| < draft-ietf-dice-profile-00.txt | draft-ietf-dice-profile-01.txt > | |||
|---|---|---|---|---|
| dice K. Hartke | dice K. Hartke | |||
| Internet-Draft Universitaet Bremen TZI | Internet-Draft Universitaet Bremen TZI | |||
| Intended status: Informational H. Tschofenig | Intended status: Informational H. Tschofenig | |||
| Expires: October 2, 2014 ARM Ltd. | Expires: November 7, 2014 ARM Ltd. | |||
| March 31, 2014 | May 6, 2014 | |||
| A DTLS 1.2 Profile for the Internet of Things | A DTLS 1.2 Profile for the Internet of Things | |||
| draft-ietf-dice-profile-00 | draft-ietf-dice-profile-01.txt | |||
| Abstract | Abstract | |||
| This document defines a DTLS profile that is suitable for Internet of | This document defines a DTLS profile that is suitable for Internet of | |||
| Things applications and is reasonably implementable on many | Things applications and is reasonably implementable on many | |||
| constrained devices. | constrained devices. | |||
| Status of This Memo | Status of This Memo | |||
| This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
| skipping to change at page 1, line 33 ¶ | skipping to change at page 1, line 33 ¶ | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
| working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
| Drafts is at http://datatracker.ietf.org/drafts/current/. | Drafts is at http://datatracker.ietf.org/drafts/current/. | |||
| Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| This Internet-Draft will expire on October 2, 2014. | This Internet-Draft will expire on November 7, 2014. | |||
| Copyright Notice | Copyright Notice | |||
| Copyright (c) 2014 IETF Trust and the persons identified as the | Copyright (c) 2014 IETF Trust and the persons identified as the | |||
| document authors. All rights reserved. | document authors. All rights reserved. | |||
| This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
| Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
| (http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
| publication of this document. Please review these documents | publication of this document. Please review these documents | |||
| carefully, as they describe your rights and restrictions with respect | carefully, as they describe your rights and restrictions with respect | |||
| to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
| include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
| the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
| described in the Simplified BSD License. | described in the Simplified BSD License. | |||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
| 2. The Communication Model . . . . . . . . . . . . . . . . . . . 4 | 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 3. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 5 | 3. The Communication Model . . . . . . . . . . . . . . . . . . . 4 | |||
| 4. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 6 | 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6 | |||
| 5. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 8 | 5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8 | |||
| 6. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 10 | 6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9 | |||
| 7. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 11 | 7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11 | |||
| 8. Session Resumption . . . . . . . . . . . . . . . . . . . . . 12 | 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 13 | |||
| 9. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 13 | 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 13 | |||
| 10. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 13 | 10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14 | |||
| 11. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 14 | 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14 | |||
| 12. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 14 | 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15 | |||
| 13. Privacy Considerations . . . . . . . . . . . . . . . . . . . 14 | 13. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 15 | |||
| 14. Security Considerations . . . . . . . . . . . . . . . . . . . 15 | 14. Privacy Considerations . . . . . . . . . . . . . . . . . . . 15 | |||
| 15. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 | 15. Security Considerations . . . . . . . . . . . . . . . . . . . 16 | |||
| 16. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 15 | 16. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 | |||
| 17. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 | 17. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 16 | |||
| 17.1. Normative References . . . . . . . . . . . . . . . . . . 16 | 18. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 | |||
| 17.2. Informative References . . . . . . . . . . . . . . . . . 17 | 18.1. Normative References . . . . . . . . . . . . . . . . . . 17 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 19 | 18.2. Informative References . . . . . . . . . . . . . . . . . 18 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 | ||||
| 1. Introduction | 1. Introduction | |||
| This document defines a DTLS 1.2 [RFC6347] profile that offers | This document defines a DTLS 1.2 [RFC6347] profile that offers | |||
| communication security for Internet of Things (IoT) applications and | communication security for Internet of Things (IoT) applications and | |||
| is reasonably implementable on many constrained devices. It aims to | is reasonably implementable on many constrained devices. It aims to | |||
| meet the following goals: | meet the following goals: | |||
| o One-stop shop for implementers through the specification jungle. | o Serve as a one-stop shop for implementers to know which pieces of | |||
| the specification jungle contain relevant details. | ||||
| o This document does not alter the DTLS 1.2 specification. | o Not alter the DTLS specification. | |||
| o This document does not introduce new extensions. | o Not introduce any new extensions. | |||
| o This profile aligns with the DTLS security modes of the | o Align with the DTLS security modes of the Constrained Application | |||
| Constrained Application Protocol (CoAP) [I-D.ietf-core-coap]. | Protocol (CoAP) [I-D.ietf-core-coap]. | |||
| DTLS is used to secure a number of applications run over an | DTLS is used to secure a number of applications run over an | |||
| unreliable datagram transport. CoAP [I-D.ietf-core-coap] is one such | unreliable datagram transport. CoAP [I-D.ietf-core-coap] is one such | |||
| protocol and has been designed specifically for use in IoT | protocol and has been designed specifically for use in IoT | |||
| environments. CoAP can be secured using a number of different ways, | environments. CoAP can be secured a number of different ways, also | |||
| also called security modes. These security modes are: | called security modes. These security modes are as follows, see | |||
| Section 5, Section 6, Section 7 for additional details: | ||||
| No Security Protection at the Transport Layer: No DTLS is used but | No Security Protection at the Transport Layer: No DTLS is used but | |||
| instead application layer security functionality is assumed. | instead application layer security functionality is assumed. | |||
| Shared Secret-based DTLS Authentication: DTLS supports the use of | Shared Secret-based DTLS Authentication: DTLS supports the use of | |||
| shared secrets [RFC4279]. This credential is useful if the number | shared secrets [RFC4279]. This mode is useful if the number of | |||
| of communication relationships between the IoT device and servers | communication relationships between the IoT device and servers is | |||
| is small and for very constrained devices. Shared secret-based | small and for very constrained devices. Shared secret-based | |||
| authentication mechanisms offer good performance and require a | authentication mechanisms offer good performance and require a | |||
| minimum of data to be exchanged. | minimum of data to be exchanged. | |||
| DTLS Authentication using Asymmetric Credentials: TLS supports | DTLS Authentication using Asymmetric Cryptography: TLS supports | |||
| client and server authentication using asymmetric credentials. | client and server authentication using asymmetric cryptography. | |||
| Two approaches for validating these public key are available. | Two approaches for validating these public keys are available. | |||
| First, [I-D.ietf-tls-oob-pubkey] allows raw public keys to be used | First, [I-D.ietf-tls-oob-pubkey] allows raw public keys to be used | |||
| in TLS without the overhead of certificates. This approach | in TLS without the overhead of certificates. This approach | |||
| requires out-of-band validation of the public key. Second, the | requires out-of-band validation of the public key. Second, the | |||
| use of X.509 certificates [RFC5280] with TLS is common on the Web | use of X.509 certificates [RFC5280] with TLS is common on the Web | |||
| today (at least for server-side authentication) and certain IoT | today (at least for server-side authentication) and certain IoT | |||
| environments may also re-use those capabilities. Certificates | environments may also re-use those capabilities. Certificates | |||
| bind an identifier to the public key signed by a certification | bind an identifier to the public key signed by a certification | |||
| authority (CA). A trust anchor store has to be provisioned on the | authority (CA). A trust anchor store has to be provisioned on the | |||
| device to indicate what CAs are trusted. Furthermore, the | device to indicate what CAs are trusted. Furthermore, the | |||
| certificate may contain a wealth of other information used to make | certificate may contain a wealth of other information used to make | |||
| authorization decisions. | authorization decisions. | |||
| As described in [I-D.ietf-lwig-tls-minimal] an application designer | As described in [I-D.ietf-lwig-tls-minimal], an application designer | |||
| developing an IoT device needs to think about the security threats | developing an IoT device needs to consider the security threats and | |||
| that need to be mitigated. For many Internet connected devices it | the security services that can be used to mitigate the threats. | |||
| is, however, likely that authentication of the device and the server | Enabling devices to upload data and retrieve configuration | |||
| infrastructure will be required. Along with the ability to upload | information, inevitably requires that Internet-connected devices be | |||
| sensor data and to retrieve configuration information the need for | able to authenticate themselves to servers and vice versa as well as | |||
| integrity and confidentiality protection will arise. While these | to ensure that the data and information exchanged is integrity and | |||
| security services can be provided at different layers in the protocol | confidentiality protected. While these security services can be | |||
| stack the use of channel security, as offered by DTLS, has been very | provided at different layers in the protocol stack the use of | |||
| popular on the Internet and it is likely to be useful for IoT | communication security, as offered by DTLS, has been very popular on | |||
| scenarios as well. In case the channel security features offered by | the Internet and it is likely to be useful for IoT scenarios as well. | |||
| DTLS meet the security requirements of your application the remainder | In case the communication security features offered by DTLS meet the | |||
| of the document might offer useful guidance. | security requirements of your application the remainder of the | |||
| document might offer useful guidance. | ||||
| Not every IoT deployment will use CoAP but the discussion regarding | Not every IoT deployment will use CoAP but the discussion regarding | |||
| choice of credentials and cryptographic algorithms will be very | choice of credentials and cryptographic algorithms will be very | |||
| similar. As such, the discussions in this document are applicable | similar. As such, the discussions in this document are applicable | |||
| beyond the use of the CoAP protocol. | beyond the use of the CoAP protocol. | |||
| The design of DTLS is intentionally very similar to TLS. Since DTLS | The design of DTLS is intentionally very similar to TLS. Since DTLS | |||
| operates on top of an unreliable datagram transport a few | operates on top of an unreliable datagram transport a few | |||
| enhancements to the TLS structure are, however necessary. RFC 6347 | enhancements to the TLS structure are, however necessary. RFC 6347 | |||
| explains these differences in great detail. As a short summary, for | explains these differences in great detail. As a short summary, for | |||
| those familiar with TLS the differences are: | those not familiar with DTLS the differences are: | |||
| o An explicit sequence number and an epoch field is included in the | o An explicit sequence number and an epoch field is included in the | |||
| TLS Record Layer. Section 4.1 of RFC 6347 explains the processing | TLS Record Layer. Section 4.1 of RFC 6347 explains the processing | |||
| rules for these two new fields. The value used to compute the MAC | rules for these two new fields. The value used to compute the MAC | |||
| is the 64-bit value formed by concatenating the epoch and the | is the 64-bit value formed by concatenating the epoch and the | |||
| sequence number. | sequence number. | |||
| o Stream ciphers must not be used with DTLS. The only stream cipher | o Stream ciphers must not be used with DTLS. The only stream cipher | |||
| defined for TLS 1.2 is RC4. | defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it | |||
| is not recommended anymore even for use with TLS. | ||||
| o The TLS Handshake Protocol has been enhanced to include a | o The TLS Handshake Protocol has been enhanced to include a | |||
| stateless cookie exchange for Denial of Service (DoS) resistance. | stateless cookie exchange for Denial of Service (DoS) resistance. | |||
| Furthermore, the header has been extended to deal with message | Furthermore, the header has been extended to deal with message | |||
| loss, reordering, and fragmentation. Retransmission timers have | loss, reordering, and fragmentation. Retransmission timers have | |||
| been included to deal with message loss. For DoS protection a new | been included to deal with message loss. For DoS protection a new | |||
| handshake message, the HelloVerifyRequest, was added to DTLS. | handshake message, the HelloVerifyRequest, was added to DTLS. | |||
| This handshake message is sent by the server and includes a | This handshake message is sent by the server and includes a | |||
| stateless cookie, which is returned in a ClientHello message back | stateless cookie, which is returned in a ClientHello message back | |||
| to the server. This type of DoS protection mechanism has also | to the server. This type of DoS protection mechanism has also | |||
| been incorporated into the design of IKEv2. Although the exchange | been incorporated into the design of IKEv2. Although the exchange | |||
| is optional for the server to execute, a client implementation has | is optional for the server to execute, a client implementation has | |||
| to be prepared to respond to it. | to be prepared to respond to it. | |||
| 2. The Communication Model | 2. Terminology | |||
| This document describes a profile of DTLS 1.2 and to be useful it has | The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", | |||
| to make assumptions about the envisioned communication architecture. | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | |||
| The architecture shown in Figure 1 assumes a uni-cast communication | document are to be interpreted as described in [RFC2119]. | |||
| interaction with an IoT device acting as a client and the client | ||||
| interacts with one or multiple servers. Which server to contact is | Note that "Client" and "Server" in this document refer to TLS roles, | |||
| based on pre-configuration onto the client (e.g., as part of the | where the Client initiates the TLS handshake. This does not restrict | |||
| firmware). This configuration information also includes information | the interaction pattern of the protocols carried inside TLS as the | |||
| about the PSK identity and the corresponding secret to be used with | record layer allows bi-directional communication. In the case of | |||
| that specific server (in case of symmetric credentials). For | CoAP the "Client" can act as a CoAP Server or Client. | |||
| asymmetric cryptography mutual authentication is assumed in this | ||||
| profile. For raw public keys the public key or the hash of the | 3. The Communication Model | |||
| public key is assumed to be available to both parties. For | ||||
| certificate-based authentication the client may have a trust anchor | This document describes a profile of DTLS 1.2 and, to be useful, it | |||
| store pre-populated, which allows the client to perform path | has to make assumptions about the envisioned communication | |||
| validation for the certificate obtained during the handshake with the | architecture. | |||
| server. The client also needs to know which certificate or raw | ||||
| public key it has to use with a specific server. | The communication architecture shown in Figure 1 assumes a uni-cast | |||
| communication interaction with an IoT device utilizing a DTLS client | ||||
| and that client interacts with one or multiple DTLS servers. | ||||
| Clients are preconfigured with the address or addresses of servers | ||||
| (e.g., as part of the firmware) they will communicate with as well as | ||||
| authentication information: | ||||
| o For PSK-based authentication (see Section 5), this includes the | ||||
| paired "PSK identity" and shared secret to be used with each | ||||
| server. | ||||
| o For raw public key-based authentication (see Section 6), this | ||||
| includes either the server's public key or the hash of the | ||||
| server's public key. | ||||
| o For certificate-based authentication (see Section 7), this may | ||||
| include a pre-populated trust anchor store that allows the client | ||||
| to perform path validation for the certificate obtained during the | ||||
| handshake with the server. | ||||
| This document only focuses on the description of the DTLS client-side | This document only focuses on the description of the DTLS client-side | |||
| functionality. | functionality. | |||
| +////////////////////////////////////+ | +////////////////////////////////////+ | |||
| | Configuration | | | Configuration | | |||
| |////////////////////////////////////| | |////////////////////////////////////| | |||
| | Server A --> PSK Identity, PSK | | | Server A --> PSK Identity, PSK | | |||
| | Server B --> Public Key (Server B),| | | Server B --> Public Key (Server B),| | |||
| | Public Key (Client) | | | Public Key (Client) | | |||
| skipping to change at page 5, line 36 ¶ | skipping to change at page 6, line 36 ¶ | |||
| '---+---' +------+ | '---+---' +------+ | |||
| | |Server| | | |Server| | |||
| | | B | | | | B | | |||
| | +------+ | | +------+ | |||
| | | | | |||
| | +------+ | | +------+ | |||
| +----------------->|Server| | +----------------->|Server| | |||
| | C | | | C | | |||
| +------+ | +------+ | |||
| Figure 1: DTLS Profile: Assumed Communication Model. | Figure 1: Constrained DTLS Client Profile. | |||
| A future version of this document may provide profiles for other | ||||
| communication architectures. | ||||
| 3. The Ciphersuite Concept | 4. The Ciphersuite Concept | |||
| TLS (and consequently DTLS) introduced the concept of ciphersuites | TLS (and consequently DTLS) has the concept of ciphersuites and an | |||
| and an IANA registry [IANA-TLS] was created to keep track of the | IANA registry [IANA-TLS] was created to register the suites. A | |||
| specified suites. A ciphersuites (and the specification that defines | ciphersuite (and the specification that defines it) contains the | |||
| it) contains the following information: | following information: | |||
| o Authentication and Key Exchange Algorithm (e.g., PSK) | o Authentication and Key Exchange Algorithm (e.g., PSK) | |||
| o Cipher and Key Length(e.g., AES with 128 bit keys) | o Cipher and Key Length (e.g., AES with 128 bit keys) | |||
| o Mode of operation (e.g., CBC) | ||||
| o Mode of operation (e.g., CBC) | ||||
| o Hash Algorithm for Integrity Protection (e.g., SHA in combination | o Hash Algorithm for Integrity Protection (e.g., SHA in combination | |||
| with HMAC) | with HMAC) | |||
| o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC | o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC | |||
| with the SHA-256) | with the SHA-256) | |||
| o Misc information (e.g., length of authentication tags) | o Misc information (e.g., length of authentication tags) | |||
| The TLS ciphersuite TLS_PSK_WITH_AES_256_CBC_SHA, for example, uses a | o Information whether the ciphersuite is suitable for DTLS or only | |||
| pre-shared authentication and key exchange algorithm. RFC 4279, | for TLS | |||
| which defined this ciphersuite predates publication of TLS 1.2. It | ||||
| uses the Advanced Encryption Standard (AES) encryption algorithm, | The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a | |||
| which is a block cipher. Since the AES algorithm supports different | pre-shared authentication and key exchange algorithm. RFC 6655 | |||
| key lengths (such as 128, 192 and 256 bits) this information has to | [RFC6655] defines this ciphersuite. It uses the Advanced Encryption | |||
| be specified as well and the selected ciphersuite supports 256 bit | Standard (AES) encryption algorithm, which is a block cipher. Since | |||
| keys. A block cipher encrypts plaintext in fixed-size blocks and AES | the AES algorithm supports different key lengths (such as 128, 192 | |||
| operates on fixed block size of 128 bits. For messages exceeding 128 | and 256 bits) this information has to be specified as well and the | |||
| bits, the message is partitioned into 128-bit blocks and the AES | selected ciphersuite supports 128 bit keys. A block cipher encrypts | |||
| cipher is applied to these input blocks with appropriate chaining, | plaintext in fixed-size blocks and AES operates on fixed block size | |||
| which is called mode of operation. In our example, the mode of | of 128 bits. For messages exceeding 128 bits, the message is | |||
| operation is cipher block chaining (CBC). Since encryption itself | partitioned into 128-bit blocks and the AES cipher is applied to | |||
| does not provide integrity protection a hash function is specified as | these input blocks with appropriate chaining, which is called mode of | |||
| well, which will be used in concert with the HMAC function. In this | operation. | |||
| case, the Secure Hash Algorithm (SHA). | ||||
| TLS 1.2 introduced Authenticated Encryption with Associated Data | TLS 1.2 introduced Authenticated Encryption with Associated Data | |||
| (AEAD) ciphersuites. AEAD is a class of block cipher modes which | (AEAD) ciphersuites [RFC5116]. AEAD is a class of block cipher modes | |||
| encrypt (parts of) the message and authenticate the message | which encrypt (parts of) the message and authenticate the message | |||
| simultaneously. Examples of such modes include the Counter with CBC- | simultaneously. Examples of such modes include the Counter with CBC- | |||
| MAC (CCM) mode, and the Galois/Counter Mode (GCM). | MAC (CCM) mode, and the Galois/Counter Mode (GCM). | |||
| Some AEAD ciphersuites have shorter authentication tags and are | ||||
| therefore more suitable for networks with low bandwidth where small | ||||
| message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite | ||||
| that ends in "_8" has an 8-octet authentication tag, while the | ||||
| regular CCM ciphersuites have 16-octet authentication tags. | ||||
| TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in | TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in | |||
| the TLS pseudo random function (PRF) with cipher-suite-specified | the TLS pseudo random function (PRF) with cipher-suite-specified | |||
| PRFs. For this reason authors of more recent TLS 1.2 ciphersuite | PRFs. For this reason authors of more recent TLS 1.2 ciphersuite | |||
| specifications explicitly indicate the MAC algorithm and the hash | specifications explicitly indicate the MAC algorithm and the hash | |||
| functions used with the TLS PRF. | functions used with the TLS PRF. | |||
| 4. Pre-Shared Secret Authentication with DTLS | This document references the CoAP recommended ciphersuite choices, | |||
| which have been selected based on implementation and deployment | ||||
| experience from the IoT community. Over time the preference for | ||||
| certain algorithms will, however, change. Not all components of a | ||||
| ciphersuite change at the same speed. Changes are more likely to | ||||
| expect for ciphers, the mode of operation, and the hash algorithms. | ||||
| Some deployment environments will also be impacted by local | ||||
| regulation, which might dictate a certain and less likely for public | ||||
| key algorithms (such as RSA vs. ECC). | ||||
| 5. Pre-Shared Secret Authentication with DTLS | ||||
| The use of pre-shared secret credentials is one of the most basic | The use of pre-shared secret credentials is one of the most basic | |||
| techniques for DTLS since it is both computational efficient and | techniques for DTLS since it is both computational efficient and | |||
| bandwidth conserving. Pre-shared secret based authentication was | bandwidth conserving. Pre-shared secret based authentication was | |||
| introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in | introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in | |||
| Figure 2 illustrates the DTLS exchange including the cookie exchange. | Figure 2 illustrates the DTLS exchange including the cookie exchange. | |||
| While the server is not required to initiate a cookie exchange with | While the server is not required to initiate a cookie exchange with | |||
| every handshake, the client is required to implement and to react on | every handshake, the client is required to implement and to react on | |||
| it when challenged. | it when challenged. | |||
| skipping to change at page 7, line 44 ¶ | skipping to change at page 9, line 10 ¶ | |||
| identity. Hence, the TLS client and server clearly have to agree on | identity. Hence, the TLS client and server clearly have to agree on | |||
| the identities and keys to be used. The mandated encoding of | the identities and keys to be used. The mandated encoding of | |||
| identities in Section 5.1 of RFC 4279 aims to improve | identities in Section 5.1 of RFC 4279 aims to improve | |||
| interoperability for those cases where the identity is configured by | interoperability for those cases where the identity is configured by | |||
| a person using some management interface. Many IoT devices do, | a person using some management interface. Many IoT devices do, | |||
| however, not have a user interface and most of their credentials are | however, not have a user interface and most of their credentials are | |||
| bound to the device rather than the user. Furthermore, credentials | bound to the device rather than the user. Furthermore, credentials | |||
| are provisioned into trusted hardware modules or in the firmware by | are provisioned into trusted hardware modules or in the firmware by | |||
| the developers. As such, the encoding considerations are not | the developers. As such, the encoding considerations are not | |||
| applicable to this usage environment. For use with this profile the | applicable to this usage environment. For use with this profile the | |||
| PSK identities MUST NOT assume a structured format (as domain names, | PSK identities SHOULD NOT assume a structured format (as domain | |||
| Distinguished Names, or IP addresses have) and a bit-by-bit | names, Distinguished Names, or IP addresses have) and a bit-by-bit | |||
| comparison operation can then be used by the server-side | comparison operation can then be used by the server-side | |||
| infrastructure. | infrastructure. | |||
| As described in Section 2 clients may have pre-shared keys with | As described in Section 3 clients may have pre-shared keys with | |||
| several different servers. The client indicates which key it uses by | several different servers. The client indicates which key it uses by | |||
| including a "PSK identity" in the ClientKeyExchange message. To help | including a "PSK identity" in the ClientKeyExchange message. To help | |||
| the client in selecting which PSK identity / PSK pair to use, the | the client in selecting which PSK identity / PSK pair to use, the | |||
| server can provide a "PSK identity hint" in the ServerKeyExchange | server can provide a "PSK identity hint" in the ServerKeyExchange | |||
| message. For Iot environments a simplifying assumption is made that | message. For IoT environments a simplifying assumption is made that | |||
| the hint for PSK key selection is based on the domain name of the | the hint for PSK key selection is based on the domain name of the | |||
| server. Hence, servers SHOULD NOT send the "PSK identity hint" in | server. Hence, servers SHOULD NOT send the "PSK identity hint" in | |||
| the ServerKeyExchange message and client MUST ignore the message. | the ServerKeyExchange message and client MUST ignore the message. | |||
| This approach is inline with RFC 4279 [RFC4279]. | ||||
| RFC 4279 requires TLS implementations supporting PSK ciphersuites to | RFC 4279 requires TLS implementations supporting PSK ciphersuites to | |||
| support arbitrary PSK identities up to 128 octets in length, and | support arbitrary PSK identities up to 128 octets in length, and | |||
| arbitrary PSKs up to 64 octets in length. This is a useful | arbitrary PSKs up to 64 octets in length. This is a useful | |||
| assumption for TLS stacks used in the desktop and mobile environment | assumption for TLS stacks used in the desktop and mobile environment | |||
| where management interfaces are used to provision identities and | where management interfaces are used to provision identities and | |||
| keys. For the IoT environment, however, many devices are not | keys. For the IoT environment, however, many devices are not | |||
| equipped with displays and input devices (e.g., keyboards). Hence, | equipped with displays and input devices (e.g., keyboards). Hence, | |||
| keys are distributed as part of hardware modules or are embedded into | keys are distributed as part of hardware modules or are embedded into | |||
| the firmware. As such, these restrictions are not applicable to this | the firmware. As such, these restrictions are not applicable to this | |||
| skipping to change at page 8, line 35 ¶ | skipping to change at page 9, line 46 ¶ | |||
| Constrained Application Protocol (CoAP) [I-D.ietf-core-coap] | Constrained Application Protocol (CoAP) [I-D.ietf-core-coap] | |||
| currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to | currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to | |||
| implement ciphersuite for use with shared secrets. This ciphersuite | implement ciphersuite for use with shared secrets. This ciphersuite | |||
| uses the AES algorithm with 128 bit keys and CCM as the mode of | uses the AES algorithm with 128 bit keys and CCM as the mode of | |||
| operation. The label "_8" indicates that an 8-octet authentication | operation. The label "_8" indicates that an 8-octet authentication | |||
| tag is used. This ciphersuite makes use of the default TLS 1.2 | tag is used. This ciphersuite makes use of the default TLS 1.2 | |||
| Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash | Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash | |||
| function. | function. | |||
| 5. Raw Public Key Use with DTLS | 6. Raw Public Key Use with DTLS | |||
| The use of raw public keys with DTLS, as defined in | The use of raw public keys with DTLS, as defined in | |||
| [I-D.ietf-tls-oob-pubkey], is the first entry point into public key | [I-D.ietf-tls-oob-pubkey], is the first entry point into public key | |||
| cryptography without having to pay the price of certificates and a | cryptography without having to pay the price of certificates and a | |||
| PKI. The specification re-uses the existing Certificate message to | PKI. The specification re-uses the existing Certificate message to | |||
| convey the raw public key encoded in the SubjectPublicKeyInfo | convey the raw public key encoded in the SubjectPublicKeyInfo | |||
| structure. To indicate support two new TLS extensions had been | structure. To indicate support two new TLS extensions had been | |||
| defined as shown in Figure 3, namely the server_certificate_type and | defined, as shown in Figure 3, namely the server_certificate_type and | |||
| the client_certificate_type. To operate this mechanism securely it | the client_certificate_type. To operate this mechanism securely it | |||
| is necessary to authenticate and authorize the public keys out-of- | is necessary to authenticate and authorize the public keys out-of- | |||
| band. This document therefore assumes that a client implementation | band. This document therefore assumes that a client implementation | |||
| comes with one or multiple raw public keys of servers, it has to | comes with one or multiple raw public keys of servers, it has to | |||
| communicate with, pre-provisioned. Additionally, a device will have | communicate with, pre-provisioned. Additionally, a device will have | |||
| its own raw public key. To replace, delete, or add raw public key to | its own raw public key. To replace, delete, or add raw public key to | |||
| this list requires a software update, for example using a firmware | this list requires a software update, for example using a firmware | |||
| update. | update mechanism. | |||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| ClientHello --------> | ClientHello --------> | |||
| client_certificate_type | client_certificate_type | |||
| server_certificate_type | server_certificate_type | |||
| <------- HelloVerifyRequest | <------- HelloVerifyRequest | |||
| skipping to change at page 9, line 37 ¶ | skipping to change at page 10, line 48 ¶ | |||
| ClientKeyExchange | ClientKeyExchange | |||
| CertificateVerify | CertificateVerify | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. | Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. | |||
| The ciphersuite for use with this credential type is | The CoAP recommended ciphersuite for use with this credential type is | |||
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [I-D.mcgrew-tls-aes-ccm-ecc]. | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [I-D.mcgrew-tls-aes-ccm-ecc]. | |||
| This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite | This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite | |||
| uses the Elliptic Curve Diffie Hellman (ECDHE) as the key | uses the Elliptic Curve Diffie Hellman (ECDHE) as the key | |||
| establishment mechanism and an Elliptic Curve Digital Signature | establishment mechanism and an Elliptic Curve Digital Signature | |||
| Algorithm (ECDSA) for authentication. This ciphersuite make use of | Algorithm (ECDSA) for authentication. This ciphersuite make use of | |||
| the AEAD capability in DTLS 1.2 and utilizes an eight-octet | the AEAD capability in DTLS 1.2 and utilizes an eight-octet | |||
| authentication tag. Based on the Diffie-Hellman it provides perfect | authentication tag. Based on the Diffie-Hellman it provides perfect | |||
| forward secrecy (PFS). More details about the PFS can be found in | forward secrecy (PFS). More details about the PFS can be found in | |||
| Section 10. | Section 11. | |||
| RFC 6090 [RFC6090] provides valuable information for implementing | RFC 6090 [RFC6090] provides valuable information for implementing | |||
| Elliptic Curve Cryptography algorithms. | Elliptic Curve Cryptography algorithms. | |||
| Since many IoT devices will either have limited ways to log error or | Since many IoT devices will either have limited ways to log error or | |||
| no ability at all, any error will lead to implementations attempting | no ability at all, any error will lead to implementations attempting | |||
| to re-try the exchange. | to re-try the exchange. | |||
| QUESTION: [I-D.sheffer-tls-bcp] recommends a different ciphersuite, | 7. Certificate Use with DTLS | |||
| namely TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 [RFC5289] or | ||||
| alternatively TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (with a 2048-bit or | ||||
| 1024 DH parameters as second and third priority, respectively). Is | ||||
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 a good choice? | ||||
| 6. Certificate Use with DTLS | ||||
| The use of mutual certificate-based authentication is shown in | The use of mutual certificate-based authentication is shown in | |||
| Figure 4. Note that the figure also makes use of the cached info | Figure 4, which makes use of the cached info extension | |||
| extension, which is indicated by the TLS extension | [I-D.ietf-tls-cached-info]. Support of the cached info extension is | |||
| (cached_information) and the changed content in the exchanged | required. Caching certificate chains allows the client to reduce the | |||
| certificates. Caching certificate chains allows the client to reduce | communication overhead significantly since otherwise the server would | |||
| the communication overhead significantly since otherwise the server | provide the end entity certificate, and the certificate chain. | |||
| would provide the end entity certificate, and the certificate chain. | ||||
| Because certificate validation requires that root keys be distributed | Because certificate validation requires that root keys be distributed | |||
| independently, the self-signed certificate that specifies the root | independently, the self-signed certificate that specifies the root | |||
| certificate authority is omitted from the chain. Client | certificate authority is omitted from the chain. Client | |||
| implementations MUST be provisioned with a trust anchor store that | implementations MUST be provisioned with a trust anchor store that | |||
| contains the root certificates. The use of the Trust Anchor | contains the root certificates. The use of the Trust Anchor | |||
| Management Protocol (TAMP) [RFC5934] is, however, not envisioned. | Management Protocol (TAMP) [RFC5934] is, however, not envisioned. | |||
| Instead IoT devices using this profile MUST rely a software update | Instead IoT devices using this profile MUST rely a software update | |||
| mechanism to provision these trust anchors. | mechanism to provision these trust anchors. | |||
| When DTLS is used to secure CoAP messages then the server provided | When DTLS is used to secure CoAP messages then the server provided | |||
| skipping to change at page 11, line 35 ¶ | skipping to change at page 12, line 42 ¶ | |||
| ClientKeyExchange | ClientKeyExchange | |||
| CertificateVerify | CertificateVerify | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| Figure 4: DTLS Mutual Certificate-based Authentication. | Figure 4: DTLS Mutual Certificate-based Authentication. | |||
| Regarding the ciphersuite choice the discussion in Section 5 applies. | Regarding the ciphersuite choice the discussion in Section 6 applies. | |||
| Further details about X.509 certificates can be found in | Further details about X.509 certificates can be found in | |||
| Section 9.1.3.3 of [I-D.ietf-core-coap]. | Section 9.1.3.3 of [I-D.ietf-core-coap]. | |||
| QUESTION: What restrictions regarding the depth of the certificate | QUESTION: What restrictions regarding the depth of the certificate | |||
| chain should be made? Is one level enough? | chain should be made? Is one level enough? | |||
| 7. Error Handling | 8. Error Handling | |||
| DTLS uses the Alert protocol to convey error messages and specifies a | DTLS uses the Alert protocol to convey error messages and specifies a | |||
| longer list of errors. However, not all error messages defined in | longer list of errors. However, not all error messages defined in | |||
| the TLS specification are applicable to this profile. All error | the TLS specification are applicable to this profile. All error | |||
| messages marked as RESERVED are only supported for backwards | messages marked as RESERVED are only supported for backwards | |||
| compatibility with SSL and are therefore not applicable to this | compatibility with SSL and are therefore not applicable to this | |||
| profile. Those include decryption_failed_RESERVED, | profile. Those include decryption_failed_RESERVED, | |||
| no_certificate_RESERVE, and export_restriction_RESERVED. A number of | no_certificate_RESERVE, and export_restriction_RESERVED. A number of | |||
| the error messages are applicable only for certificate-based | the error messages are applicable only for certificate-based | |||
| authentication ciphersuites. Hence, for PSK and raw public key use | authentication ciphersuites. Hence, for PSK and raw public key use | |||
| skipping to change at page 12, line 34 ¶ | skipping to change at page 13, line 43 ¶ | |||
| DTLS protocol. | DTLS protocol. | |||
| insufficient_security: This error message indicates that the server | insufficient_security: This error message indicates that the server | |||
| requires ciphers to be more secure. This document does, however, | requires ciphers to be more secure. This document does, however, | |||
| specify the only acceptable ciphersuites and client | specify the only acceptable ciphersuites and client | |||
| implementations must support them. | implementations must support them. | |||
| user_canceled: The IoT devices in focus of this specification are | user_canceled: The IoT devices in focus of this specification are | |||
| assumed to be unattended. | assumed to be unattended. | |||
| 8. Session Resumption | 9. Session Resumption | |||
| Session resumption is a feature of DTLS that allows a client to | Session resumption is a feature of DTLS that allows a client to | |||
| continue with an earlier established session state. The resulting | continue with an earlier established session state. The resulting | |||
| exchange is shown in Figure 5. In addition, the server may choose | exchange is shown in Figure 5. In addition, the server may choose | |||
| not to do a cookie exchange when a session is resumed. Still, | not to do a cookie exchange when a session is resumed. Still, | |||
| clients have to be prepared to do a cookie exchange with every | clients have to be prepared to do a cookie exchange with every | |||
| handshake. | handshake. | |||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| skipping to change at page 13, line 22 ¶ | skipping to change at page 14, line 22 ¶ | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| Application Data <-------> Application Data | Application Data <-------> Application Data | |||
| Figure 5: DTLS Session Resumption. | Figure 5: DTLS Session Resumption. | |||
| Clients MUST implement session resumption to improve the performance | Clients MUST implement session resumption to improve the performance | |||
| of the handshake (in terms of reduced number of message exchanges, | of the handshake (in terms of reduced number of message exchanges, | |||
| lower computational overhead, and less bandwidth conserved). | lower computational overhead, and less bandwidth conserved). | |||
| Since the communication model described in Section 2 does not assume | Since the communication model described in Section 3 does not assume | |||
| that the server is constrained. RFC 5077 [RFC5077] describing TLS | that the server is constrained. RFC 5077 [RFC5077] describing TLS | |||
| session resumption without server-side state is not utilized by this | session resumption without server-side state is not utilized by this | |||
| profile. | profile. | |||
| 9. TLS Compression | 10. TLS Compression | |||
| [I-D.sheffer-tls-bcp] recommends to always disable DTLS-level | [I-D.sheffer-tls-bcp] recommends to always disable DTLS-level | |||
| compression due to attacks. For IoT applications compression at the | compression due to attacks. For IoT applications compression at the | |||
| DTLS is not needed since application layer protocols are highly | DTLS is not needed since application layer protocols are highly | |||
| optimized and the compression algorithms at the DTLS layer increase | optimized and the compression algorithms at the DTLS layer increase | |||
| code size and complexity. Hence, for use with this profile | code size and complexity. Hence, for use with this profile | |||
| compression at the DTLS layer MUST NOT be implemented by the DTLS | compression at the DTLS layer SHOULD NOT be implemented by the DTLS | |||
| client. | client. | |||
| 10. Perfect Forward Secrecy | 11. Perfect Forward Secrecy | |||
| Perfect forward secrecy is designed to prevent the compromise of a | Perfect forward secrecy is designed to prevent the compromise of a | |||
| long-term secret key from affecting the confidentiality of past | long-term secret key from affecting the confidentiality of past | |||
| conversations. The PSK ciphersuite recommended in the CoAP | conversations. The PSK ciphersuite recommended in the CoAP | |||
| specification [I-D.ietf-core-coap] does not offer this property. | specification [I-D.ietf-core-coap] does not offer this property. | |||
| [I-D.sheffer-tls-bcp] on the other hand recommends using ciphersuites | [I-D.sheffer-tls-bcp] on the other hand recommends using ciphersuites | |||
| offering this security property. | offering this security property. | |||
| QUESTION: Should the PSK ciphersuite offer PFS? | QUESTION: Should the PSK ciphersuite offer PFS? | |||
| 11. Keep-Alive | 12. Keep-Alive | |||
| RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the | RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the | |||
| other peer is still alive. The same mechanism can also be used to | other peer is still alive. The same mechanism can also be used to | |||
| perform path MTU discovery. | perform path MTU discovery. | |||
| QUESTION: Do IoT deployments make use of this extension? | QUESTION: Do IoT deployments make use of this extension? | |||
| 12. Negotiation and Downgrading Attacks | 13. Negotiation and Downgrading Attacks | |||
| CoAP demands version 1.2 of DTLS to be used and the earlier version | CoAP demands version 1.2 of DTLS to be used and the earlier version | |||
| of DTLS is not supported. As such, there is no risk of downgrading | of DTLS is not supported. As such, there is no risk of downgrading | |||
| to an older version of DTLS. The work described in | to an older version of DTLS. The work described in | |||
| [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to | [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to | |||
| this environment since there is no legacy server infrastructure to | this environment since there is no legacy server infrastructure to | |||
| worry about. | worry about. | |||
| QUESTION: Should we say something for non-CoAP use of DTLS? | QUESTION: Should we say something for non-CoAP use of DTLS? | |||
| To prevent the TLS renegotiation attack [RFC5746] clients MUST | To prevent the TLS renegotiation attack [RFC5746] clients MUST | |||
| respond to server-initiated renegotiation attempts with an Alert | respond to server-initiated renegotiation attempts with an Alert | |||
| message (no_renegotiation) and clients MUST NOT initiate them. TLS | message (no_renegotiation) and clients MUST NOT initiate them. TLS | |||
| and DTLS allows a client and a server who already have a TLS | and DTLS allows a client and a server who already have a TLS | |||
| connection to negotiate new parameters, generate new keys, etc by | connection to negotiate new parameters, generate new keys, etc by | |||
| initiating a TLS handshake using a ClientHello message. | initiating a TLS handshake using a ClientHello message. | |||
| Renegotiation happens in the existing TLS connection, with the new | Renegotiation happens in the existing TLS connection, with the new | |||
| handshake packets being encrypted along with application data. | handshake packets being encrypted along with application data. | |||
| 13. Privacy Considerations | 14. Privacy Considerations | |||
| The DTLS handshake exchange conveys various identifiers, which can be | The DTLS handshake exchange conveys various identifiers, which can be | |||
| observed by an on-path eavesdropper. For example, the DTLS PSK | observed by an on-path eavesdropper. For example, the DTLS PSK | |||
| exchange reveals the PSK identity, the supported extensions, the | exchange reveals the PSK identity, the supported extensions, the | |||
| session id, algorithm parameters, etc. When session resumption is | session id, algorithm parameters, etc. When session resumption is | |||
| used then individual TLS sessions can be correlated by an on-path | used then individual TLS sessions can be correlated by an on-path | |||
| adversary. With many IoT deployments it is likely that keying | adversary. With many IoT deployments it is likely that keying | |||
| material and their identifiers are persistent over a longer period of | material and their identifiers are persistent over a longer period of | |||
| time due to the cost of updating software on these devices. | time due to the cost of updating software on these devices. | |||
| skipping to change at page 15, line 16 ¶ | skipping to change at page 16, line 16 ¶ | |||
| with other data to be truly useful and this extra data might include | with other data to be truly useful and this extra data might include | |||
| personal data about the owner of the device or data about the | personal data about the owner of the device or data about the | |||
| environment it senses. Consequently, the data stored on the server- | environment it senses. Consequently, the data stored on the server- | |||
| side will be vulnerable to stored data compromise. For the | side will be vulnerable to stored data compromise. For the | |||
| communication between the client and the server this specification | communication between the client and the server this specification | |||
| prevents eavesdroppers to gain access to the communication content. | prevents eavesdroppers to gain access to the communication content. | |||
| While the PSK-based ciphersuite does not provide PFS the asymmetric | While the PSK-based ciphersuite does not provide PFS the asymmetric | |||
| version does. No explicit techniques, such as extra padding, have | version does. No explicit techniques, such as extra padding, have | |||
| been provided to make traffic analysis more difficult. | been provided to make traffic analysis more difficult. | |||
| 14. Security Considerations | 15. Security Considerations | |||
| This entire document is about security. | This entire document is about security. | |||
| The TLS protocol requires random numbers to be available during the | The TLS protocol requires random numbers to be available during the | |||
| protocol run. For example, during the ClientHello and the | protocol run. For example, during the ClientHello and the | |||
| ServerHello exchange the client and the server exchange random | ServerHello exchange the client and the server exchange random | |||
| numbers. Also, the use of the Diffie Hellman exchange requires | numbers. Also, the use of the Diffie Hellman exchange requires | |||
| random numbers during the key pair generation. Special care has to | random numbers during the key pair generation. Special care has to | |||
| be paid when generating random numbers in embedded systems as many | be paid when generating random numbers in embedded systems as many | |||
| entropy sources available on desktop operating systems or mobile | entropy sources available on desktop operating systems or mobile | |||
| skipping to change at page 15, line 41 ¶ | skipping to change at page 16, line 41 ¶ | |||
| Guidelines and requirements for random number generation can be found | Guidelines and requirements for random number generation can be found | |||
| in RFC 4086 [RFC4086]. | in RFC 4086 [RFC4086]. | |||
| We would also like to point out that designing a software update | We would also like to point out that designing a software update | |||
| mechanism into an IoT system is crucial to ensure that both | mechanism into an IoT system is crucial to ensure that both | |||
| functionality can be enhanced and that potential vulnerabilities can | functionality can be enhanced and that potential vulnerabilities can | |||
| be fixed. This software update mechanism is also useful for changing | be fixed. This software update mechanism is also useful for changing | |||
| configuration information, for example, trust anchors and other | configuration information, for example, trust anchors and other | |||
| keying related information. | keying related information. | |||
| 15. IANA Considerations | 16. IANA Considerations | |||
| This document includes no request to IANA. | This document includes no request to IANA. | |||
| 16. Acknowledgements | 17. Acknowledgements | |||
| Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, | Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, | |||
| Zach Shelby, and Sean Turner for helpful comments and discussions | Zach Shelby, and Sean Turner for helpful comments and discussions | |||
| that have shaped the document. | that have shaped the document. | |||
| 17. References | 18. References | |||
| 17.1. Normative References | 18.1. Normative References | |||
| [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) | [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) | |||
| REGISTRATION AUTHORITY", April 2010, | REGISTRATION AUTHORITY", April 2010, | |||
| <http://standards.ieee.org/regauth/oui/tutorials/ | <http://standards.ieee.org/regauth/oui/tutorials/ | |||
| EUI64.html>. | EUI64.html>. | |||
| [I-D.ietf-core-coap] | ||||
| Shelby, Z., Hartke, K., and C. Bormann, "Constrained | ||||
| Application Protocol (CoAP)", draft-ietf-core-coap-18 | ||||
| (work in progress), June 2013. | ||||
| [I-D.ietf-tls-cached-info] | [I-D.ietf-tls-cached-info] | |||
| Santesson, S. and H. Tschofenig, "Transport Layer Security | Santesson, S. and H. Tschofenig, "Transport Layer Security | |||
| (TLS) Cached Information Extension", draft-ietf-tls- | (TLS) Cached Information Extension", draft-ietf-tls- | |||
| cached-info-16 (work in progress), February 2014. | cached-info-16 (work in progress), February 2014. | |||
| [I-D.ietf-tls-oob-pubkey] | [I-D.ietf-tls-oob-pubkey] | |||
| Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and | Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and | |||
| T. Kivinen, "Using Raw Public Keys in Transport Layer | T. Kivinen, "Using Raw Public Keys in Transport Layer | |||
| Security (TLS) and Datagram Transport Layer Security | Security (TLS) and Datagram Transport Layer Security | |||
| (DTLS)", draft-ietf-tls-oob-pubkey-11 (work in progress), | (DTLS)", draft-ietf-tls-oob-pubkey-11 (work in progress), | |||
| January 2014. | January 2014. | |||
| [I-D.mcgrew-tls-aes-ccm-ecc] | [I-D.mcgrew-tls-aes-ccm-ecc] | |||
| McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- | McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- | |||
| CCM ECC Cipher Suites for TLS", draft-mcgrew-tls-aes-ccm- | CCM ECC Cipher Suites for TLS", draft-mcgrew-tls-aes-ccm- | |||
| ecc-08 (work in progress), February 2014. | ecc-08 (work in progress), February 2014. | |||
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | ||||
| Requirement Levels", BCP 14, RFC 2119, March 1997. | ||||
| [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites | [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites | |||
| for Transport Layer Security (TLS)", RFC 4279, December | for Transport Layer Security (TLS)", RFC 4279, December | |||
| 2005. | 2005. | |||
| [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security | [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security | |||
| (TLS) Protocol Version 1.2", RFC 5246, August 2008. | (TLS) Protocol Version 1.2", RFC 5246, August 2008. | |||
| [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, | [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, | |||
| "Transport Layer Security (TLS) Renegotiation Indication | "Transport Layer Security (TLS) Renegotiation Indication | |||
| Extension", RFC 5746, February 2010. | Extension", RFC 5746, February 2010. | |||
| skipping to change at page 17, line 18 ¶ | skipping to change at page 18, line 12 ¶ | |||
| (PKIX) Certificates in the Context of Transport Layer | (PKIX) Certificates in the Context of Transport Layer | |||
| Security (TLS)", RFC 6125, March 2011. | Security (TLS)", RFC 6125, March 2011. | |||
| [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer | [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer | |||
| Security Version 1.2", RFC 6347, January 2012. | Security Version 1.2", RFC 6347, January 2012. | |||
| [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport | [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport | |||
| Layer Security (TLS) and Datagram Transport Layer Security | Layer Security (TLS) and Datagram Transport Layer Security | |||
| (DTLS) Heartbeat Extension", RFC 6520, February 2012. | (DTLS) Heartbeat Extension", RFC 6520, February 2012. | |||
| 17.2. Informative References | 18.2. Informative References | |||
| [Heninger] | [Heninger] | |||
| Heninger, N., Durumeric, Z., Wustrow, E., and A. | Heninger, N., Durumeric, Z., Wustrow, E., and A. | |||
| Halderman, "Mining Your Ps and Qs: Detection of Widespread | Halderman, "Mining Your Ps and Qs: Detection of Widespread | |||
| Weak Keys in Network Devices", 21st USENIX Security | Weak Keys in Network Devices", 21st USENIX Security | |||
| Symposium, https://www.usenix.org/conference/ | Symposium, https://www.usenix.org/conference/ | |||
| usenixsecurity12/technical-sessions/presentation/heninger, | usenixsecurity12/technical-sessions/presentation/heninger, | |||
| 2012. | 2012. | |||
| [I-D.bmoeller-tls-downgrade-scsv] | [I-D.bmoeller-tls-downgrade-scsv] | |||
| skipping to change at page 18, line 11 ¶ | skipping to change at page 19, line 5 ¶ | |||
| Gutmann, P., "Encrypt-then-MAC for TLS and DTLS", draft- | Gutmann, P., "Encrypt-then-MAC for TLS and DTLS", draft- | |||
| gutmann-tls-encrypt-then-mac-05 (work in progress), | gutmann-tls-encrypt-then-mac-05 (work in progress), | |||
| December 2013. | December 2013. | |||
| [I-D.hummen-dtls-extended-session-resumption] | [I-D.hummen-dtls-extended-session-resumption] | |||
| Hummen, R., Gilger, J., and H. Shafagh, "Extended DTLS | Hummen, R., Gilger, J., and H. Shafagh, "Extended DTLS | |||
| Session Resumption for Constrained Network Environments", | Session Resumption for Constrained Network Environments", | |||
| draft-hummen-dtls-extended-session-resumption-01 (work in | draft-hummen-dtls-extended-session-resumption-01 (work in | |||
| progress), October 2013. | progress), October 2013. | |||
| [I-D.ietf-core-coap] | ||||
| Shelby, Z., Hartke, K., and C. Bormann, "Constrained | ||||
| Application Protocol (CoAP)", draft-ietf-core-coap-18 | ||||
| (work in progress), June 2013. | ||||
| [I-D.ietf-lwig-guidance] | [I-D.ietf-lwig-guidance] | |||
| Bormann, C., "Guidance for Light-Weight Implementations of | Bormann, C., "Guidance for Light-Weight Implementations of | |||
| the Internet Protocol Suite", draft-ietf-lwig-guidance-03 | the Internet Protocol Suite", draft-ietf-lwig-guidance-03 | |||
| (work in progress), February 2013. | (work in progress), February 2013. | |||
| [I-D.ietf-lwig-terminology] | [I-D.ietf-lwig-terminology] | |||
| Bormann, C., Ersue, M., and A. Keranen, "Terminology for | Bormann, C., Ersue, M., and A. Keranen, "Terminology for | |||
| Constrained Node Networks", draft-ietf-lwig-terminology-07 | Constrained Node Networks", draft-ietf-lwig-terminology-07 | |||
| (work in progress), February 2014. | (work in progress), February 2014. | |||
| skipping to change at page 19, line 16 ¶ | skipping to change at page 20, line 13 ¶ | |||
| Requirements for Security", BCP 106, RFC 4086, June 2005. | Requirements for Security", BCP 106, RFC 4086, June 2005. | |||
| [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. | [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. | |||
| Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites | Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites | |||
| for Transport Layer Security (TLS)", RFC 4492, May 2006. | for Transport Layer Security (TLS)", RFC 4492, May 2006. | |||
| [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, | [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, | |||
| "Transport Layer Security (TLS) Session Resumption without | "Transport Layer Security (TLS) Session Resumption without | |||
| Server-Side State", RFC 5077, January 2008. | Server-Side State", RFC 5077, January 2008. | |||
| [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated | ||||
| Encryption", RFC 5116, January 2008. | ||||
| [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., | [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., | |||
| Housley, R., and W. Polk, "Internet X.509 Public Key | Housley, R., and W. Polk, "Internet X.509 Public Key | |||
| Infrastructure Certificate and Certificate Revocation List | Infrastructure Certificate and Certificate Revocation List | |||
| (CRL) Profile", RFC 5280, May 2008. | (CRL) Profile", RFC 5280, May 2008. | |||
| [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with | [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with | |||
| SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, | SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, | |||
| August 2008. | August 2008. | |||
| [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor | [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor | |||
| Management Protocol (TAMP)", RFC 5934, August 2010. | Management Protocol (TAMP)", RFC 5934, August 2010. | |||
| [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic | [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic | |||
| Curve Cryptography Algorithms", RFC 6090, February 2011. | Curve Cryptography Algorithms", RFC 6090, February 2011. | |||
| [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for | ||||
| Transport Layer Security (TLS)", RFC 6655, July 2012. | ||||
| [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) | [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) | |||
| Multiple Certificate Status Request Extension", RFC 6961, | Multiple Certificate Status Request Extension", RFC 6961, | |||
| June 2013. | June 2013. | |||
| [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., | [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., | |||
| Morris, J., Hansen, M., and R. Smith, "Privacy | Morris, J., Hansen, M., and R. Smith, "Privacy | |||
| Considerations for Internet Protocols", RFC 6973, July | Considerations for Internet Protocols", RFC 6973, July | |||
| 2013. | 2013. | |||
| Authors' Addresses | Authors' Addresses | |||
| End of changes. 58 change blocks. | ||||
| 142 lines changed or deleted | 183 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||