| < draft-ietf-dice-profile-01.txt | draft-ietf-dice-profile-02.txt > | |||
|---|---|---|---|---|
| dice K. Hartke | dice H. Tschofenig, Ed. | |||
| Internet-Draft Universitaet Bremen TZI | Internet-Draft ARM Ltd. | |||
| Intended status: Informational H. Tschofenig | Intended status: Standards Track July 4, 2014 | |||
| Expires: November 7, 2014 ARM Ltd. | Expires: January 5, 2015 | |||
| May 6, 2014 | ||||
| A DTLS 1.2 Profile for the Internet of Things | A Datagram Transport Layer Security (DTLS) 1.2 Profile for the Internet | |||
| draft-ietf-dice-profile-01.txt | of Things | |||
| draft-ietf-dice-profile-02.txt | ||||
| Abstract | Abstract | |||
| This document defines a DTLS profile that is suitable for Internet of | This document defines a DTLS profile that is suitable for Internet of | |||
| Things applications and is reasonably implementable on many | Things applications and is reasonably implementable on many | |||
| constrained devices. | constrained devices. | |||
| A common design pattern in IoT deployments is the use of a | ||||
| constrained device (typically providing sensor data) that interacts | ||||
| with the web infrastructure. This document focuses on this | ||||
| particular pattern. | ||||
| Status of This Memo | Status of This Memo | |||
| This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
| provisions of BCP 78 and BCP 79. | provisions of BCP 78 and BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
| working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
| Drafts is at http://datatracker.ietf.org/drafts/current/. | Drafts is at http://datatracker.ietf.org/drafts/current/. | |||
| Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| This Internet-Draft will expire on November 7, 2014. | This Internet-Draft will expire on January 5, 2015. | |||
| Copyright Notice | Copyright Notice | |||
| Copyright (c) 2014 IETF Trust and the persons identified as the | Copyright (c) 2014 IETF Trust and the persons identified as the | |||
| document authors. All rights reserved. | document authors. All rights reserved. | |||
| This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
| Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
| (http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
| publication of this document. Please review these documents | publication of this document. Please review these documents | |||
| carefully, as they describe your rights and restrictions with respect | carefully, as they describe your rights and restrictions with respect | |||
| to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
| include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
| the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
| described in the Simplified BSD License. | described in the Simplified BSD License. | |||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 | |||
| 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 | |||
| 3. The Communication Model . . . . . . . . . . . . . . . . . . . 4 | 3. The Communication Model . . . . . . . . . . . . . . . . . . . 5 | |||
| 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6 | 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6 | |||
| 5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8 | 5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8 | |||
| 6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9 | 6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9 | |||
| 7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11 | 7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11 | |||
| 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 13 | 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 12 | |||
| 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 13 | 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 14 | |||
| 10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14 | 10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14 | |||
| 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14 | 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14 | |||
| 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15 | 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15 | |||
| 13. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 15 | 13. Random Number Generation . . . . . . . . . . . . . . . . . . 16 | |||
| 14. Privacy Considerations . . . . . . . . . . . . . . . . . . . 15 | 14. Client Certificate URLs . . . . . . . . . . . . . . . . . . . 17 | |||
| 15. Security Considerations . . . . . . . . . . . . . . . . . . . 16 | 15. Trusted CA Indication . . . . . . . . . . . . . . . . . . . . 17 | |||
| 16. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16 | 16. Truncated MAC Extension . . . . . . . . . . . . . . . . . . . 18 | |||
| 17. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 16 | 17. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 18 | |||
| 18. References . . . . . . . . . . . . . . . . . . . . . . . . . 17 | 18. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 18 | |||
| 18.1. Normative References . . . . . . . . . . . . . . . . . . 17 | 19. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 18 | |||
| 18.2. Informative References . . . . . . . . . . . . . . . . . 18 | 20. Privacy Considerations . . . . . . . . . . . . . . . . . . . 19 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 | 21. Security Considerations . . . . . . . . . . . . . . . . . . . 19 | |||
| 22. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 20 | ||||
| 23. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 20 | ||||
| 24. References . . . . . . . . . . . . . . . . . . . . . . . . . 20 | ||||
| 24.1. Normative References . . . . . . . . . . . . . . . . . . 20 | ||||
| 24.2. Informative References . . . . . . . . . . . . . . . . . 21 | ||||
| Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 23 | ||||
| 1. Introduction | 1. Introduction | |||
| This document defines a DTLS 1.2 [RFC6347] profile that offers | This document defines a DTLS 1.2 [RFC6347] profile that offers | |||
| communication security for Internet of Things (IoT) applications and | communication security for Internet of Things (IoT) applications and | |||
| is reasonably implementable on many constrained devices. It aims to | is reasonably implementable on many constrained devices. It aims to | |||
| meet the following goals: | meet the following goals: | |||
| o Serve as a one-stop shop for implementers to know which pieces of | o Serves as a one-stop shop for implementers to know which pieces of | |||
| the specification jungle contain relevant details. | the specification jungle contain relevant details. | |||
| o Not alter the DTLS specification. | o Does not alter the DTLS 1.2 specification. | |||
| o Not introduce any new extensions. | o Does not introduce any new extensions. | |||
| o Align with the DTLS security modes of the Constrained Application | o Aligns with the DTLS security modes of the Constrained Application | |||
| Protocol (CoAP) [I-D.ietf-core-coap]. | Protocol (CoAP) [RFC7252]. | |||
| DTLS is used to secure a number of applications run over an | DTLS is used to secure a number of applications run over an | |||
| unreliable datagram transport. CoAP [I-D.ietf-core-coap] is one such | unreliable datagram transport. CoAP [RFC7252] is one such protocol | |||
| protocol and has been designed specifically for use in IoT | and has been designed specifically for use in IoT environments. CoAP | |||
| environments. CoAP can be secured a number of different ways, also | can be secured a number of different ways, also called security | |||
| called security modes. These security modes are as follows, see | modes. These security modes are as follows, see Section 5, | |||
| Section 5, Section 6, Section 7 for additional details: | Section 6, Section 7 for additional details: | |||
| No Security Protection at the Transport Layer: No DTLS is used but | No Security Protection at the Transport Layer: No DTLS is used but | |||
| instead application layer security functionality is assumed. | instead application layer security functionality is assumed. | |||
| Shared Secret-based DTLS Authentication: DTLS supports the use of | Shared Secret-based DTLS Authentication: DTLS supports the use of | |||
| shared secrets [RFC4279]. This mode is useful if the number of | shared secrets [RFC4279]. This mode is useful if the number of | |||
| communication relationships between the IoT device and servers is | communication relationships between the IoT device and servers is | |||
| small and for very constrained devices. Shared secret-based | small and for very constrained devices. Shared secret-based | |||
| authentication mechanisms offer good performance and require a | authentication mechanisms offer good performance and require a | |||
| minimum of data to be exchanged. | minimum of data to be exchanged. | |||
| DTLS Authentication using Asymmetric Cryptography: TLS supports | DTLS Authentication using Asymmetric Cryptography: TLS supports | |||
| client and server authentication using asymmetric cryptography. | client and server authentication using asymmetric cryptography. | |||
| Two approaches for validating these public keys are available. | Two approaches for validating these public keys are available. | |||
| First, [I-D.ietf-tls-oob-pubkey] allows raw public keys to be used | First, [RFC7250] allows raw public keys to be used in TLS without | |||
| in TLS without the overhead of certificates. This approach | the overhead of certificates. This approach requires out-of-band | |||
| requires out-of-band validation of the public key. Second, the | validation of the public key. Second, the use of X.509 | |||
| use of X.509 certificates [RFC5280] with TLS is common on the Web | certificates [RFC5280] with TLS is common on the Web today (at | |||
| today (at least for server-side authentication) and certain IoT | least for server-side authentication) and certain IoT environments | |||
| environments may also re-use those capabilities. Certificates | may also re-use those capabilities. Certificates bind an | |||
| bind an identifier to the public key signed by a certification | identifier to the public key signed by a certification authority | |||
| authority (CA). A trust anchor store has to be provisioned on the | (CA). A trust anchor store has to be provisioned on the device to | |||
| device to indicate what CAs are trusted. Furthermore, the | indicate what CAs are trusted. Furthermore, the certificate may | |||
| certificate may contain a wealth of other information used to make | contain a wealth of other information used to make authorization | |||
| authorization decisions. | decisions. | |||
| As described in [I-D.ietf-lwig-tls-minimal], an application designer | As described in [I-D.ietf-lwig-tls-minimal], an application designer | |||
| developing an IoT device needs to consider the security threats and | developing an IoT device needs to consider the security threats and | |||
| the security services that can be used to mitigate the threats. | the security services that can be used to mitigate the threats. | |||
| Enabling devices to upload data and retrieve configuration | Enabling devices to upload data and retrieve configuration | |||
| information, inevitably requires that Internet-connected devices be | information, inevitably requires that Internet-connected devices be | |||
| able to authenticate themselves to servers and vice versa as well as | able to authenticate themselves to servers and vice versa as well as | |||
| to ensure that the data and information exchanged is integrity and | to ensure that the data and information exchanged is integrity and | |||
| confidentiality protected. While these security services can be | confidentiality protected. While these security services can be | |||
| provided at different layers in the protocol stack the use of | provided at different layers in the protocol stack the use of | |||
| skipping to change at page 7, line 7 ¶ | skipping to change at page 7, line 7 ¶ | |||
| following information: | following information: | |||
| o Authentication and Key Exchange Algorithm (e.g., PSK) | o Authentication and Key Exchange Algorithm (e.g., PSK) | |||
| o Cipher and Key Length (e.g., AES with 128 bit keys) | o Cipher and Key Length (e.g., AES with 128 bit keys) | |||
| o Mode of operation (e.g., CBC) | o Mode of operation (e.g., CBC) | |||
| o Hash Algorithm for Integrity Protection (e.g., SHA in combination | o Hash Algorithm for Integrity Protection (e.g., SHA in combination | |||
| with HMAC) | with HMAC) | |||
| o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC | o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC | |||
| with the SHA-256) | with the SHA-256) | |||
| o Misc information (e.g., length of authentication tags) | o Misc information (e.g., length of authentication tags) | |||
| o Information whether the ciphersuite is suitable for DTLS or only | o Information whether the ciphersuite is suitable for DTLS or only | |||
| for TLS | for TLS | |||
| The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a | The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a | |||
| pre-shared authentication and key exchange algorithm. RFC 6655 | pre-shared authentication and key exchange algorithm. RFC 6655 | |||
| [RFC6655] defines this ciphersuite. It uses the Advanced Encryption | [RFC6655] defines this ciphersuite. It uses the Advanced Encryption | |||
| skipping to change at page 9, line 37 ¶ | skipping to change at page 9, line 37 ¶ | |||
| support arbitrary PSK identities up to 128 octets in length, and | support arbitrary PSK identities up to 128 octets in length, and | |||
| arbitrary PSKs up to 64 octets in length. This is a useful | arbitrary PSKs up to 64 octets in length. This is a useful | |||
| assumption for TLS stacks used in the desktop and mobile environment | assumption for TLS stacks used in the desktop and mobile environment | |||
| where management interfaces are used to provision identities and | where management interfaces are used to provision identities and | |||
| keys. For the IoT environment, however, many devices are not | keys. For the IoT environment, however, many devices are not | |||
| equipped with displays and input devices (e.g., keyboards). Hence, | equipped with displays and input devices (e.g., keyboards). Hence, | |||
| keys are distributed as part of hardware modules or are embedded into | keys are distributed as part of hardware modules or are embedded into | |||
| the firmware. As such, these restrictions are not applicable to this | the firmware. As such, these restrictions are not applicable to this | |||
| profile. | profile. | |||
| Constrained Application Protocol (CoAP) [I-D.ietf-core-coap] | Constrained Application Protocol (CoAP) [RFC7252] currently specifies | |||
| currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to | TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite | |||
| implement ciphersuite for use with shared secrets. This ciphersuite | for use with shared secrets. This ciphersuite uses the AES algorithm | |||
| uses the AES algorithm with 128 bit keys and CCM as the mode of | with 128 bit keys and CCM as the mode of operation. The label "_8" | |||
| operation. The label "_8" indicates that an 8-octet authentication | indicates that an 8-octet authentication tag is used. This | |||
| tag is used. This ciphersuite makes use of the default TLS 1.2 | ciphersuite makes use of the default TLS 1.2 Pseudorandom Function | |||
| Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash | (PRF), which uses HMAC with the SHA-256 hash function. | |||
| function. | ||||
| 6. Raw Public Key Use with DTLS | 6. Raw Public Key Use with DTLS | |||
| The use of raw public keys with DTLS, as defined in | The use of raw public keys with DTLS, as defined in [RFC7250], is the | |||
| [I-D.ietf-tls-oob-pubkey], is the first entry point into public key | first entry point into public key cryptography without having to pay | |||
| cryptography without having to pay the price of certificates and a | the price of certificates and a PKI. The specification re-uses the | |||
| PKI. The specification re-uses the existing Certificate message to | existing Certificate message to convey the raw public key encoded in | |||
| convey the raw public key encoded in the SubjectPublicKeyInfo | the SubjectPublicKeyInfo structure. To indicate support two new TLS | |||
| structure. To indicate support two new TLS extensions had been | extensions had been defined, as shown in Figure 3, namely the | |||
| defined, as shown in Figure 3, namely the server_certificate_type and | server_certificate_type and the client_certificate_type. To operate | |||
| the client_certificate_type. To operate this mechanism securely it | this mechanism securely it is necessary to authenticate and authorize | |||
| is necessary to authenticate and authorize the public keys out-of- | the public keys out-of-band. This document therefore assumes that a | |||
| band. This document therefore assumes that a client implementation | client implementation comes with one or multiple raw public keys of | |||
| comes with one or multiple raw public keys of servers, it has to | servers, it has to communicate with, pre-provisioned. Additionally, | |||
| communicate with, pre-provisioned. Additionally, a device will have | a device will have its own raw public key. To replace, delete, or | |||
| its own raw public key. To replace, delete, or add raw public key to | add raw public key to this list requires a software update, for | |||
| this list requires a software update, for example using a firmware | example using a firmware update mechanism. | |||
| update mechanism. | ||||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| ClientHello --------> | ClientHello --------> | |||
| client_certificate_type | client_certificate_type | |||
| server_certificate_type | server_certificate_type | |||
| <------- HelloVerifyRequest | <------- HelloVerifyRequest | |||
| skipping to change at page 10, line 49 ¶ | skipping to change at page 10, line 47 ¶ | |||
| CertificateVerify | CertificateVerify | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. | Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. | |||
| The CoAP recommended ciphersuite for use with this credential type is | The CoAP recommended ciphersuite for use with this credential type is | |||
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [I-D.mcgrew-tls-aes-ccm-ecc]. | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve | |||
| cryptography (ECC) based AES-CCM TLS ciphersuite uses the Elliptic | ||||
| This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite | Curve Diffie Hellman (ECDHE) as the key establishment mechanism and | |||
| uses the Elliptic Curve Diffie Hellman (ECDHE) as the key | an Elliptic Curve Digital Signature Algorithm (ECDSA) for | |||
| establishment mechanism and an Elliptic Curve Digital Signature | authentication. This ciphersuite make use of the AEAD capability in | |||
| Algorithm (ECDSA) for authentication. This ciphersuite make use of | DTLS 1.2 and utilizes an eight-octet authentication tag. Based on | |||
| the AEAD capability in DTLS 1.2 and utilizes an eight-octet | the Diffie-Hellman it provides perfect forward secrecy (PFS). More | |||
| authentication tag. Based on the Diffie-Hellman it provides perfect | details about the PFS can be found in Section 11. | |||
| forward secrecy (PFS). More details about the PFS can be found in | ||||
| Section 11. | ||||
| RFC 6090 [RFC6090] provides valuable information for implementing | RFC 6090 [RFC6090] provides valuable information for implementing | |||
| Elliptic Curve Cryptography algorithms. | Elliptic Curve Cryptography algorithms. | |||
| Since many IoT devices will either have limited ways to log error or | Since many IoT devices will either have limited ways to log error or | |||
| no ability at all, any error will lead to implementations attempting | no ability at all, any error will lead to implementations attempting | |||
| to re-try the exchange. | to re-try the exchange. | |||
| 7. Certificate Use with DTLS | 7. Certificate Use with DTLS | |||
| skipping to change at page 11, line 41 ¶ | skipping to change at page 11, line 37 ¶ | |||
| certificate authority is omitted from the chain. Client | certificate authority is omitted from the chain. Client | |||
| implementations MUST be provisioned with a trust anchor store that | implementations MUST be provisioned with a trust anchor store that | |||
| contains the root certificates. The use of the Trust Anchor | contains the root certificates. The use of the Trust Anchor | |||
| Management Protocol (TAMP) [RFC5934] is, however, not envisioned. | Management Protocol (TAMP) [RFC5934] is, however, not envisioned. | |||
| Instead IoT devices using this profile MUST rely a software update | Instead IoT devices using this profile MUST rely a software update | |||
| mechanism to provision these trust anchors. | mechanism to provision these trust anchors. | |||
| When DTLS is used to secure CoAP messages then the server provided | When DTLS is used to secure CoAP messages then the server provided | |||
| certificates MUST contain the fully qualified DNS domain name or | certificates MUST contain the fully qualified DNS domain name or | |||
| "FQDN". The coaps URI scheme is described in Section 6.2 of | "FQDN". The coaps URI scheme is described in Section 6.2 of | |||
| [I-D.ietf-core-coap]. This FQDN is stored in the SubjectAltName or | [RFC7252]. This FQDN is stored in the SubjectAltName or in the CN, | |||
| in the CN, as explained in Section 9.1.3.3 of [I-D.ietf-core-coap], | as explained in Section 9.1.3.3 of [RFC7252], and used by the client | |||
| and used by the client to match it against the FQDN used during the | to match it against the FQDN used during the look-up process, as | |||
| look-up process, as described in RFC 6125 [RFC6125]. For the profile | described in RFC 6125 [RFC6125]. For the profile in this | |||
| in this specification does not assume dynamic discovery of local | specification does not assume dynamic discovery of local servers. | |||
| servers. | ||||
| For client certificates the identifier used in the SubjectAltName or | For client certificates the identifier used in the SubjectAltName or | |||
| in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 | in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 | |||
| of [I-D.ietf-core-coap]. | of [RFC7252]. | |||
| For certificate revocation neither the Online Certificate Status | For certificate revocation neither the Online Certificate Status | |||
| Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. | Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. | |||
| Instead, this profile relies on a software update mechanism. While | Instead, this profile relies on a software update mechanism. While | |||
| multiple OCSP stapling [RFC6961] has recently been introduced as a | multiple OCSP stapling [RFC6961] has recently been introduced as a | |||
| mechanism to piggyback OCSP request/responses inside the DTLS/TLS | mechanism to piggyback OCSP request/responses inside the DTLS/TLS | |||
| handshake to avoid the cost of a separate protocol handshake further | handshake to avoid the cost of a separate protocol handshake further | |||
| investigations are needed to determine its suitability for the IoT | investigations are needed to determine its suitability for the IoT | |||
| environment. | environment. | |||
| skipping to change at page 12, line 44 ¶ | skipping to change at page 12, line 38 ¶ | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| Figure 4: DTLS Mutual Certificate-based Authentication. | Figure 4: DTLS Mutual Certificate-based Authentication. | |||
| Regarding the ciphersuite choice the discussion in Section 6 applies. | Regarding the ciphersuite choice the discussion in Section 6 applies. | |||
| Further details about X.509 certificates can be found in | Further details about X.509 certificates can be found in | |||
| Section 9.1.3.3 of [I-D.ietf-core-coap]. | Section 9.1.3.3 of [RFC7252]. | |||
| QUESTION: What restrictions regarding the depth of the certificate | QUESTION: What restrictions regarding the depth of the certificate | |||
| chain should be made? Is one level enough? | chain should be made? Is one level enough? | |||
| 8. Error Handling | 8. Error Handling | |||
| DTLS uses the Alert protocol to convey error messages and specifies a | DTLS uses the Alert protocol to convey error messages and specifies a | |||
| longer list of errors. However, not all error messages defined in | longer list of errors. However, not all error messages defined in | |||
| the TLS specification are applicable to this profile. All error | the TLS specification are applicable to this profile. All error | |||
| messages marked as RESERVED are only supported for backwards | messages marked as RESERVED are only supported for backwards | |||
| compatibility with SSL and are therefore not applicable to this | compatibility with SSL and are therefore not applicable to this | |||
| profile. Those include decryption_failed_RESERVED, | profile. Those include decryption_failed_RESERVED, | |||
| no_certificate_RESERVE, and export_restriction_RESERVED. A number of | no_certificate_RESERVE, and export_restriction_RESERVED. | |||
| the error messages are applicable only for certificate-based | ||||
| authentication ciphersuites. Hence, for PSK and raw public key use | A number of the error messages are applicable only for certificate- | |||
| the following error messages are not applicable: bad_certificate, | based authentication ciphersuites. Hence, for PSK and raw public key | |||
| unsupported_certificate, certificate_revoked, certificate_expired, | use the following error messages are not applicable: | |||
| certificate_unknown, unknown_ca, and access_denied. | ||||
| o bad_certificate, | ||||
| o unsupported_certificate, | ||||
| o certificate_revoked, | ||||
| o certificate_expired, | ||||
| o certificate_unknown, | ||||
| o unknown_ca, and | ||||
| o access_denied. | ||||
| Since this profile does not make use of compression at the TLS layer | Since this profile does not make use of compression at the TLS layer | |||
| the decompression_failure error message is not applicable either. | the decompression_failure error message is not applicable either. | |||
| RFC 4279 introduced a new alert message unknown_psk_identity for PSK | RFC 4279 introduced a new alert message unknown_psk_identity for PSK | |||
| ciphersuites. As stated in Section 2 of RFC 4279 the | ciphersuites. As stated in Section 2 of RFC 4279 the | |||
| decryption_error error message may also be used instead. For this | decryption_error error message may also be used instead. For this | |||
| profile the TLS server MUST return the decryption_error error message | profile the TLS server MUST return the decryption_error error message | |||
| instead of the unknown_psk_identity. | instead of the unknown_psk_identity. | |||
| skipping to change at page 14, line 29 ¶ | skipping to change at page 14, line 38 ¶ | |||
| of the handshake (in terms of reduced number of message exchanges, | of the handshake (in terms of reduced number of message exchanges, | |||
| lower computational overhead, and less bandwidth conserved). | lower computational overhead, and less bandwidth conserved). | |||
| Since the communication model described in Section 3 does not assume | Since the communication model described in Section 3 does not assume | |||
| that the server is constrained. RFC 5077 [RFC5077] describing TLS | that the server is constrained. RFC 5077 [RFC5077] describing TLS | |||
| session resumption without server-side state is not utilized by this | session resumption without server-side state is not utilized by this | |||
| profile. | profile. | |||
| 10. TLS Compression | 10. TLS Compression | |||
| [I-D.sheffer-tls-bcp] recommends to always disable DTLS-level | [I-D.ietf-uta-tls-bcp] recommends to always disable DTLS-level | |||
| compression due to attacks. For IoT applications compression at the | compression due to attacks. For IoT applications compression at the | |||
| DTLS is not needed since application layer protocols are highly | DTLS is not needed since application layer protocols are highly | |||
| optimized and the compression algorithms at the DTLS layer increase | optimized and the compression algorithms at the DTLS layer increase | |||
| code size and complexity. Hence, for use with this profile | code size and complexity. | |||
| compression at the DTLS layer SHOULD NOT be implemented by the DTLS | ||||
| client. | This DTLS client profile does not include DTLS layer compression. | |||
| 11. Perfect Forward Secrecy | 11. Perfect Forward Secrecy | |||
| Perfect forward secrecy is designed to prevent the compromise of a | Perfect forward secrecy (PFS) is designed to prevent the compromise | |||
| long-term secret key from affecting the confidentiality of past | of a long-term secret key from affecting the confidentiality of past | |||
| conversations. The PSK ciphersuite recommended in the CoAP | conversations. The PSK ciphersuite recommended in the CoAP | |||
| specification [I-D.ietf-core-coap] does not offer this property. | specification [RFC7252] does not offer this property since it does | |||
| [I-D.sheffer-tls-bcp] on the other hand recommends using ciphersuites | not utilize a Diffie-Hellman exchange. [I-D.ietf-uta-tls-bcp] on the | |||
| offering this security property. | other hand recommends using ciphersuites offering this security | |||
| property and so do the public key-based ciphersuites recommended by | ||||
| the CoAP specification. | ||||
| QUESTION: Should the PSK ciphersuite offer PFS? | The use of PFS is certainly a tradeoff decision since on one hand the | |||
| compromise of long-term secrets of embedded devices is more likely | ||||
| than with many other Internet hosts but on the other hand a Diffie- | ||||
| Hellman exchange requires emphemeral key pairs to be generated, which | ||||
| can be demanding from a performance point of view. Finally, the | ||||
| impact of the disclosure of past conversations and the desire to | ||||
| increase the cost for pervasive monitoring (see [RFC7258]) has to be | ||||
| taken into account. | ||||
| Our recommendation is to stick with the ciphersuite suggested in the | ||||
| CoAP specification. New ciphersuites support PFS for pre-shared | ||||
| secret-based authentication, such as | ||||
| [I-D.schmertmann-dice-ccm-psk-pfs], and might be available as a | ||||
| standardized ciphersuite in the future. | ||||
| 12. Keep-Alive | 12. Keep-Alive | |||
| RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the | RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the | |||
| other peer is still alive. The same mechanism can also be used to | other peer is still alive. The same mechanism can also be used to | |||
| perform path MTU discovery. | perform Path Maximum Transmission Unit (MTU) Discovery. | |||
| QUESTION: Do IoT deployments make use of this extension? | A recommendation about the use of RFC 6520 depends on the type of | |||
| message exchange an IoT device performs. There are three types of | ||||
| exchanges that need to be analysed: | ||||
| 13. Negotiation and Downgrading Attacks | Client-Initiated, One-Shot Messages | |||
| This is a common communication pattern where IoT devices upload | ||||
| data to a server on the Internet on an irregular basis. The | ||||
| communcation may be triggered by specific events, such as opening | ||||
| a door. | ||||
| Since the upload happens on an irregular and unpredicable basis | ||||
| and due to renumbering and Network Address Translation (NAT) a new | ||||
| DTLS session or DTLS session resumption can be used. | ||||
| In this case there is no use for a keep-alive extension for this | ||||
| scenario. | ||||
| Client-Initiated, Regular Data Uploads | ||||
| This is a variation of the previous case whereby data gets | ||||
| uploaded on a regular basis, for example, based on frequent | ||||
| temperature readings. With such regular exchange it can be | ||||
| assumed that the DTLS context is still in kept at the IoT device. | ||||
| If neither NAT bindings nor IP address changes occurred then the | ||||
| DTLS record layer will not notice any changes. For the case where | ||||
| IP and port changes happened it is necessary to re-create the DTLS | ||||
| record layer using session resumption. | ||||
| In this scenario there is no use for a keep-alive extension. It | ||||
| is also very likely that the device will enter a sleep cycle in | ||||
| between data transmissions to keep power consumption low. | ||||
| Server-Initiated Messages | ||||
| In the two previous scenarios the client initiated the protocol | ||||
| interaction. In this case, we consider server-initiated messages. | ||||
| Since messages to the client may get blocked by intermediaries, | ||||
| such as NATs and stateful packet filtering firewalls, the initial | ||||
| connection setup is triggered by the client and then kept alive. | ||||
| Since state expires fairly quickly at middleboxes regular | ||||
| heartbeats are necessary whereby these keep-alive messages may be | ||||
| exchanged at the application layer or within DTLS itself. | ||||
| For this message exchange pattern the use of DTLS heartbeat | ||||
| messages is quite useful. The MTU discovery mechanism, on the | ||||
| other hand, is less likely to be relevant since for many IoT | ||||
| deployments the must constrained link is the wireless interface at | ||||
| the IoT device itself rather than somewhere in the network. Only | ||||
| in more complex network topologies the situation might be | ||||
| different. | ||||
| For server-initiated messages the heartbeat extension can be | ||||
| recommended. | ||||
| 13. Random Number Generation | ||||
| The DTLS protocol requires random numbers to be available during the | ||||
| protocol run. For example, during the ClientHello and the | ||||
| ServerHello exchange the client and the server exchange random | ||||
| numbers. Also, the use of the Diffie Hellman exchange requires | ||||
| random numbers during the key pair generation. Special care has to | ||||
| be paid when generating random numbers in embedded systems as many | ||||
| entropy sources available on desktop operating systems or mobile | ||||
| devices might be missing, as described in [Heninger]. Consequently, | ||||
| if not enough time is given during system start time to fill the | ||||
| entropy pool then the output might be predictable and repeatable, for | ||||
| example leading to the same keys generated again and again. | ||||
| Recommendation: IoT devices using DTLS MUST offer ways to generate | ||||
| quality random numbers. Guidelines and requirements for random | ||||
| number generation can be found in RFC 4086 [RFC4086]. | ||||
| It is important to note that sources contributing to the randomness | ||||
| pool on laptops, or desktop pcs are not available on many IoT device, | ||||
| such as mouse movement, timing of keystrokes, air turbulence on the | ||||
| movement of hard drive heads, etc. Other sources have to be found or | ||||
| dedicated hardware has to be added. | ||||
| 14. Client Certificate URLs | ||||
| This RFC 6066 [RFC6066] extension allows to avoid sending client-side | ||||
| certificates and URLs instead. This reduces the over-the-air | ||||
| transmission. | ||||
| This is certainly a useful extension when a certificate-based mode | ||||
| for DTLS is used since the TLS cached info extension does not provide | ||||
| any help with caching information on the server side. | ||||
| Recommendation: Add support for client certificate URLs for those | ||||
| environments where client-side certificates are used. | ||||
| 15. Trusted CA Indication | ||||
| This RFC 6066 extension allows clients to indicate what trust anchor | ||||
| they support. With certificate-based authentication a DTLS server | ||||
| conveys its end entity certificate to the client during the DTLS | ||||
| exchange provides. Since the server does not necessarily know what | ||||
| trust anchors the client has stored it includes intermediate CA certs | ||||
| in the certificate payload as well to facilitate with certification | ||||
| path construction and path validation. | ||||
| Today, in most IoT deployments there is a fairly static relationship | ||||
| between the IoT device (and the software running on them) and the | ||||
| server- side infrastructure and no such dynamic indication of trust | ||||
| anchors is needed. | ||||
| Recommendation: For IoT deployments where clients talk to a fixed, | ||||
| pre-configured set of servers and where a software update mechanism | ||||
| is available this extension is not recommended. Environments where | ||||
| the client needs to interact with dynamically discovered DTLS servers | ||||
| this extension may be useful to reduce the communication overhead. | ||||
| Note, however, in that case the TLS cached info extension may help to | ||||
| reduce the communication overhead for everything but the first | ||||
| protocol interaction. | ||||
| 16. Truncated MAC Extension | ||||
| This RFC 6066 extension was introduced to reduces the size of the MAC | ||||
| used at the Record Layer. This extension was developed for TLS | ||||
| ciphersuites that used older modes of operation where the MAC and the | ||||
| encryption operation was performed independently. | ||||
| For CoAP, however, the recommended ciphersuites use the newer | ||||
| Authenticated Encryption with Associated Data (AEAD) construct, | ||||
| namely the CBC-MAC mode (CCM) with eight-octet authentication tags. | ||||
| Recommendation: Since this profile only supports AEAD ciphersuites | ||||
| this extension is not applicable. | ||||
| 17. Server Name Indication (SNI) | ||||
| This RFC 6066 extension defines a mechanism for a client to tell a | ||||
| TLS server the name of the server it wants to contact. This is a | ||||
| useful extension for many hosting environments where multiple virtual | ||||
| servers are run on single IP address. | ||||
| Recommendation: Unless it is known that a DTLS client does not | ||||
| interact with a server in a hosting environment that requires such an | ||||
| extension we advice to offer support for the SNI extension in this | ||||
| profile. | ||||
| 18. Maximum Fragment Length Negotiation | ||||
| This RFC 6066 extension lowers the maximum fragment length support | ||||
| needed for the Record Layer from 2^14 bytes to 2^9 bytes. | ||||
| This is a very useful extension that allows the client to indicate to | ||||
| the server how much maximum memory buffers it uses for incoming | ||||
| messages. Ultimately, the main benefit of this extension is it to | ||||
| allows client implementations to lower their RAM requirements since | ||||
| the client does not need to accept packets of large size (such as 16k | ||||
| packets as required by plain TLS/DTLS). | ||||
| Recommendation: Client implementations must support this extension. | ||||
| 19. Negotiation and Downgrading Attacks | ||||
| CoAP demands version 1.2 of DTLS to be used and the earlier version | CoAP demands version 1.2 of DTLS to be used and the earlier version | |||
| of DTLS is not supported. As such, there is no risk of downgrading | of DTLS is not supported. As such, there is no risk of downgrading | |||
| to an older version of DTLS. The work described in | to an older version of DTLS. The work described in | |||
| [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to | [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to | |||
| this environment since there is no legacy server infrastructure to | this environment since there is no legacy server infrastructure to | |||
| worry about. | worry about. | |||
| QUESTION: Should we say something for non-CoAP use of DTLS? | QUESTION: Should we say something for non-CoAP use of DTLS? | |||
| To prevent the TLS renegotiation attack [RFC5746] clients MUST | To prevent the TLS renegotiation attack [RFC5746] clients MUST | |||
| respond to server-initiated renegotiation attempts with an Alert | respond to server-initiated renegotiation attempts with an Alert | |||
| message (no_renegotiation) and clients MUST NOT initiate them. TLS | message (no_renegotiation) and clients MUST NOT initiate them. TLS | |||
| and DTLS allows a client and a server who already have a TLS | and DTLS allows a client and a server who already have a TLS | |||
| connection to negotiate new parameters, generate new keys, etc by | connection to negotiate new parameters, generate new keys, etc by | |||
| initiating a TLS handshake using a ClientHello message. | initiating a TLS handshake using a ClientHello message. | |||
| Renegotiation happens in the existing TLS connection, with the new | Renegotiation happens in the existing TLS connection, with the new | |||
| handshake packets being encrypted along with application data. | handshake packets being encrypted along with application data. | |||
| 14. Privacy Considerations | 20. Privacy Considerations | |||
| The DTLS handshake exchange conveys various identifiers, which can be | The DTLS handshake exchange conveys various identifiers, which can be | |||
| observed by an on-path eavesdropper. For example, the DTLS PSK | observed by an on-path eavesdropper. For example, the DTLS PSK | |||
| exchange reveals the PSK identity, the supported extensions, the | exchange reveals the PSK identity, the supported extensions, the | |||
| session id, algorithm parameters, etc. When session resumption is | session id, algorithm parameters, etc. When session resumption is | |||
| used then individual TLS sessions can be correlated by an on-path | used then individual TLS sessions can be correlated by an on-path | |||
| adversary. With many IoT deployments it is likely that keying | adversary. With many IoT deployments it is likely that keying | |||
| material and their identifiers are persistent over a longer period of | material and their identifiers are persistent over a longer period of | |||
| time due to the cost of updating software on these devices. | time due to the cost of updating software on these devices. | |||
| skipping to change at page 16, line 16 ¶ | skipping to change at page 19, line 48 ¶ | |||
| with other data to be truly useful and this extra data might include | with other data to be truly useful and this extra data might include | |||
| personal data about the owner of the device or data about the | personal data about the owner of the device or data about the | |||
| environment it senses. Consequently, the data stored on the server- | environment it senses. Consequently, the data stored on the server- | |||
| side will be vulnerable to stored data compromise. For the | side will be vulnerable to stored data compromise. For the | |||
| communication between the client and the server this specification | communication between the client and the server this specification | |||
| prevents eavesdroppers to gain access to the communication content. | prevents eavesdroppers to gain access to the communication content. | |||
| While the PSK-based ciphersuite does not provide PFS the asymmetric | While the PSK-based ciphersuite does not provide PFS the asymmetric | |||
| version does. No explicit techniques, such as extra padding, have | version does. No explicit techniques, such as extra padding, have | |||
| been provided to make traffic analysis more difficult. | been provided to make traffic analysis more difficult. | |||
| 15. Security Considerations | 21. Security Considerations | |||
| This entire document is about security. | This entire document is about security. | |||
| The TLS protocol requires random numbers to be available during the | ||||
| protocol run. For example, during the ClientHello and the | ||||
| ServerHello exchange the client and the server exchange random | ||||
| numbers. Also, the use of the Diffie Hellman exchange requires | ||||
| random numbers during the key pair generation. Special care has to | ||||
| be paid when generating random numbers in embedded systems as many | ||||
| entropy sources available on desktop operating systems or mobile | ||||
| devices might be missing, as described in [Heninger]. Consequently, | ||||
| if not enough time is given during system start time to fill the | ||||
| entropy pool then the output might be predictable and repeatable, for | ||||
| example leading to the same keys generated again and again. | ||||
| Guidelines and requirements for random number generation can be found | ||||
| in RFC 4086 [RFC4086]. | ||||
| We would also like to point out that designing a software update | We would also like to point out that designing a software update | |||
| mechanism into an IoT system is crucial to ensure that both | mechanism into an IoT system is crucial to ensure that both | |||
| functionality can be enhanced and that potential vulnerabilities can | functionality can be enhanced and that potential vulnerabilities can | |||
| be fixed. This software update mechanism is also useful for changing | be fixed. This software update mechanism is also useful for changing | |||
| configuration information, for example, trust anchors and other | configuration information, for example, trust anchors and other | |||
| keying related information. | keying related information. | |||
| 16. IANA Considerations | 22. IANA Considerations | |||
| This document includes no request to IANA. | This document includes no request to IANA. | |||
| 17. Acknowledgements | 23. Acknowledgements | |||
| Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, | Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, | |||
| Zach Shelby, and Sean Turner for helpful comments and discussions | Russ Housley, Michael Richardson, Zach Shelby, and Sean Turner for | |||
| that have shaped the document. | their helpful comments and discussions that have shaped the document. | |||
| 18. References | Big thanks also to Klaus Hartke, who wrote the initial version of | |||
| this document. | ||||
| 18.1. Normative References | 24. References | |||
| 24.1. Normative References | ||||
| [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) | [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) | |||
| REGISTRATION AUTHORITY", April 2010, | REGISTRATION AUTHORITY", April 2010, | |||
| <http://standards.ieee.org/regauth/oui/tutorials/ | <http://standards.ieee.org/regauth/oui/tutorials/ | |||
| EUI64.html>. | EUI64.html>. | |||
| [I-D.ietf-tls-cached-info] | [I-D.ietf-tls-cached-info] | |||
| Santesson, S. and H. Tschofenig, "Transport Layer Security | Santesson, S. and H. Tschofenig, "Transport Layer Security | |||
| (TLS) Cached Information Extension", draft-ietf-tls- | (TLS) Cached Information Extension", draft-ietf-tls- | |||
| cached-info-16 (work in progress), February 2014. | cached-info-16 (work in progress), February 2014. | |||
| [I-D.ietf-tls-oob-pubkey] | ||||
| Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and | ||||
| T. Kivinen, "Using Raw Public Keys in Transport Layer | ||||
| Security (TLS) and Datagram Transport Layer Security | ||||
| (DTLS)", draft-ietf-tls-oob-pubkey-11 (work in progress), | ||||
| January 2014. | ||||
| [I-D.mcgrew-tls-aes-ccm-ecc] | ||||
| McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- | ||||
| CCM ECC Cipher Suites for TLS", draft-mcgrew-tls-aes-ccm- | ||||
| ecc-08 (work in progress), February 2014. | ||||
| [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate | |||
| Requirement Levels", BCP 14, RFC 2119, March 1997. | Requirement Levels", BCP 14, RFC 2119, March 1997. | |||
| [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites | [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites | |||
| for Transport Layer Security (TLS)", RFC 4279, December | for Transport Layer Security (TLS)", RFC 4279, December | |||
| 2005. | 2005. | |||
| [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security | [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security | |||
| (TLS) Protocol Version 1.2", RFC 5246, August 2008. | (TLS) Protocol Version 1.2", RFC 5246, August 2008. | |||
| skipping to change at page 18, line 12 ¶ | skipping to change at page 21, line 21 ¶ | |||
| (PKIX) Certificates in the Context of Transport Layer | (PKIX) Certificates in the Context of Transport Layer | |||
| Security (TLS)", RFC 6125, March 2011. | Security (TLS)", RFC 6125, March 2011. | |||
| [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer | [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer | |||
| Security Version 1.2", RFC 6347, January 2012. | Security Version 1.2", RFC 6347, January 2012. | |||
| [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport | [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport | |||
| Layer Security (TLS) and Datagram Transport Layer Security | Layer Security (TLS) and Datagram Transport Layer Security | |||
| (DTLS) Heartbeat Extension", RFC 6520, February 2012. | (DTLS) Heartbeat Extension", RFC 6520, February 2012. | |||
| 18.2. Informative References | [RFC7250] Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and | |||
| T. Kivinen, "Using Raw Public Keys in Transport Layer | ||||
| Security (TLS) and Datagram Transport Layer Security | ||||
| (DTLS)", RFC 7250, June 2014. | ||||
| [RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- | ||||
| CCM Elliptic Curve Cryptography (ECC) Cipher Suites for | ||||
| TLS", RFC 7251, June 2014. | ||||
| 24.2. Informative References | ||||
| [Heninger] | [Heninger] | |||
| Heninger, N., Durumeric, Z., Wustrow, E., and A. | Heninger, N., Durumeric, Z., Wustrow, E., and A. | |||
| Halderman, "Mining Your Ps and Qs: Detection of Widespread | Halderman, "Mining Your Ps and Qs: Detection of Widespread | |||
| Weak Keys in Network Devices", 21st USENIX Security | Weak Keys in Network Devices", 21st USENIX Security | |||
| Symposium, https://www.usenix.org/conference/ | Symposium, | |||
| usenixsecurity12/technical-sessions/presentation/heninger, | https://www.usenix.org/conference/usenixsecurity12/ | |||
| 2012. | technical-sessions/presentation/heninger, 2012. | |||
| [I-D.bmoeller-tls-downgrade-scsv] | [I-D.bmoeller-tls-downgrade-scsv] | |||
| Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher | Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher | |||
| Suite Value (SCSV) for Preventing Protocol Downgrade | Suite Value (SCSV) for Preventing Protocol Downgrade | |||
| Attacks", draft-bmoeller-tls-downgrade-scsv-01 (work in | Attacks", draft-bmoeller-tls-downgrade-scsv-02 (work in | |||
| progress), November 2013. | progress), May 2014. | |||
| [I-D.campagna-suitee] | ||||
| Campagna, M., "A Cryptographic Suite for Embedded Systems | ||||
| (SuiteE)", draft-campagna-suitee-04 (work in progress), | ||||
| October 2012. | ||||
| [I-D.cooper-ietf-privacy-requirements] | [I-D.cooper-ietf-privacy-requirements] | |||
| Cooper, A., Farrell, S., and S. Turner, "Privacy | Cooper, A., Farrell, S., and S. Turner, "Privacy | |||
| Requirements for IETF Protocols", draft-cooper-ietf- | Requirements for IETF Protocols", draft-cooper-ietf- | |||
| privacy-requirements-01 (work in progress), October 2013. | privacy-requirements-01 (work in progress), October 2013. | |||
| [I-D.greevenbosch-tls-ocsp-lite] | ||||
| Greevenbosch, B., "OCSP-lite - Revocation of raw public | ||||
| keys", draft-greevenbosch-tls-ocsp-lite-01 (work in | ||||
| progress), June 2013. | ||||
| [I-D.gutmann-tls-encrypt-then-mac] | ||||
| Gutmann, P., "Encrypt-then-MAC for TLS and DTLS", draft- | ||||
| gutmann-tls-encrypt-then-mac-05 (work in progress), | ||||
| December 2013. | ||||
| [I-D.hummen-dtls-extended-session-resumption] | ||||
| Hummen, R., Gilger, J., and H. Shafagh, "Extended DTLS | ||||
| Session Resumption for Constrained Network Environments", | ||||
| draft-hummen-dtls-extended-session-resumption-01 (work in | ||||
| progress), October 2013. | ||||
| [I-D.ietf-core-coap] | ||||
| Shelby, Z., Hartke, K., and C. Bormann, "Constrained | ||||
| Application Protocol (CoAP)", draft-ietf-core-coap-18 | ||||
| (work in progress), June 2013. | ||||
| [I-D.ietf-lwig-guidance] | ||||
| Bormann, C., "Guidance for Light-Weight Implementations of | ||||
| the Internet Protocol Suite", draft-ietf-lwig-guidance-03 | ||||
| (work in progress), February 2013. | ||||
| [I-D.ietf-lwig-terminology] | ||||
| Bormann, C., Ersue, M., and A. Keranen, "Terminology for | ||||
| Constrained Node Networks", draft-ietf-lwig-terminology-07 | ||||
| (work in progress), February 2014. | ||||
| [I-D.ietf-lwig-tls-minimal] | [I-D.ietf-lwig-tls-minimal] | |||
| Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's | Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's | |||
| Guide to the (Datagram) Transport Layer Security Protocol | Guide to the (Datagram) Transport Layer Security Protocol | |||
| for Smart Objects and Constrained Node Networks", draft- | for Smart Objects and Constrained Node Networks", draft- | |||
| ietf-lwig-tls-minimal-01 (work in progress), March 2014. | ietf-lwig-tls-minimal-01 (work in progress), March 2014. | |||
| [I-D.ietf-tls-applayerprotoneg] | [I-D.ietf-uta-tls-bcp] | |||
| Friedl, S., Popov, A., Langley, A., and S. Emile, | ||||
| "Transport Layer Security (TLS) Application Layer Protocol | ||||
| Negotiation Extension", draft-ietf-tls-applayerprotoneg-05 | ||||
| (work in progress), March 2014. | ||||
| [I-D.pettersen-tls-version-rollback-removal] | ||||
| Pettersen, Y., "Managing and removing automatic version | ||||
| rollback in TLS Clients", draft-pettersen-tls-version- | ||||
| rollback-removal-03 (work in progress), February 2014. | ||||
| [I-D.sheffer-tls-bcp] | ||||
| Sheffer, Y., Holz, R., and P. Saint-Andre, | Sheffer, Y., Holz, R., and P. Saint-Andre, | |||
| "Recommendations for Secure Use of TLS and DTLS", draft- | "Recommendations for Secure Use of TLS and DTLS", draft- | |||
| sheffer-tls-bcp-02 (work in progress), February 2014. | ietf-uta-tls-bcp-01 (work in progress), June 2014. | |||
| [I-D.schmertmann-dice-ccm-psk-pfs] | ||||
| Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher | ||||
| Suites with Forward Secrecy for Transport Layer Security | ||||
| (TLS)", draft-schmertmann-dice-ccm-psk-pfs-00 (work in | ||||
| progress), February 2014. | ||||
| [IANA-TLS] | [IANA-TLS] | |||
| IANA, "TLS Cipher Suite Registry", http://www.iana.org/ | IANA, "TLS Cipher Suite Registry", | |||
| assignments/tls-parameters/ | http://www.iana.org/assignments/tls-parameters/ | |||
| tls-parameters.xhtml#tls-parameters-4, 2014. | tls-parameters.xhtml#tls-parameters-4, 2014. | |||
| [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC | [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC | |||
| Text on Security Considerations", BCP 72, RFC 3552, July | Text on Security Considerations", BCP 72, RFC 3552, July | |||
| 2003. | 2003. | |||
| [RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness | [RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness | |||
| Requirements for Security", BCP 106, RFC 4086, June 2005. | Requirements for Security", BCP 106, RFC 4086, June 2005. | |||
| [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. | [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. | |||
| skipping to change at page 20, line 21 ¶ | skipping to change at page 22, line 50 ¶ | |||
| Server-Side State", RFC 5077, January 2008. | Server-Side State", RFC 5077, January 2008. | |||
| [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated | [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated | |||
| Encryption", RFC 5116, January 2008. | Encryption", RFC 5116, January 2008. | |||
| [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., | [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., | |||
| Housley, R., and W. Polk, "Internet X.509 Public Key | Housley, R., and W. Polk, "Internet X.509 Public Key | |||
| Infrastructure Certificate and Certificate Revocation List | Infrastructure Certificate and Certificate Revocation List | |||
| (CRL) Profile", RFC 5280, May 2008. | (CRL) Profile", RFC 5280, May 2008. | |||
| [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with | [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA- | |||
| SHA-256/384 and AES Galois Counter Mode (GCM)", RFC 5289, | 256/384 and AES Galois Counter Mode (GCM)", RFC 5289, | |||
| August 2008. | August 2008. | |||
| [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor | [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor | |||
| Management Protocol (TAMP)", RFC 5934, August 2010. | Management Protocol (TAMP)", RFC 5934, August 2010. | |||
| [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic | [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic | |||
| Curve Cryptography Algorithms", RFC 6090, February 2011. | Curve Cryptography Algorithms", RFC 6090, February 2011. | |||
| [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for | [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for | |||
| Transport Layer Security (TLS)", RFC 6655, July 2012. | Transport Layer Security (TLS)", RFC 6655, July 2012. | |||
| [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) | [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) | |||
| Multiple Certificate Status Request Extension", RFC 6961, | Multiple Certificate Status Request Extension", RFC 6961, | |||
| June 2013. | June 2013. | |||
| [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., | [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., | |||
| Morris, J., Hansen, M., and R. Smith, "Privacy | Morris, J., Hansen, M., and R. Smith, "Privacy | |||
| Considerations for Internet Protocols", RFC 6973, July | Considerations for Internet Protocols", RFC 6973, July | |||
| 2013. | 2013. | |||
| Authors' Addresses | [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained | |||
| Application Protocol (CoAP)", RFC 7252, June 2014. | ||||
| Klaus Hartke | [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an | |||
| Universitaet Bremen TZI | Attack", BCP 188, RFC 7258, May 2014. | |||
| Postfach 330440 | ||||
| Bremen D-28359 | ||||
| Germany | ||||
| Phone: +49-421-218-63905 | Author's Address | |||
| Email: hartke@tzi.org | ||||
| Hannes Tschofenig | Hannes Tschofenig (editor) | |||
| ARM Ltd. | ARM Ltd. | |||
| 110 Fulbourn Rd | 110 Fulbourn Rd | |||
| Cambridge CB1 9NJ | Cambridge CB1 9NJ | |||
| Great Britain | Great Britain | |||
| Email: Hannes.tschofenig@gmx.net | Email: Hannes.tschofenig@gmx.net | |||
| URI: http://www.tschofenig.priv.at | URI: http://www.tschofenig.priv.at | |||
| End of changes. 49 change blocks. | ||||
| 204 lines changed or deleted | 334 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||