< draft-ietf-dice-profile-01.txt   draft-ietf-dice-profile-02.txt >
dice K. Hartke dice H. Tschofenig, Ed.
Internet-Draft Universitaet Bremen TZI Internet-Draft ARM Ltd.
Intended status: Informational H. Tschofenig Intended status: Standards Track July 4, 2014
Expires: November 7, 2014 ARM Ltd. Expires: January 5, 2015
May 6, 2014
A DTLS 1.2 Profile for the Internet of Things A Datagram Transport Layer Security (DTLS) 1.2 Profile for the Internet
draft-ietf-dice-profile-01.txt of Things
draft-ietf-dice-profile-02.txt
Abstract Abstract
This document defines a DTLS profile that is suitable for Internet of This document defines a DTLS profile that is suitable for Internet of
Things applications and is reasonably implementable on many Things applications and is reasonably implementable on many
constrained devices. constrained devices.
A common design pattern in IoT deployments is the use of a
constrained device (typically providing sensor data) that interacts
with the web infrastructure. This document focuses on this
particular pattern.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on November 7, 2014. This Internet-Draft will expire on January 5, 2015.
Copyright Notice Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. The Communication Model . . . . . . . . . . . . . . . . . . . 4 3. The Communication Model . . . . . . . . . . . . . . . . . . . 5
4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6
5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8 5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8
6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9 6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9
7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11 7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11
8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 13 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 12
9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 13 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 14
10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14 10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14
11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14
12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15
13. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 15 13. Random Number Generation . . . . . . . . . . . . . . . . . . 16
14. Privacy Considerations . . . . . . . . . . . . . . . . . . . 15 14. Client Certificate URLs . . . . . . . . . . . . . . . . . . . 17
15. Security Considerations . . . . . . . . . . . . . . . . . . . 16 15. Trusted CA Indication . . . . . . . . . . . . . . . . . . . . 17
16. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 16. Truncated MAC Extension . . . . . . . . . . . . . . . . . . . 18
17. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 16 17. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 18
18. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 18. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 18
18.1. Normative References . . . . . . . . . . . . . . . . . . 17 19. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 18
18.2. Informative References . . . . . . . . . . . . . . . . . 18 20. Privacy Considerations . . . . . . . . . . . . . . . . . . . 19
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 21. Security Considerations . . . . . . . . . . . . . . . . . . . 19
22. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 20
23. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 20
24. References . . . . . . . . . . . . . . . . . . . . . . . . . 20
24.1. Normative References . . . . . . . . . . . . . . . . . . 20
24.2. Informative References . . . . . . . . . . . . . . . . . 21
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 23
1. Introduction 1. Introduction
This document defines a DTLS 1.2 [RFC6347] profile that offers This document defines a DTLS 1.2 [RFC6347] profile that offers
communication security for Internet of Things (IoT) applications and communication security for Internet of Things (IoT) applications and
is reasonably implementable on many constrained devices. It aims to is reasonably implementable on many constrained devices. It aims to
meet the following goals: meet the following goals:
o Serve as a one-stop shop for implementers to know which pieces of o Serves as a one-stop shop for implementers to know which pieces of
the specification jungle contain relevant details. the specification jungle contain relevant details.
o Not alter the DTLS specification. o Does not alter the DTLS 1.2 specification.
o Not introduce any new extensions. o Does not introduce any new extensions.
o Align with the DTLS security modes of the Constrained Application o Aligns with the DTLS security modes of the Constrained Application
Protocol (CoAP) [I-D.ietf-core-coap]. Protocol (CoAP) [RFC7252].
DTLS is used to secure a number of applications run over an DTLS is used to secure a number of applications run over an
unreliable datagram transport. CoAP [I-D.ietf-core-coap] is one such unreliable datagram transport. CoAP [RFC7252] is one such protocol
protocol and has been designed specifically for use in IoT and has been designed specifically for use in IoT environments. CoAP
environments. CoAP can be secured a number of different ways, also can be secured a number of different ways, also called security
called security modes. These security modes are as follows, see modes. These security modes are as follows, see Section 5,
Section 5, Section 6, Section 7 for additional details: Section 6, Section 7 for additional details:
No Security Protection at the Transport Layer: No DTLS is used but No Security Protection at the Transport Layer: No DTLS is used but
instead application layer security functionality is assumed. instead application layer security functionality is assumed.
Shared Secret-based DTLS Authentication: DTLS supports the use of Shared Secret-based DTLS Authentication: DTLS supports the use of
shared secrets [RFC4279]. This mode is useful if the number of shared secrets [RFC4279]. This mode is useful if the number of
communication relationships between the IoT device and servers is communication relationships between the IoT device and servers is
small and for very constrained devices. Shared secret-based small and for very constrained devices. Shared secret-based
authentication mechanisms offer good performance and require a authentication mechanisms offer good performance and require a
minimum of data to be exchanged. minimum of data to be exchanged.
DTLS Authentication using Asymmetric Cryptography: TLS supports DTLS Authentication using Asymmetric Cryptography: TLS supports
client and server authentication using asymmetric cryptography. client and server authentication using asymmetric cryptography.
Two approaches for validating these public keys are available. Two approaches for validating these public keys are available.
First, [I-D.ietf-tls-oob-pubkey] allows raw public keys to be used First, [RFC7250] allows raw public keys to be used in TLS without
in TLS without the overhead of certificates. This approach the overhead of certificates. This approach requires out-of-band
requires out-of-band validation of the public key. Second, the validation of the public key. Second, the use of X.509
use of X.509 certificates [RFC5280] with TLS is common on the Web certificates [RFC5280] with TLS is common on the Web today (at
today (at least for server-side authentication) and certain IoT least for server-side authentication) and certain IoT environments
environments may also re-use those capabilities. Certificates may also re-use those capabilities. Certificates bind an
bind an identifier to the public key signed by a certification identifier to the public key signed by a certification authority
authority (CA). A trust anchor store has to be provisioned on the (CA). A trust anchor store has to be provisioned on the device to
device to indicate what CAs are trusted. Furthermore, the indicate what CAs are trusted. Furthermore, the certificate may
certificate may contain a wealth of other information used to make contain a wealth of other information used to make authorization
authorization decisions. decisions.
As described in [I-D.ietf-lwig-tls-minimal], an application designer As described in [I-D.ietf-lwig-tls-minimal], an application designer
developing an IoT device needs to consider the security threats and developing an IoT device needs to consider the security threats and
the security services that can be used to mitigate the threats. the security services that can be used to mitigate the threats.
Enabling devices to upload data and retrieve configuration Enabling devices to upload data and retrieve configuration
information, inevitably requires that Internet-connected devices be information, inevitably requires that Internet-connected devices be
able to authenticate themselves to servers and vice versa as well as able to authenticate themselves to servers and vice versa as well as
to ensure that the data and information exchanged is integrity and to ensure that the data and information exchanged is integrity and
confidentiality protected. While these security services can be confidentiality protected. While these security services can be
provided at different layers in the protocol stack the use of provided at different layers in the protocol stack the use of
skipping to change at page 7, line 7 skipping to change at page 7, line 7
following information: following information:
o Authentication and Key Exchange Algorithm (e.g., PSK) o Authentication and Key Exchange Algorithm (e.g., PSK)
o Cipher and Key Length (e.g., AES with 128 bit keys) o Cipher and Key Length (e.g., AES with 128 bit keys)
o Mode of operation (e.g., CBC) o Mode of operation (e.g., CBC)
o Hash Algorithm for Integrity Protection (e.g., SHA in combination o Hash Algorithm for Integrity Protection (e.g., SHA in combination
with HMAC) with HMAC)
o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC
with the SHA-256) with the SHA-256)
o Misc information (e.g., length of authentication tags) o Misc information (e.g., length of authentication tags)
o Information whether the ciphersuite is suitable for DTLS or only o Information whether the ciphersuite is suitable for DTLS or only
for TLS for TLS
The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a
pre-shared authentication and key exchange algorithm. RFC 6655 pre-shared authentication and key exchange algorithm. RFC 6655
[RFC6655] defines this ciphersuite. It uses the Advanced Encryption [RFC6655] defines this ciphersuite. It uses the Advanced Encryption
skipping to change at page 9, line 37 skipping to change at page 9, line 37
support arbitrary PSK identities up to 128 octets in length, and support arbitrary PSK identities up to 128 octets in length, and
arbitrary PSKs up to 64 octets in length. This is a useful arbitrary PSKs up to 64 octets in length. This is a useful
assumption for TLS stacks used in the desktop and mobile environment assumption for TLS stacks used in the desktop and mobile environment
where management interfaces are used to provision identities and where management interfaces are used to provision identities and
keys. For the IoT environment, however, many devices are not keys. For the IoT environment, however, many devices are not
equipped with displays and input devices (e.g., keyboards). Hence, equipped with displays and input devices (e.g., keyboards). Hence,
keys are distributed as part of hardware modules or are embedded into keys are distributed as part of hardware modules or are embedded into
the firmware. As such, these restrictions are not applicable to this the firmware. As such, these restrictions are not applicable to this
profile. profile.
Constrained Application Protocol (CoAP) [I-D.ietf-core-coap] Constrained Application Protocol (CoAP) [RFC7252] currently specifies
currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite
implement ciphersuite for use with shared secrets. This ciphersuite for use with shared secrets. This ciphersuite uses the AES algorithm
uses the AES algorithm with 128 bit keys and CCM as the mode of with 128 bit keys and CCM as the mode of operation. The label "_8"
operation. The label "_8" indicates that an 8-octet authentication indicates that an 8-octet authentication tag is used. This
tag is used. This ciphersuite makes use of the default TLS 1.2 ciphersuite makes use of the default TLS 1.2 Pseudorandom Function
Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash (PRF), which uses HMAC with the SHA-256 hash function.
function.
6. Raw Public Key Use with DTLS 6. Raw Public Key Use with DTLS
The use of raw public keys with DTLS, as defined in The use of raw public keys with DTLS, as defined in [RFC7250], is the
[I-D.ietf-tls-oob-pubkey], is the first entry point into public key first entry point into public key cryptography without having to pay
cryptography without having to pay the price of certificates and a the price of certificates and a PKI. The specification re-uses the
PKI. The specification re-uses the existing Certificate message to existing Certificate message to convey the raw public key encoded in
convey the raw public key encoded in the SubjectPublicKeyInfo the SubjectPublicKeyInfo structure. To indicate support two new TLS
structure. To indicate support two new TLS extensions had been extensions had been defined, as shown in Figure 3, namely the
defined, as shown in Figure 3, namely the server_certificate_type and server_certificate_type and the client_certificate_type. To operate
the client_certificate_type. To operate this mechanism securely it this mechanism securely it is necessary to authenticate and authorize
is necessary to authenticate and authorize the public keys out-of- the public keys out-of-band. This document therefore assumes that a
band. This document therefore assumes that a client implementation client implementation comes with one or multiple raw public keys of
comes with one or multiple raw public keys of servers, it has to servers, it has to communicate with, pre-provisioned. Additionally,
communicate with, pre-provisioned. Additionally, a device will have a device will have its own raw public key. To replace, delete, or
its own raw public key. To replace, delete, or add raw public key to add raw public key to this list requires a software update, for
this list requires a software update, for example using a firmware example using a firmware update mechanism.
update mechanism.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
client_certificate_type client_certificate_type
server_certificate_type server_certificate_type
<------- HelloVerifyRequest <------- HelloVerifyRequest
skipping to change at page 10, line 49 skipping to change at page 10, line 47
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange.
The CoAP recommended ciphersuite for use with this credential type is The CoAP recommended ciphersuite for use with this credential type is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [I-D.mcgrew-tls-aes-ccm-ecc]. TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve
cryptography (ECC) based AES-CCM TLS ciphersuite uses the Elliptic
This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite Curve Diffie Hellman (ECDHE) as the key establishment mechanism and
uses the Elliptic Curve Diffie Hellman (ECDHE) as the key an Elliptic Curve Digital Signature Algorithm (ECDSA) for
establishment mechanism and an Elliptic Curve Digital Signature authentication. This ciphersuite make use of the AEAD capability in
Algorithm (ECDSA) for authentication. This ciphersuite make use of DTLS 1.2 and utilizes an eight-octet authentication tag. Based on
the AEAD capability in DTLS 1.2 and utilizes an eight-octet the Diffie-Hellman it provides perfect forward secrecy (PFS). More
authentication tag. Based on the Diffie-Hellman it provides perfect details about the PFS can be found in Section 11.
forward secrecy (PFS). More details about the PFS can be found in
Section 11.
RFC 6090 [RFC6090] provides valuable information for implementing RFC 6090 [RFC6090] provides valuable information for implementing
Elliptic Curve Cryptography algorithms. Elliptic Curve Cryptography algorithms.
Since many IoT devices will either have limited ways to log error or Since many IoT devices will either have limited ways to log error or
no ability at all, any error will lead to implementations attempting no ability at all, any error will lead to implementations attempting
to re-try the exchange. to re-try the exchange.
7. Certificate Use with DTLS 7. Certificate Use with DTLS
skipping to change at page 11, line 41 skipping to change at page 11, line 37
certificate authority is omitted from the chain. Client certificate authority is omitted from the chain. Client
implementations MUST be provisioned with a trust anchor store that implementations MUST be provisioned with a trust anchor store that
contains the root certificates. The use of the Trust Anchor contains the root certificates. The use of the Trust Anchor
Management Protocol (TAMP) [RFC5934] is, however, not envisioned. Management Protocol (TAMP) [RFC5934] is, however, not envisioned.
Instead IoT devices using this profile MUST rely a software update Instead IoT devices using this profile MUST rely a software update
mechanism to provision these trust anchors. mechanism to provision these trust anchors.
When DTLS is used to secure CoAP messages then the server provided When DTLS is used to secure CoAP messages then the server provided
certificates MUST contain the fully qualified DNS domain name or certificates MUST contain the fully qualified DNS domain name or
"FQDN". The coaps URI scheme is described in Section 6.2 of "FQDN". The coaps URI scheme is described in Section 6.2 of
[I-D.ietf-core-coap]. This FQDN is stored in the SubjectAltName or [RFC7252]. This FQDN is stored in the SubjectAltName or in the CN,
in the CN, as explained in Section 9.1.3.3 of [I-D.ietf-core-coap], as explained in Section 9.1.3.3 of [RFC7252], and used by the client
and used by the client to match it against the FQDN used during the to match it against the FQDN used during the look-up process, as
look-up process, as described in RFC 6125 [RFC6125]. For the profile described in RFC 6125 [RFC6125]. For the profile in this
in this specification does not assume dynamic discovery of local specification does not assume dynamic discovery of local servers.
servers.
For client certificates the identifier used in the SubjectAltName or For client certificates the identifier used in the SubjectAltName or
in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3
of [I-D.ietf-core-coap]. of [RFC7252].
For certificate revocation neither the Online Certificate Status For certificate revocation neither the Online Certificate Status
Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
Instead, this profile relies on a software update mechanism. While Instead, this profile relies on a software update mechanism. While
multiple OCSP stapling [RFC6961] has recently been introduced as a multiple OCSP stapling [RFC6961] has recently been introduced as a
mechanism to piggyback OCSP request/responses inside the DTLS/TLS mechanism to piggyback OCSP request/responses inside the DTLS/TLS
handshake to avoid the cost of a separate protocol handshake further handshake to avoid the cost of a separate protocol handshake further
investigations are needed to determine its suitability for the IoT investigations are needed to determine its suitability for the IoT
environment. environment.
skipping to change at page 12, line 44 skipping to change at page 12, line 38
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Figure 4: DTLS Mutual Certificate-based Authentication. Figure 4: DTLS Mutual Certificate-based Authentication.
Regarding the ciphersuite choice the discussion in Section 6 applies. Regarding the ciphersuite choice the discussion in Section 6 applies.
Further details about X.509 certificates can be found in Further details about X.509 certificates can be found in
Section 9.1.3.3 of [I-D.ietf-core-coap]. Section 9.1.3.3 of [RFC7252].
QUESTION: What restrictions regarding the depth of the certificate QUESTION: What restrictions regarding the depth of the certificate
chain should be made? Is one level enough? chain should be made? Is one level enough?
8. Error Handling 8. Error Handling
DTLS uses the Alert protocol to convey error messages and specifies a DTLS uses the Alert protocol to convey error messages and specifies a
longer list of errors. However, not all error messages defined in longer list of errors. However, not all error messages defined in
the TLS specification are applicable to this profile. All error the TLS specification are applicable to this profile. All error
messages marked as RESERVED are only supported for backwards messages marked as RESERVED are only supported for backwards
compatibility with SSL and are therefore not applicable to this compatibility with SSL and are therefore not applicable to this
profile. Those include decryption_failed_RESERVED, profile. Those include decryption_failed_RESERVED,
no_certificate_RESERVE, and export_restriction_RESERVED. A number of no_certificate_RESERVE, and export_restriction_RESERVED.
the error messages are applicable only for certificate-based
authentication ciphersuites. Hence, for PSK and raw public key use A number of the error messages are applicable only for certificate-
the following error messages are not applicable: bad_certificate, based authentication ciphersuites. Hence, for PSK and raw public key
unsupported_certificate, certificate_revoked, certificate_expired, use the following error messages are not applicable:
certificate_unknown, unknown_ca, and access_denied.
o bad_certificate,
o unsupported_certificate,
o certificate_revoked,
o certificate_expired,
o certificate_unknown,
o unknown_ca, and
o access_denied.
Since this profile does not make use of compression at the TLS layer Since this profile does not make use of compression at the TLS layer
the decompression_failure error message is not applicable either. the decompression_failure error message is not applicable either.
RFC 4279 introduced a new alert message unknown_psk_identity for PSK RFC 4279 introduced a new alert message unknown_psk_identity for PSK
ciphersuites. As stated in Section 2 of RFC 4279 the ciphersuites. As stated in Section 2 of RFC 4279 the
decryption_error error message may also be used instead. For this decryption_error error message may also be used instead. For this
profile the TLS server MUST return the decryption_error error message profile the TLS server MUST return the decryption_error error message
instead of the unknown_psk_identity. instead of the unknown_psk_identity.
skipping to change at page 14, line 29 skipping to change at page 14, line 38
of the handshake (in terms of reduced number of message exchanges, of the handshake (in terms of reduced number of message exchanges,
lower computational overhead, and less bandwidth conserved). lower computational overhead, and less bandwidth conserved).
Since the communication model described in Section 3 does not assume Since the communication model described in Section 3 does not assume
that the server is constrained. RFC 5077 [RFC5077] describing TLS that the server is constrained. RFC 5077 [RFC5077] describing TLS
session resumption without server-side state is not utilized by this session resumption without server-side state is not utilized by this
profile. profile.
10. TLS Compression 10. TLS Compression
[I-D.sheffer-tls-bcp] recommends to always disable DTLS-level [I-D.ietf-uta-tls-bcp] recommends to always disable DTLS-level
compression due to attacks. For IoT applications compression at the compression due to attacks. For IoT applications compression at the
DTLS is not needed since application layer protocols are highly DTLS is not needed since application layer protocols are highly
optimized and the compression algorithms at the DTLS layer increase optimized and the compression algorithms at the DTLS layer increase
code size and complexity. Hence, for use with this profile code size and complexity.
compression at the DTLS layer SHOULD NOT be implemented by the DTLS
client. This DTLS client profile does not include DTLS layer compression.
11. Perfect Forward Secrecy 11. Perfect Forward Secrecy
Perfect forward secrecy is designed to prevent the compromise of a Perfect forward secrecy (PFS) is designed to prevent the compromise
long-term secret key from affecting the confidentiality of past of a long-term secret key from affecting the confidentiality of past
conversations. The PSK ciphersuite recommended in the CoAP conversations. The PSK ciphersuite recommended in the CoAP
specification [I-D.ietf-core-coap] does not offer this property. specification [RFC7252] does not offer this property since it does
[I-D.sheffer-tls-bcp] on the other hand recommends using ciphersuites not utilize a Diffie-Hellman exchange. [I-D.ietf-uta-tls-bcp] on the
offering this security property. other hand recommends using ciphersuites offering this security
property and so do the public key-based ciphersuites recommended by
the CoAP specification.
QUESTION: Should the PSK ciphersuite offer PFS? The use of PFS is certainly a tradeoff decision since on one hand the
compromise of long-term secrets of embedded devices is more likely
than with many other Internet hosts but on the other hand a Diffie-
Hellman exchange requires emphemeral key pairs to be generated, which
can be demanding from a performance point of view. Finally, the
impact of the disclosure of past conversations and the desire to
increase the cost for pervasive monitoring (see [RFC7258]) has to be
taken into account.
Our recommendation is to stick with the ciphersuite suggested in the
CoAP specification. New ciphersuites support PFS for pre-shared
secret-based authentication, such as
[I-D.schmertmann-dice-ccm-psk-pfs], and might be available as a
standardized ciphersuite in the future.
12. Keep-Alive 12. Keep-Alive
RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the
other peer is still alive. The same mechanism can also be used to other peer is still alive. The same mechanism can also be used to
perform path MTU discovery. perform Path Maximum Transmission Unit (MTU) Discovery.
QUESTION: Do IoT deployments make use of this extension? A recommendation about the use of RFC 6520 depends on the type of
message exchange an IoT device performs. There are three types of
exchanges that need to be analysed:
13. Negotiation and Downgrading Attacks Client-Initiated, One-Shot Messages
This is a common communication pattern where IoT devices upload
data to a server on the Internet on an irregular basis. The
communcation may be triggered by specific events, such as opening
a door.
Since the upload happens on an irregular and unpredicable basis
and due to renumbering and Network Address Translation (NAT) a new
DTLS session or DTLS session resumption can be used.
In this case there is no use for a keep-alive extension for this
scenario.
Client-Initiated, Regular Data Uploads
This is a variation of the previous case whereby data gets
uploaded on a regular basis, for example, based on frequent
temperature readings. With such regular exchange it can be
assumed that the DTLS context is still in kept at the IoT device.
If neither NAT bindings nor IP address changes occurred then the
DTLS record layer will not notice any changes. For the case where
IP and port changes happened it is necessary to re-create the DTLS
record layer using session resumption.
In this scenario there is no use for a keep-alive extension. It
is also very likely that the device will enter a sleep cycle in
between data transmissions to keep power consumption low.
Server-Initiated Messages
In the two previous scenarios the client initiated the protocol
interaction. In this case, we consider server-initiated messages.
Since messages to the client may get blocked by intermediaries,
such as NATs and stateful packet filtering firewalls, the initial
connection setup is triggered by the client and then kept alive.
Since state expires fairly quickly at middleboxes regular
heartbeats are necessary whereby these keep-alive messages may be
exchanged at the application layer or within DTLS itself.
For this message exchange pattern the use of DTLS heartbeat
messages is quite useful. The MTU discovery mechanism, on the
other hand, is less likely to be relevant since for many IoT
deployments the must constrained link is the wireless interface at
the IoT device itself rather than somewhere in the network. Only
in more complex network topologies the situation might be
different.
For server-initiated messages the heartbeat extension can be
recommended.
13. Random Number Generation
The DTLS protocol requires random numbers to be available during the
protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie Hellman exchange requires
random numbers during the key pair generation. Special care has to
be paid when generating random numbers in embedded systems as many
entropy sources available on desktop operating systems or mobile
devices might be missing, as described in [Heninger]. Consequently,
if not enough time is given during system start time to fill the
entropy pool then the output might be predictable and repeatable, for
example leading to the same keys generated again and again.
Recommendation: IoT devices using DTLS MUST offer ways to generate
quality random numbers. Guidelines and requirements for random
number generation can be found in RFC 4086 [RFC4086].
It is important to note that sources contributing to the randomness
pool on laptops, or desktop pcs are not available on many IoT device,
such as mouse movement, timing of keystrokes, air turbulence on the
movement of hard drive heads, etc. Other sources have to be found or
dedicated hardware has to be added.
14. Client Certificate URLs
This RFC 6066 [RFC6066] extension allows to avoid sending client-side
certificates and URLs instead. This reduces the over-the-air
transmission.
This is certainly a useful extension when a certificate-based mode
for DTLS is used since the TLS cached info extension does not provide
any help with caching information on the server side.
Recommendation: Add support for client certificate URLs for those
environments where client-side certificates are used.
15. Trusted CA Indication
This RFC 6066 extension allows clients to indicate what trust anchor
they support. With certificate-based authentication a DTLS server
conveys its end entity certificate to the client during the DTLS
exchange provides. Since the server does not necessarily know what
trust anchors the client has stored it includes intermediate CA certs
in the certificate payload as well to facilitate with certification
path construction and path validation.
Today, in most IoT deployments there is a fairly static relationship
between the IoT device (and the software running on them) and the
server- side infrastructure and no such dynamic indication of trust
anchors is needed.
Recommendation: For IoT deployments where clients talk to a fixed,
pre-configured set of servers and where a software update mechanism
is available this extension is not recommended. Environments where
the client needs to interact with dynamically discovered DTLS servers
this extension may be useful to reduce the communication overhead.
Note, however, in that case the TLS cached info extension may help to
reduce the communication overhead for everything but the first
protocol interaction.
16. Truncated MAC Extension
This RFC 6066 extension was introduced to reduces the size of the MAC
used at the Record Layer. This extension was developed for TLS
ciphersuites that used older modes of operation where the MAC and the
encryption operation was performed independently.
For CoAP, however, the recommended ciphersuites use the newer
Authenticated Encryption with Associated Data (AEAD) construct,
namely the CBC-MAC mode (CCM) with eight-octet authentication tags.
Recommendation: Since this profile only supports AEAD ciphersuites
this extension is not applicable.
17. Server Name Indication (SNI)
This RFC 6066 extension defines a mechanism for a client to tell a
TLS server the name of the server it wants to contact. This is a
useful extension for many hosting environments where multiple virtual
servers are run on single IP address.
Recommendation: Unless it is known that a DTLS client does not
interact with a server in a hosting environment that requires such an
extension we advice to offer support for the SNI extension in this
profile.
18. Maximum Fragment Length Negotiation
This RFC 6066 extension lowers the maximum fragment length support
needed for the Record Layer from 2^14 bytes to 2^9 bytes.
This is a very useful extension that allows the client to indicate to
the server how much maximum memory buffers it uses for incoming
messages. Ultimately, the main benefit of this extension is it to
allows client implementations to lower their RAM requirements since
the client does not need to accept packets of large size (such as 16k
packets as required by plain TLS/DTLS).
Recommendation: Client implementations must support this extension.
19. Negotiation and Downgrading Attacks
CoAP demands version 1.2 of DTLS to be used and the earlier version CoAP demands version 1.2 of DTLS to be used and the earlier version
of DTLS is not supported. As such, there is no risk of downgrading of DTLS is not supported. As such, there is no risk of downgrading
to an older version of DTLS. The work described in to an older version of DTLS. The work described in
[I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to
this environment since there is no legacy server infrastructure to this environment since there is no legacy server infrastructure to
worry about. worry about.
QUESTION: Should we say something for non-CoAP use of DTLS? QUESTION: Should we say something for non-CoAP use of DTLS?
To prevent the TLS renegotiation attack [RFC5746] clients MUST To prevent the TLS renegotiation attack [RFC5746] clients MUST
respond to server-initiated renegotiation attempts with an Alert respond to server-initiated renegotiation attempts with an Alert
message (no_renegotiation) and clients MUST NOT initiate them. TLS message (no_renegotiation) and clients MUST NOT initiate them. TLS
and DTLS allows a client and a server who already have a TLS and DTLS allows a client and a server who already have a TLS
connection to negotiate new parameters, generate new keys, etc by connection to negotiate new parameters, generate new keys, etc by
initiating a TLS handshake using a ClientHello message. initiating a TLS handshake using a ClientHello message.
Renegotiation happens in the existing TLS connection, with the new Renegotiation happens in the existing TLS connection, with the new
handshake packets being encrypted along with application data. handshake packets being encrypted along with application data.
14. Privacy Considerations 20. Privacy Considerations
The DTLS handshake exchange conveys various identifiers, which can be The DTLS handshake exchange conveys various identifiers, which can be
observed by an on-path eavesdropper. For example, the DTLS PSK observed by an on-path eavesdropper. For example, the DTLS PSK
exchange reveals the PSK identity, the supported extensions, the exchange reveals the PSK identity, the supported extensions, the
session id, algorithm parameters, etc. When session resumption is session id, algorithm parameters, etc. When session resumption is
used then individual TLS sessions can be correlated by an on-path used then individual TLS sessions can be correlated by an on-path
adversary. With many IoT deployments it is likely that keying adversary. With many IoT deployments it is likely that keying
material and their identifiers are persistent over a longer period of material and their identifiers are persistent over a longer period of
time due to the cost of updating software on these devices. time due to the cost of updating software on these devices.
skipping to change at page 16, line 16 skipping to change at page 19, line 48
with other data to be truly useful and this extra data might include with other data to be truly useful and this extra data might include
personal data about the owner of the device or data about the personal data about the owner of the device or data about the
environment it senses. Consequently, the data stored on the server- environment it senses. Consequently, the data stored on the server-
side will be vulnerable to stored data compromise. For the side will be vulnerable to stored data compromise. For the
communication between the client and the server this specification communication between the client and the server this specification
prevents eavesdroppers to gain access to the communication content. prevents eavesdroppers to gain access to the communication content.
While the PSK-based ciphersuite does not provide PFS the asymmetric While the PSK-based ciphersuite does not provide PFS the asymmetric
version does. No explicit techniques, such as extra padding, have version does. No explicit techniques, such as extra padding, have
been provided to make traffic analysis more difficult. been provided to make traffic analysis more difficult.
15. Security Considerations 21. Security Considerations
This entire document is about security. This entire document is about security.
The TLS protocol requires random numbers to be available during the
protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie Hellman exchange requires
random numbers during the key pair generation. Special care has to
be paid when generating random numbers in embedded systems as many
entropy sources available on desktop operating systems or mobile
devices might be missing, as described in [Heninger]. Consequently,
if not enough time is given during system start time to fill the
entropy pool then the output might be predictable and repeatable, for
example leading to the same keys generated again and again.
Guidelines and requirements for random number generation can be found
in RFC 4086 [RFC4086].
We would also like to point out that designing a software update We would also like to point out that designing a software update
mechanism into an IoT system is crucial to ensure that both mechanism into an IoT system is crucial to ensure that both
functionality can be enhanced and that potential vulnerabilities can functionality can be enhanced and that potential vulnerabilities can
be fixed. This software update mechanism is also useful for changing be fixed. This software update mechanism is also useful for changing
configuration information, for example, trust anchors and other configuration information, for example, trust anchors and other
keying related information. keying related information.
16. IANA Considerations 22. IANA Considerations
This document includes no request to IANA. This document includes no request to IANA.
17. Acknowledgements 23. Acknowledgements
Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla,
Zach Shelby, and Sean Turner for helpful comments and discussions Russ Housley, Michael Richardson, Zach Shelby, and Sean Turner for
that have shaped the document. their helpful comments and discussions that have shaped the document.
18. References Big thanks also to Klaus Hartke, who wrote the initial version of
this document.
18.1. Normative References 24. References
24.1. Normative References
[EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64)
REGISTRATION AUTHORITY", April 2010, REGISTRATION AUTHORITY", April 2010,
<http://standards.ieee.org/regauth/oui/tutorials/ <http://standards.ieee.org/regauth/oui/tutorials/
EUI64.html>. EUI64.html>.
[I-D.ietf-tls-cached-info] [I-D.ietf-tls-cached-info]
Santesson, S. and H. Tschofenig, "Transport Layer Security Santesson, S. and H. Tschofenig, "Transport Layer Security
(TLS) Cached Information Extension", draft-ietf-tls- (TLS) Cached Information Extension", draft-ietf-tls-
cached-info-16 (work in progress), February 2014. cached-info-16 (work in progress), February 2014.
[I-D.ietf-tls-oob-pubkey]
Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and
T. Kivinen, "Using Raw Public Keys in Transport Layer
Security (TLS) and Datagram Transport Layer Security
(DTLS)", draft-ietf-tls-oob-pubkey-11 (work in progress),
January 2014.
[I-D.mcgrew-tls-aes-ccm-ecc]
McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES-
CCM ECC Cipher Suites for TLS", draft-mcgrew-tls-aes-ccm-
ecc-08 (work in progress), February 2014.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites
for Transport Layer Security (TLS)", RFC 4279, December for Transport Layer Security (TLS)", RFC 4279, December
2005. 2005.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008. (TLS) Protocol Version 1.2", RFC 5246, August 2008.
skipping to change at page 18, line 12 skipping to change at page 21, line 21
(PKIX) Certificates in the Context of Transport Layer (PKIX) Certificates in the Context of Transport Layer
Security (TLS)", RFC 6125, March 2011. Security (TLS)", RFC 6125, March 2011.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security Version 1.2", RFC 6347, January 2012. Security Version 1.2", RFC 6347, January 2012.
[RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport
Layer Security (TLS) and Datagram Transport Layer Security Layer Security (TLS) and Datagram Transport Layer Security
(DTLS) Heartbeat Extension", RFC 6520, February 2012. (DTLS) Heartbeat Extension", RFC 6520, February 2012.
18.2. Informative References [RFC7250] Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and
T. Kivinen, "Using Raw Public Keys in Transport Layer
Security (TLS) and Datagram Transport Layer Security
(DTLS)", RFC 7250, June 2014.
[RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES-
CCM Elliptic Curve Cryptography (ECC) Cipher Suites for
TLS", RFC 7251, June 2014.
24.2. Informative References
[Heninger] [Heninger]
Heninger, N., Durumeric, Z., Wustrow, E., and A. Heninger, N., Durumeric, Z., Wustrow, E., and A.
Halderman, "Mining Your Ps and Qs: Detection of Widespread Halderman, "Mining Your Ps and Qs: Detection of Widespread
Weak Keys in Network Devices", 21st USENIX Security Weak Keys in Network Devices", 21st USENIX Security
Symposium, https://www.usenix.org/conference/ Symposium,
usenixsecurity12/technical-sessions/presentation/heninger, https://www.usenix.org/conference/usenixsecurity12/
2012. technical-sessions/presentation/heninger, 2012.
[I-D.bmoeller-tls-downgrade-scsv] [I-D.bmoeller-tls-downgrade-scsv]
Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher
Suite Value (SCSV) for Preventing Protocol Downgrade Suite Value (SCSV) for Preventing Protocol Downgrade
Attacks", draft-bmoeller-tls-downgrade-scsv-01 (work in Attacks", draft-bmoeller-tls-downgrade-scsv-02 (work in
progress), November 2013. progress), May 2014.
[I-D.campagna-suitee]
Campagna, M., "A Cryptographic Suite for Embedded Systems
(SuiteE)", draft-campagna-suitee-04 (work in progress),
October 2012.
[I-D.cooper-ietf-privacy-requirements] [I-D.cooper-ietf-privacy-requirements]
Cooper, A., Farrell, S., and S. Turner, "Privacy Cooper, A., Farrell, S., and S. Turner, "Privacy
Requirements for IETF Protocols", draft-cooper-ietf- Requirements for IETF Protocols", draft-cooper-ietf-
privacy-requirements-01 (work in progress), October 2013. privacy-requirements-01 (work in progress), October 2013.
[I-D.greevenbosch-tls-ocsp-lite]
Greevenbosch, B., "OCSP-lite - Revocation of raw public
keys", draft-greevenbosch-tls-ocsp-lite-01 (work in
progress), June 2013.
[I-D.gutmann-tls-encrypt-then-mac]
Gutmann, P., "Encrypt-then-MAC for TLS and DTLS", draft-
gutmann-tls-encrypt-then-mac-05 (work in progress),
December 2013.
[I-D.hummen-dtls-extended-session-resumption]
Hummen, R., Gilger, J., and H. Shafagh, "Extended DTLS
Session Resumption for Constrained Network Environments",
draft-hummen-dtls-extended-session-resumption-01 (work in
progress), October 2013.
[I-D.ietf-core-coap]
Shelby, Z., Hartke, K., and C. Bormann, "Constrained
Application Protocol (CoAP)", draft-ietf-core-coap-18
(work in progress), June 2013.
[I-D.ietf-lwig-guidance]
Bormann, C., "Guidance for Light-Weight Implementations of
the Internet Protocol Suite", draft-ietf-lwig-guidance-03
(work in progress), February 2013.
[I-D.ietf-lwig-terminology]
Bormann, C., Ersue, M., and A. Keranen, "Terminology for
Constrained Node Networks", draft-ietf-lwig-terminology-07
(work in progress), February 2014.
[I-D.ietf-lwig-tls-minimal] [I-D.ietf-lwig-tls-minimal]
Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's
Guide to the (Datagram) Transport Layer Security Protocol Guide to the (Datagram) Transport Layer Security Protocol
for Smart Objects and Constrained Node Networks", draft- for Smart Objects and Constrained Node Networks", draft-
ietf-lwig-tls-minimal-01 (work in progress), March 2014. ietf-lwig-tls-minimal-01 (work in progress), March 2014.
[I-D.ietf-tls-applayerprotoneg] [I-D.ietf-uta-tls-bcp]
Friedl, S., Popov, A., Langley, A., and S. Emile,
"Transport Layer Security (TLS) Application Layer Protocol
Negotiation Extension", draft-ietf-tls-applayerprotoneg-05
(work in progress), March 2014.
[I-D.pettersen-tls-version-rollback-removal]
Pettersen, Y., "Managing and removing automatic version
rollback in TLS Clients", draft-pettersen-tls-version-
rollback-removal-03 (work in progress), February 2014.
[I-D.sheffer-tls-bcp]
Sheffer, Y., Holz, R., and P. Saint-Andre, Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of TLS and DTLS", draft- "Recommendations for Secure Use of TLS and DTLS", draft-
sheffer-tls-bcp-02 (work in progress), February 2014. ietf-uta-tls-bcp-01 (work in progress), June 2014.
[I-D.schmertmann-dice-ccm-psk-pfs]
Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher
Suites with Forward Secrecy for Transport Layer Security
(TLS)", draft-schmertmann-dice-ccm-psk-pfs-00 (work in
progress), February 2014.
[IANA-TLS] [IANA-TLS]
IANA, "TLS Cipher Suite Registry", http://www.iana.org/ IANA, "TLS Cipher Suite Registry",
assignments/tls-parameters/ http://www.iana.org/assignments/tls-parameters/
tls-parameters.xhtml#tls-parameters-4, 2014. tls-parameters.xhtml#tls-parameters-4, 2014.
[RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC
Text on Security Considerations", BCP 72, RFC 3552, July Text on Security Considerations", BCP 72, RFC 3552, July
2003. 2003.
[RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness [RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness
Requirements for Security", BCP 106, RFC 4086, June 2005. Requirements for Security", BCP 106, RFC 4086, June 2005.
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
skipping to change at page 20, line 21 skipping to change at page 22, line 50
Server-Side State", RFC 5077, January 2008. Server-Side State", RFC 5077, January 2008.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, January 2008. Encryption", RFC 5116, January 2008.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, May 2008. (CRL) Profile", RFC 5280, May 2008.
[RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA-
SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, 256/384 and AES Galois Counter Mode (GCM)", RFC 5289,
August 2008. August 2008.
[RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor
Management Protocol (TAMP)", RFC 5934, August 2010. Management Protocol (TAMP)", RFC 5934, August 2010.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic
Curve Cryptography Algorithms", RFC 6090, February 2011. Curve Cryptography Algorithms", RFC 6090, February 2011.
[RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for
Transport Layer Security (TLS)", RFC 6655, July 2012. Transport Layer Security (TLS)", RFC 6655, July 2012.
[RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS)
Multiple Certificate Status Request Extension", RFC 6961, Multiple Certificate Status Request Extension", RFC 6961,
June 2013. June 2013.
[RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
Morris, J., Hansen, M., and R. Smith, "Privacy Morris, J., Hansen, M., and R. Smith, "Privacy
Considerations for Internet Protocols", RFC 6973, July Considerations for Internet Protocols", RFC 6973, July
2013. 2013.
Authors' Addresses [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained
Application Protocol (CoAP)", RFC 7252, June 2014.
Klaus Hartke [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
Universitaet Bremen TZI Attack", BCP 188, RFC 7258, May 2014.
Postfach 330440
Bremen D-28359
Germany
Phone: +49-421-218-63905 Author's Address
Email: hartke@tzi.org
Hannes Tschofenig Hannes Tschofenig (editor)
ARM Ltd. ARM Ltd.
110 Fulbourn Rd 110 Fulbourn Rd
Cambridge CB1 9NJ Cambridge CB1 9NJ
Great Britain Great Britain
Email: Hannes.tschofenig@gmx.net Email: Hannes.tschofenig@gmx.net
URI: http://www.tschofenig.priv.at URI: http://www.tschofenig.priv.at
 End of changes. 49 change blocks. 
204 lines changed or deleted 334 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/