK-based authentication (see Section 5), this includes the
paired "PSK identity" and shared secret to be used with each
server.
o For raw public key-based authentication (see Section 6), this
includes either the server's public key or the hash of the
server's public key.
o For certificate-based authentication (see Section 7), this may
include a pre-populated trust anchor store that allows the client
to perform path validation for the certificate obtained during the
handshake with the server.
This document only focuses on the description of the DTLS client-side This document only focuses on the description of the DTLS client-side
functionality. functionality.
+////////////////////////////////////+ +////////////////////////////////////+
| Configuration | | Configuration |
|////////////////////////////////////| |////////////////////////////////////|
| Server A --> PSK Identity, PSK | | Server A --> PSK Identity, PSK |
| Server B --> Public Key (Server B),| | Server B --> Public Key (Server B),|
| Public Key (Client) | | Public Key (Client) |
skipping to change at page 5, line 36 skipping to change at page 6, line 36
'---+---' +------+ '---+---' +------+
| |Server| | |Server|
| | B | | | B |
| +------+ | +------+
| |
| +------+ | +------+
+----------------->|Server| +----------------->|Server|
| C | | C |
+------+ +------+
Figure 1: DTLS Profile: Assumed Communication Model. Figure 1: Constrained DTLS Client Profile.
A future version of this document may provide profiles for other
communication architectures.
3. The Ciphersuite Concept 4. The Ciphersuite Concept
TLS (and consequently DTLS) introduced the concept of ciphersuites TLS (and consequently DTLS) has the concept of ciphersuites and an
and an IANA registry [IANA-TLS] was created to keep track of the IANA registry [IANA-TLS] was created to register the suites. A
specified suites. A ciphersuites (and the specification that defines ciphersuite (and the specification that defines it) contains the
it) contains the following information: following information:
o Authentication and Key Exchange Algorithm (e.g., PSK) o Authentication and Key Exchange Algorithm (e.g., PSK)
o Cipher and Key Length(e.g., AES with 128 bit keys) o Cipher and Key Length (e.g., AES with 128 bit keys)
o Mode of operation (e.g., CBC)
o Mode of operation (e.g., CBC)
o Hash Algorithm for Integrity Protection (e.g., SHA in combination o Hash Algorithm for Integrity Protection (e.g., SHA in combination
with HMAC) with HMAC)
o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC
with the SHA-256) with the SHA-256)
o Misc information (e.g., length of authentication tags) o Misc information (e.g., length of authentication tags)
The TLS ciphersuite TLS_PSK_WITH_AES_256_CBC_SHA, for example, uses a o Information whether the ciphersuite is suitable for DTLS or only
pre-shared authentication and key exchange algorithm. RFC 4279, for TLS
which defined this ciphersuite predates publication of TLS 1.2. It
uses the Advanced Encryption Standard (AES) encryption algorithm, The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a
which is a block cipher. Since the AES algorithm supports different pre-shared authentication and key exchange algorithm. RFC 6655
key lengths (such as 128, 192 and 256 bits) this information has to [RFC6655] defines this ciphersuite. It uses the Advanced Encryption
be specified as well and the selected ciphersuite supports 256 bit Standard (AES) encryption algorithm, which is a block cipher. Since
keys. A block cipher encrypts plaintext in fixed-size blocks and AES the AES algorithm supports different key lengths (such as 128, 192
operates on fixed block size of 128 bits. For messages exceeding 128 and 256 bits) this information has to be specified as well and the
bits, the message is partitioned into 128-bit blocks and the AES selected ciphersuite supports 128 bit keys. A block cipher encrypts
cipher is applied to these input blocks with appropriate chaining, plaintext in fixed-size blocks and AES operates on fixed block size
which is called mode of operation. In our example, the mode of of 128 bits. For messages exceeding 128 bits, the message is
operation is cipher block chaining (CBC). Since encryption itself partitioned into 128-bit blocks and the AES cipher is applied to
does not provide integrity protection a hash function is specified as these input blocks with appropriate chaining, which is called mode of
well, which will be used in concert with the HMAC function. In this operation.
case, the Secure Hash Algorithm (SHA).
TLS 1.2 introduced Authenticated Encryption with Associated Data TLS 1.2 introduced Authenticated Encryption with Associated Data
(AEAD) ciphersuites. AEAD is a class of block cipher modes which (AEAD) ciphersuites [RFC5116]. AEAD is a class of block cipher modes
encrypt (parts of) the message and authenticate the message which encrypt (parts of) the message and authenticate the message
simultaneously. Examples of such modes include the Counter with CBC- simultaneously. Examples of such modes include the Counter with CBC-
MAC (CCM) mode, and the Galois/Counter Mode (GCM). MAC (CCM) mode, and the Galois/Counter Mode (GCM).
Some AEAD ciphersuites have shorter authentication tags and are
therefore more suitable for networks with low bandwidth where small
message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite
that ends in "_8" has an 8-octet authentication tag, while the
regular CCM ciphersuites have 16-octet authentication tags.
TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in
the TLS pseudo random function (PRF) with cipher-suite-specified the TLS pseudo random function (PRF) with cipher-suite-specified
PRFs. For this reason authors of more recent TLS 1.2 ciphersuite PRFs. For this reason authors of more recent TLS 1.2 ciphersuite
specifications explicitly indicate the MAC algorithm and the hash specifications explicitly indicate the MAC algorithm and the hash
functions used with the TLS PRF. functions used with the TLS PRF.
4. Pre-Shared Secret Authentication with DTLS This document references the CoAP recommended ciphersuite choices,
which have been selected based on implementation and deployment
experience from the IoT community. Over time the preference for
certain algorithms will, however, change. Not all components of a
ciphersuite change at the same speed. Changes are more likely to
expect for ciphers, the mode of operation, and the hash algorithms.
Some deployment environments will also be impacted by local
regulation, which might dictate a certain and less likely for public
key algorithms (such as RSA vs. ECC).
5. Pre-Shared Secret Authentication with DTLS
The use of pre-shared secret credentials is one of the most basic The use of pre-shared secret credentials is one of the most basic
techniques for DTLS since it is both computational efficient and techniques for DTLS since it is both computational efficient and
bandwidth conserving. Pre-shared secret based authentication was bandwidth conserving. Pre-shared secret based authentication was
introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in
Figure 2 illustrates the DTLS exchange including the cookie exchange. Figure 2 illustrates the DTLS exchange including the cookie exchange.
While the server is not required to initiate a cookie exchange with While the server is not required to initiate a cookie exchange with
every handshake, the client is required to implement and to react on every handshake, the client is required to implement and to react on
it when challenged. it when challenged.
skipping to change at page 7, line 44 skipping to change at page 9, line 10
identity. Hence, the TLS client and server clearly have to agree on identity. Hence, the TLS client and server clearly have to agree on
the identities and keys to be used. The mandated encoding of the identities and keys to be used. The mandated encoding of
identities in Section 5.1 of RFC 4279 aims to improve identities in Section 5.1 of RFC 4279 aims to improve
interoperability for those cases where the identity is configured by interoperability for those cases where the identity is configured by
a person using some management interface. Many IoT devices do, a person using some management interface. Many IoT devices do,
however, not have a user interface and most of their credentials are however, not have a user interface and most of their credentials are
bound to the device rather than the user. Furthermore, credentials bound to the device rather than the user. Furthermore, credentials
are provisioned into trusted hardware modules or in the firmware by are provisioned into trusted hardware modules or in the firmware by
the developers. As such, the encoding considerations are not the developers. As such, the encoding considerations are not
applicable to this usage environment. For use with this profile the applicable to this usage environment. For use with this profile the
PSK identities MUST NOT assume a structured format (as domain names, PSK identities SHOULD NOT assume a structured format (as domain
Distinguished Names, or IP addresses have) and a bit-by-bit names, Distinguished Names, or IP addresses have) and a bit-by-bit
comparison operation can then be used by the server-side comparison operation can then be used by the server-side
infrastructure. infrastructure.
As described in Section 2 clients may have pre-shared keys with As described in Section 3 clients may have pre-shared keys with
several different servers. The client indicates which key it uses by several different servers. The client indicates which key it uses by
including a "PSK identity" in the ClientKeyExchange message. To help including a "PSK identity" in the ClientKeyExchange message. To help
the client in selecting which PSK identity / PSK pair to use, the the client in selecting which PSK identity / PSK pair to use, the
server can provide a "PSK identity hint" in the ServerKeyExchange server can provide a "PSK identity hint" in the ServerKeyExchange
message. For Iot environments a simplifying assumption is made that message. For IoT environments a simplifying assumption is made that
the hint for PSK key selection is based on the domain name of the the hint for PSK key selection is based on the domain name of the
server. Hence, servers SHOULD NOT send the "PSK identity hint" in server. Hence, servers SHOULD NOT send the "PSK identity hint" in
the ServerKeyExchange message and client MUST ignore the message. the ServerKeyExchange message and client MUST ignore the message.
This approach is inline with RFC 4279 [RFC4279].
RFC 4279 requires TLS implementations supporting PSK ciphersuites to RFC 4279 requires TLS implementations supporting PSK ciphersuites to
support arbitrary PSK identities up to 128 octets in length, and support arbitrary PSK identities up to 128 octets in length, and
arbitrary PSKs up to 64 octets in length. This is a useful arbitrary PSKs up to 64 octets in length. This is a useful
assumption for TLS stacks used in the desktop and mobile environment assumption for TLS stacks used in the desktop and mobile environment
where management interfaces are used to provision identities and where management interfaces are used to provision identities and
keys. For the IoT environment, however, many devices are not keys. For the IoT environment, however, many devices are not
equipped with displays and input devices (e.g., keyboards). Hence, equipped with displays and input devices (e.g., keyboards). Hence,
keys are distributed as part of hardware modules or are embedded into keys are distributed as part of hardware modules or are embedded into
the firmware. As such, these restrictions are not applicable to this the firmware. As such, these restrictions are not applicable to this
skipping to change at page 8, line 35 skipping to change at page 9, line 46
Constrained Application Protocol (CoAP) [I-D.ietf-core-coap] Constrained Application Protocol (CoAP) [I-D.ietf-core-coap]
currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to
implement ciphersuite for use with shared secrets. This ciphersuite implement ciphersuite for use with shared secrets. This ciphersuite
uses the AES algorithm with 128 bit keys and CCM as the mode of uses the AES algorithm with 128 bit keys and CCM as the mode of
operation. The label "_8" indicates that an 8-octet authentication operation. The label "_8" indicates that an 8-octet authentication
tag is used. This ciphersuite makes use of the default TLS 1.2 tag is used. This ciphersuite makes use of the default TLS 1.2
Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash
function. function.
5. Raw Public Key Use with DTLS 6. Raw Public Key Use with DTLS
The use of raw public keys with DTLS, as defined in The use of raw public keys with DTLS, as defined in
[I-D.ietf-tls-oob-pubkey], is the first entry point into public key [I-D.ietf-tls-oob-pubkey], is the first entry point into public key
cryptography without having to pay the price of certificates and a cryptography without having to pay the price of certificates and a
PKI. The specification re-uses the existing Certificate message to PKI. The specification re-uses the existing Certificate message to
convey the raw public key encoded in the SubjectPublicKeyInfo convey the raw public key encoded in the SubjectPublicKeyInfo
structure. To indicate support two new TLS extensions had been structure. To indicate support two new TLS extensions had been
defined as shown in Figure 3, namely the server_certificate_type and defined, as shown in Figure 3, namely the server_certificate_type and
the client_certificate_type. To operate this mechanism securely it the client_certificate_type. To operate this mechanism securely it
is necessary to authenticate and authorize the public keys out-of- is necessary to authenticate and authorize the public keys out-of-
band. This document therefore assumes that a client implementation band. This document therefore assumes that a client implementation
comes with one or multiple raw public keys of servers, it has to comes with one or multiple raw public keys of servers, it has to
communicate with, pre-provisioned. Additionally, a device will have communicate with, pre-provisioned. Additionally, a device will have
its own raw public key. To replace, delete, or add raw public key to its own raw public key. To replace, delete, or add raw public key to
this list requires a software update, for example using a firmware this list requires a software update, for example using a firmware
update. update mechanism.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
client_certificate_type client_certificate_type
server_certificate_type server_certificate_type
<------- HelloVerifyRequest <------- HelloVerifyRequest
skipping to change at page 9, line 37 skipping to change at page 10, line 48
ClientKeyExchange ClientKeyExchange
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange.
The ciphersuite for use with this credential type is The CoAP recommended ciphersuite for use with this credential type is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [I-D.mcgrew-tls-aes-ccm-ecc]. TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [I-D.mcgrew-tls-aes-ccm-ecc].
This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite
uses the Elliptic Curve Diffie Hellman (ECDHE) as the key uses the Elliptic Curve Diffie Hellman (ECDHE) as the key
establishment mechanism and an Elliptic Curve Digital Signature establishment mechanism and an Elliptic Curve Digital Signature
Algorithm (ECDSA) for authentication. This ciphersuite make use of Algorithm (ECDSA) for authentication. This ciphersuite make use of
the AEAD capability in DTLS 1.2 and utilizes an eight-octet the AEAD capability in DTLS 1.2 and utilizes an eight-octet
authentication tag. Based on the Diffie-Hellman it provides perfect authentication tag. Based on the Diffie-Hellman it provides perfect
forward secrecy (PFS). More details about the PFS can be found in forward secrecy (PFS). More details about the PFS can be found in
Section 10. Section 11.
RFC 6090 [RFC6090] provides valuable information for implementing RFC 6090 [RFC6090] provides valuable information for implementing
Elliptic Curve Cryptography algorithms. Elliptic Curve Cryptography algorithms.
Since many IoT devices will either have limited ways to log error or Since many IoT devices will either have limited ways to log error or
no ability at all, any error will lead to implementations attempting no ability at all, any error will lead to implementations attempting
to re-try the exchange. to re-try the exchange.
QUESTION: [I-D.sheffer-tls-bcp] recommends a different ciphersuite, 7. Certificate Use with DTLS
namely TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [RFC5289] or
alternatively TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (with a 2048-bit or
1024 DH parameters as second and third priority, respectively). Is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 a good choice?
6. Certificate Use with DTLS
The use of mutual certificate-based authentication is shown in The use of mutual certificate-based authentication is shown in
Figure 4. Note that the figure also makes use of the cached info Figure 4, which makes use of the cached info extension
extension, which is indicated by the TLS extension [I-D.ietf-tls-cached-info]. Support of the cached info extension is
(cached_information) and the changed content in the exchanged required. Caching certificate chains allows the client to reduce the
certificates. Caching certificate chains allows the client to reduce communication overhead significantly since otherwise the server would
the communication overhead significantly since otherwise the server provide the end entity certificate, and the certificate chain.
would provide the end entity certificate, and the certificate chain.
Because certificate validation requires that root keys be distributed Because certificate validation requires that root keys be distributed
independently, the self-signed certificate that specifies the root independently, the self-signed certificate that specifies the root
certificate authority is omitted from the chain. Client certificate authority is omitted from the chain. Client
implementations MUST be provisioned with a trust anchor store that implementations MUST be provisioned with a trust anchor store that
contains the root certificates. The use of the Trust Anchor contains the root certificates. The use of the Trust Anchor
Management Protocol (TAMP) [RFC5934] is, however, not envisioned. Management Protocol (TAMP) [RFC5934] is, however, not envisioned.
Instead IoT devices using this profile MUST rely a software update Instead IoT devices using this profile MUST rely a software update
mechanism to provision these trust anchors. mechanism to provision these trust anchors.
When DTLS is used to secure CoAP messages then the server provided When DTLS is used to secure CoAP messages then the server provided
skipping to change at page 11, line 35 skipping to change at page 12, line 42
ClientKeyExchange ClientKeyExchange
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Figure 4: DTLS Mutual Certificate-based Authentication. Figure 4: DTLS Mutual Certificate-based Authentication.
Regarding the ciphersuite choice the discussion in Section 5 applies. Regarding the ciphersuite choice the discussion in Section 6 applies.
Further details about X.509 certificates can be found in Further details about X.509 certificates can be found in
Section 9.1.3.3 of [I-D.ietf-core-coap]. Section 9.1.3.3 of [I-D.ietf-core-coap].
QUESTION: What restrictions regarding the depth of the certificate QUESTION: What restrictions regarding the depth of the certificate
chain should be made? Is one level enough? chain should be made? Is one level enough?
7. Error Handling 8. Error Handling
DTLS uses the Alert protocol to convey error messages and specifies a DTLS uses the Alert protocol to convey error messages and specifies a
longer list of errors. However, not all error messages defined in longer list of errors. However, not all error messages defined in
the TLS specification are applicable to this profile. All error the TLS specification are applicable to this profile. All error
messages marked as RESERVED are only supported for backwards messages marked as RESERVED are only supported for backwards
compatibility with SSL and are therefore not applicable to this compatibility with SSL and are therefore not applicable to this
profile. Those include decryption_failed_RESERVED, profile. Those include decryption_failed_RESERVED,
no_certificate_RESERVE, and export_restriction_RESERVED. A number of no_certificate_RESERVE, and export_restriction_RESERVED. A number of
the error messages are applicable only for certificate-based the error messages are applicable only for certificate-based
authentication ciphersuites. Hence, for PSK and raw public key use authentication ciphersuites. Hence, for PSK and raw public key use
skipping to change at page 12, line 34 skipping to change at page 13, line 43
DTLS protocol. DTLS protocol.
insufficient_security: This error message indicates that the server insufficient_security: This error message indicates that the server
requires ciphers to be more secure. This document does, however, requires ciphers to be more secure. This document does, however,
specify the only acceptable ciphersuites and client specify the only acceptable ciphersuites and client
implementations must support them. implementations must support them.
user_canceled: The IoT devices in focus of this specification are user_canceled: The IoT devices in focus of this specification are
assumed to be unattended. assumed to be unattended.
8. Session Resumption 9. Session Resumption
Session resumption is a feature of DTLS that allows a client to Session resumption is a feature of DTLS that allows a client to
continue with an earlier established session state. The resulting continue with an earlier established session state. The resulting
exchange is shown in Figure 5. In addition, the server may choose exchange is shown in Figure 5. In addition, the server may choose
not to do a cookie exchange when a session is resumed. Still, not to do a cookie exchange when a session is resumed. Still,
clients have to be prepared to do a cookie exchange with every clients have to be prepared to do a cookie exchange with every
handshake. handshake.
Client Server Client Server
------ ------ ------ ------
skipping to change at page 13, line 22 skipping to change at page 14, line 22
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
Application Data <-------> Application Data Application Data <-------> Application Data
Figure 5: DTLS Session Resumption. Figure 5: DTLS Session Resumption.
Clients MUST implement session resumption to improve the performance Clients MUST implement session resumption to improve the performance
of the handshake (in terms of reduced number of message exchanges, of the handshake (in terms of reduced number of message exchanges,
lower computational overhead, and less bandwidth conserved). lower computational overhead, and less bandwidth conserved).
Since the communication model described in Section 2 does not assume Since the communication model described in Section 3 does not assume
that the server is constrained. RFC 5077 [RFC5077] describing TLS that the server is constrained. RFC 5077 [RFC5077] describing TLS
session resumption without server-side state is not utilized by this session resumption without server-side state is not utilized by this
profile. profile.
9. TLS Compression 10. TLS Compression
[I-D.sheffer-tls-bcp] recommends to always disable DTLS-level [I-D.sheffer-tls-bcp] recommends to always disable DTLS-level
compression due to attacks. For IoT applications compression at the compression due to attacks. For IoT applications compression at the
DTLS is not needed since application layer protocols are highly DTLS is not needed since application layer protocols are highly
optimized and the compression algorithms at the DTLS layer increase optimized and the compression algorithms at the DTLS layer increase
code size and complexity. Hence, for use with this profile code size and complexity. Hence, for use with this profile
compression at the DTLS layer MUST NOT be implemented by the DTLS compression at the DTLS layer SHOULD NOT be implemented by the DTLS
client. client.
10. Perfect Forward Secrecy 11. Perfect Forward Secrecy
Perfect forward secrecy is designed to prevent the compromise of a Perfect forward secrecy is designed to prevent the compromise of a
long-term secret key from affecting the confidentiality of past long-term secret key from affecting the confidentiality of past
conversations. The PSK ciphersuite recommended in the CoAP conversations. The PSK ciphersuite recommended in the CoAP
specification [I-D.ietf-core-coap] does not offer this property. specification [I-D.ietf-core-coap] does not offer this property.
[I-D.sheffer-tls-bcp] on the other hand recommends using ciphersuites [I-D.sheffer-tls-bcp] on the other hand recommends using ciphersuites
offering this security property. offering this security property.
QUESTION: Should the PSK ciphersuite offer PFS? QUESTION: Should the PSK ciphersuite offer PFS?
11. Keep-Alive 12. Keep-Alive
RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the
other peer is still alive. The same mechanism can also be used to other peer is still alive. The same mechanism can also be used to
perform path MTU discovery. perform path MTU discovery.
QUESTION: Do IoT deployments make use of this extension? QUESTION: Do IoT deployments make use of this extension?
12. Negotiation and Downgrading Attacks 13. Negotiation and Downgrading Attacks
CoAP demands version 1.2 of DTLS to be used and the earlier version CoAP demands version 1.2 of DTLS to be used and the earlier version
of DTLS is not supported. As such, there is no risk of downgrading of DTLS is not supported. As such, there is no risk of downgrading
to an older version of DTLS. The work described in to an older version of DTLS. The work described in
[I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to
this environment since there is no legacy server infrastructure to this environment since there is no legacy server infrastructure to
worry about. worry about.
QUESTION: Should we say something for non-CoAP use of DTLS? QUESTION: Should we say something for non-CoAP use of DTLS?
To prevent the TLS renegotiation attack [RFC5746] clients MUST To prevent the TLS renegotiation attack [RFC5746] clients MUST
respond to server-initiated renegotiation attempts with an Alert respond to server-initiated renegotiation attempts with an Alert
message (no_renegotiation) and clients MUST NOT initiate them. TLS message (no_renegotiation) and clients MUST NOT initiate them. TLS
and DTLS allows a client and a server who already have a TLS and DTLS allows a client and a server who already have a TLS
connection to negotiate new parameters, generate new keys, etc by connection to negotiate new parameters, generate new keys, etc by
initiating a TLS handshake using a ClientHello message. initiating a TLS handshake using a ClientHello message.
Renegotiation happens in the existing TLS connection, with the new Renegotiation happens in the existing TLS connection, with the new
handshake packets being encrypted along with application data. handshake packets being encrypted along with application data.
13. Privacy Considerations 14. Privacy Considerations
The DTLS handshake exchange conveys various identifiers, which can be The DTLS handshake exchange conveys various identifiers, which can be
observed by an on-path eavesdropper. For example, the DTLS PSK observed by an on-path eavesdropper. For example, the DTLS PSK
exchange reveals the PSK identity, the supported extensions, the exchange reveals the PSK identity, the supported extensions, the
session id, algorithm parameters, etc. When session resumption is session id, algorithm parameters, etc. When session resumption is
used then individual TLS sessions can be correlated by an on-path used then individual TLS sessions can be correlated by an on-path
adversary. With many IoT deployments it is likely that keying adversary. With many IoT deployments it is likely that keying
material and their identifiers are persistent over a longer period of material and their identifiers are persistent over a longer period of
time due to the cost of updating software on these devices. time due to the cost of updating software on these devices.
skipping to change at page 15, line 16 skipping to change at page 16, line 16
with other data to be truly useful and this extra data might include with other data to be truly useful and this extra data might include
personal data about the owner of the device or data about the personal data about the owner of the device or data about the
environment it senses. Consequently, the data stored on the server- environment it senses. Consequently, the data stored on the server-
side will be vulnerable to stored data compromise. For the side will be vulnerable to stored data compromise. For the
communication between the client and the server this specification communication between the client and the server this specification
prevents eavesdroppers to gain access to the communication content. prevents eavesdroppers to gain access to the communication content.
While the PSK-based ciphersuite does not provide PFS the asymmetric While the PSK-based ciphersuite does not provide PFS the asymmetric
version does. No explicit techniques, such as extra padding, have version does. No explicit techniques, such as extra padding, have
been provided to make traffic analysis more difficult. been provided to make traffic analysis more difficult.
14. Security Considerations 15. Security Considerations
This entire document is about security. This entire document is about security.
The TLS protocol requires random numbers to be available during the The TLS protocol requires random numbers to be available during the
protocol run. For example, during the ClientHello and the protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie Hellman exchange requires numbers. Also, the use of the Diffie Hellman exchange requires
random numbers during the key pair generation. Special care has to random numbers during the key pair generation. Special care has to
be paid when generating random numbers in embedded systems as many be paid when generating random numbers in embedded systems as many
entropy sources available on desktop operating systems or mobile entropy sources available on desktop operating systems or mobile
skipping to change at page 15, line 41 skipping to change at page 16, line 41
Guidelines and requirements for random number generation can be found Guidelines and requirements for random number generation can be found
in RFC 4086 [RFC4086]. in RFC 4086 [RFC4086].
We would also like to point out that designing a software update We would also like to point out that designing a software update
mechanism into an IoT system is crucial to ensure that both mechanism into an IoT system is crucial to ensure that both
functionality can be enhanced and that potential vulnerabilities can functionality can be enhanced and that potential vulnerabilities can
be fixed. This software update mechanism is also useful for changing be fixed. This software update mechanism is also useful for changing
configuration information, for example, trust anchors and other configuration information, for example, trust anchors and other
keying related information. keying related information.
15. IANA Considerations 16. IANA Considerations
This document includes no request to IANA. This document includes no request to IANA.
16. Acknowledgements 17. Acknowledgements
Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla,
Zach Shelby, and Sean Turner for helpful comments and discussions Zach Shelby, and Sean Turner for helpful comments and discussions
that have shaped the document. that have shaped the document.
17. References 18. References
17.1. Normative References 18.1. Normative References
[EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64)
REGISTRATION AUTHORITY", April 2010, REGISTRATION AUTHORITY", April 2010,
<http://standards.ieee.org/regauth/oui/tutorials/ <http://standards.ieee.org/regauth/oui/tutorials/
EUI64.html>. EUI64.html>.
[I-D.ietf-core-coap]
Shelby, Z., Hartke, K., and C. Bormann, "Constrained
Application Protocol (CoAP)", draft-ietf-core-coap-18
(work in progress), June 2013.
[I-D.ietf-tls-cached-info] [I-D.ietf-tls-cached-info]
Santesson, S. and H. Tschofenig, "Transport Layer Security Santesson, S. and H. Tschofenig, "Transport Layer Security
(TLS) Cached Information Extension", draft-ietf-tls- (TLS) Cached Information Extension", draft-ietf-tls-
cached-info-16 (work in progress), February 2014. cached-info-16 (work in progress), February 2014.
[I-D.ietf-tls-oob-pubkey] [I-D.ietf-tls-oob-pubkey]
Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and
T. Kivinen, "Using Raw Public Keys in Transport Layer T. Kivinen, "Using Raw Public Keys in Transport Layer
Security (TLS) and Datagram Transport Layer Security Security (TLS) and Datagram Transport Layer Security
(DTLS)", draft-ietf-tls-oob-pubkey-11 (work in progress), (DTLS)", draft-ietf-tls-oob-pubkey-11 (work in progress),
January 2014. January 2014.
[I-D.mcgrew-tls-aes-ccm-ecc] [I-D.mcgrew-tls-aes-ccm-ecc]
McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES-
CCM ECC Cipher Suites for TLS", draft-mcgrew-tls-aes-ccm- CCM ECC Cipher Suites for TLS", draft-mcgrew-tls-aes-ccm-
ecc-08 (work in progress), February 2014. ecc-08 (work in progress), February 2014.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites
for Transport Layer Security (TLS)", RFC 4279, December for Transport Layer Security (TLS)", RFC 4279, December
2005. 2005.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008. (TLS) Protocol Version 1.2", RFC 5246, August 2008.
[RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov,
"Transport Layer Security (TLS) Renegotiation Indication "Transport Layer Security (TLS) Renegotiation Indication
Extension", RFC 5746, February 2010. Extension", RFC 5746, February 2010.
skipping to change at page 17, line 18 skipping to change at page 18, line 12
(PKIX) Certificates in the Context of Transport Layer (PKIX) Certificates in the Context of Transport Layer
Security (TLS)", RFC 6125, March 2011. Security (TLS)", RFC 6125, March 2011.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security Version 1.2", RFC 6347, January 2012. Security Version 1.2", RFC 6347, January 2012.
[RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport
Layer Security (TLS) and Datagram Transport Layer Security Layer Security (TLS) and Datagram Transport Layer Security
(DTLS) Heartbeat Extension", RFC 6520, February 2012. (DTLS) Heartbeat Extension", RFC 6520, February 2012.
17.2. Informative References 18.2. Informative References
[Heninger] [Heninger]
Heninger, N., Durumeric, Z., Wustrow, E., and A. Heninger, N., Durumeric, Z., Wustrow, E., and A.
Halderman, "Mining Your Ps and Qs: Detection of Widespread Halderman, "Mining Your Ps and Qs: Detection of Widespread
Weak Keys in Network Devices", 21st USENIX Security Weak Keys in Network Devices", 21st USENIX Security
Symposium, https://www.usenix.org/conference/ Symposium, https://www.usenix.org/conference/
usenixsecurity12/technical-sessions/presentation/heninger, usenixsecurity12/technical-sessions/presentation/heninger,
2012. 2012.
[I-D.bmoeller-tls-downgrade-scsv] [I-D.bmoeller-tls-downgrade-scsv]
skipping to change at page 18, line 11 skipping to change at page 19, line 5
Gutmann, P., "Encrypt-then-MAC for TLS and DTLS", draft- Gutmann, P., "Encrypt-then-MAC for TLS and DTLS", draft-
gutmann-tls-encrypt-then-mac-05 (work in progress), gutmann-tls-encrypt-then-mac-05 (work in progress),
December 2013. December 2013.
[I-D.hummen-dtls-extended-session-resumption] [I-D.hummen-dtls-extended-session-resumption]
Hummen, R., Gilger, J., and H. Shafagh, "Extended DTLS Hummen, R., Gilger, J., and H. Shafagh, "Extended DTLS
Session Resumption for Constrained Network Environments", Session Resumption for Constrained Network Environments",
draft-hummen-dtls-extended-session-resumption-01 (work in draft-hummen-dtls-extended-session-resumption-01 (work in
progress), October 2013. progress), October 2013.
[I-D.ietf-core-coap]
Shelby, Z., Hartke, K., and C. Bormann, "Constrained
Application Protocol (CoAP)", draft-ietf-core-coap-18
(work in progress), June 2013.
[I-D.ietf-lwig-guidance] [I-D.ietf-lwig-guidance]
Bormann, C., "Guidance for Light-Weight Implementations of Bormann, C., "Guidance for Light-Weight Implementations of
the Internet Protocol Suite", draft-ietf-lwig-guidance-03 the Internet Protocol Suite", draft-ietf-lwig-guidance-03
(work in progress), February 2013. (work in progress), February 2013.
[I-D.ietf-lwig-terminology] [I-D.ietf-lwig-terminology]
Bormann, C., Ersue, M., and A. Keranen, "Terminology for Bormann, C., Ersue, M., and A. Keranen, "Terminology for
Constrained Node Networks", draft-ietf-lwig-terminology-07 Constrained Node Networks", draft-ietf-lwig-terminology-07
(work in progress), February 2014. (work in progress), February 2014.
skipping to change at page 19, line 16 skipping to change at page 20, line 13
Requirements for Security", BCP 106, RFC 4086, June 2005. Requirements for Security", BCP 106, RFC 4086, June 2005.
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites
for Transport Layer Security (TLS)", RFC 4492, May 2006. for Transport Layer Security (TLS)", RFC 4492, May 2006.
[RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,
"Transport Layer Security (TLS) Session Resumption without "Transport Layer Security (TLS) Session Resumption without
Server-Side State", RFC 5077, January 2008. Server-Side State", RFC 5077, January 2008.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, January 2008.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, May 2008. (CRL) Profile", RFC 5280, May 2008.
[RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with
SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289,
August 2008. August 2008.
[RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor
Management Protocol (TAMP)", RFC 5934, August 2010. Management Protocol (TAMP)", RFC 5934, August 2010.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic
Curve Cryptography Algorithms", RFC 6090, February 2011. Curve Cryptography Algorithms", RFC 6090, February 2011.
[RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for
Transport Layer Security (TLS)", RFC 6655, July 2012.
[RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS)
Multiple Certificate Status Request Extension", RFC 6961, Multiple Certificate Status Request Extension", RFC 6961,
June 2013. June 2013.
[RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
Morris, J., Hansen, M., and R. Smith, "Privacy Morris, J., Hansen, M., and R. Smith, "Privacy
Considerations for Internet Protocols", RFC 6973, July Considerations for Internet Protocols", RFC 6973, July
2013. 2013.
Authors' Addresses Authors' Addresses
 End of changes. 58 change blocks. 
142 lines changed or deleted 183 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/