| < draft-ietf-dice-profile-06.txt | draft-ietf-dice-profile-07.txt > | |||
|---|---|---|---|---|
| dice H. Tschofenig, Ed. | dice H. Tschofenig, Ed. | |||
| Internet-Draft ARM Ltd. | Internet-Draft ARM Ltd. | |||
| Intended status: Standards Track T. Fossati | Intended status: Standards Track T. Fossati | |||
| Expires: June 11, 2015 Alcatel-Lucent | Expires: June 18, 2015 Alcatel-Lucent | |||
| December 8, 2014 | December 15, 2014 | |||
| A Datagram Transport Layer Security (DTLS) 1.2 Profile for the Internet | A TLS/DTLS 1.2 Profile for the Internet of Things | |||
| of Things | draft-ietf-dice-profile-07.txt | |||
| draft-ietf-dice-profile-06.txt | ||||
| Abstract | Abstract | |||
| This document defines a DTLS 1.2 profile that is suitable for | A common design pattern in Internet of Things (IoT) deployments is | |||
| Internet of Things applications and is reasonably implementable on | the use of a constrained device (typically providing sensor data) | |||
| many constrained devices. | that makes data available for home automation, industrial control | |||
| systems, smart cities and other IoT deployments. | ||||
| A common design pattern in IoT deployments is the use of a | This document defines a Transport Layer Security (TLS) and Datagram | |||
| constrained device (typically providing sensor data) that interacts | TLS 1.2 profile that offers communications security for this data | |||
| with the web infrastructure. This document focuses on this | exchange thereby preventing eavesdropping, tampering, and message | |||
| particular pattern. | forgery. | |||
| Status of This Memo | Status of This Memo | |||
| This Internet-Draft is submitted in full conformance with the | This Internet-Draft is submitted in full conformance with the | |||
| provisions of BCP 78 and BCP 79. | provisions of BCP 78 and BCP 79. | |||
| Internet-Drafts are working documents of the Internet Engineering | Internet-Drafts are working documents of the Internet Engineering | |||
| Task Force (IETF). Note that other groups may also distribute | Task Force (IETF). Note that other groups may also distribute | |||
| working documents as Internet-Drafts. The list of current Internet- | working documents as Internet-Drafts. The list of current Internet- | |||
| Drafts is at http://datatracker.ietf.org/drafts/current/. | Drafts is at http://datatracker.ietf.org/drafts/current/. | |||
| Internet-Drafts are draft documents valid for a maximum of six months | Internet-Drafts are draft documents valid for a maximum of six months | |||
| and may be updated, replaced, or obsoleted by other documents at any | and may be updated, replaced, or obsoleted by other documents at any | |||
| time. It is inappropriate to use Internet-Drafts as reference | time. It is inappropriate to use Internet-Drafts as reference | |||
| material or to cite them other than as "work in progress." | material or to cite them other than as "work in progress." | |||
| This Internet-Draft will expire on June 11, 2015. | This Internet-Draft will expire on June 18, 2015. | |||
| Copyright Notice | Copyright Notice | |||
| Copyright (c) 2014 IETF Trust and the persons identified as the | Copyright (c) 2014 IETF Trust and the persons identified as the | |||
| document authors. All rights reserved. | document authors. All rights reserved. | |||
| This document is subject to BCP 78 and the IETF Trust's Legal | This document is subject to BCP 78 and the IETF Trust's Legal | |||
| Provisions Relating to IETF Documents | Provisions Relating to IETF Documents | |||
| (http://trustee.ietf.org/license-info) in effect on the date of | (http://trustee.ietf.org/license-info) in effect on the date of | |||
| publication of this document. Please review these documents | publication of this document. Please review these documents | |||
| carefully, as they describe your rights and restrictions with respect | carefully, as they describe your rights and restrictions with respect | |||
| to this document. Code Components extracted from this document must | to this document. Code Components extracted from this document must | |||
| include Simplified BSD License text as described in Section 4.e of | include Simplified BSD License text as described in Section 4.e of | |||
| the Trust Legal Provisions and are provided without warranty as | the Trust Legal Provisions and are provided without warranty as | |||
| described in the Simplified BSD License. | described in the Simplified BSD License. | |||
| Table of Contents | Table of Contents | |||
| 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 | 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
| 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 | 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 | |||
| 3. DTLS Protocol Overview . . . . . . . . . . . . . . . . . . . 4 | 3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4 | |||
| 4. The Communication Model . . . . . . . . . . . . . . . . . . . 5 | 4. Communication Models . . . . . . . . . . . . . . . . . . . . 5 | |||
| 5. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 7 | 4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 5 | |||
| 6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 9 | 4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 12 | |||
| 6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 9 | 5. The TLS/DTLS Ciphersuite Concept . . . . . . . . . . . . . . 12 | |||
| 6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 11 | 6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 13 | |||
| 6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 13 | 6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 13 | |||
| 7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 15 | 6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 15 | |||
| 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 16 | 6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 17 | |||
| 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 17 | 7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 20 | |||
| 10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 18 | 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 20 | |||
| 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 18 | 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 21 | |||
| 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 19 | 10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 22 | |||
| 13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 20 | 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 22 | |||
| 14. Random Number Generation . . . . . . . . . . . . . . . . . . 21 | 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 23 | |||
| 15. Truncated MAC Extension . . . . . . . . . . . . . . . . . . . 22 | 13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 25 | |||
| 16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 22 | 14. Random Number Generation . . . . . . . . . . . . . . . . . . 25 | |||
| 17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 22 | 15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 26 | |||
| 18. TLS Session Hash . . . . . . . . . . . . . . . . . . . . . . 23 | 16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 27 | |||
| 19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 23 | 17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 27 | |||
| 20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 23 | 18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 27 | |||
| 21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 24 | 19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 28 | |||
| 22. Key Length Recommendations . . . . . . . . . . . . . . . . . 25 | 20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 28 | |||
| 23. TLS False Start . . . . . . . . . . . . . . . . . . . . . . . 25 | 21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 29 | |||
| 24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 26 | 22. Key Length Recommendations . . . . . . . . . . . . . . . . . 30 | |||
| 25. Security Considerations . . . . . . . . . . . . . . . . . . . 27 | 23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 31 | |||
| 26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27 | 24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 32 | |||
| 27. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 27 | 25. Security Considerations . . . . . . . . . . . . . . . . . . . 32 | |||
| 28. References . . . . . . . . . . . . . . . . . . . . . . . . . 27 | 26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 33 | |||
| 28.1. Normative References . . . . . . . . . . . . . . . . . . 28 | 27. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 33 | |||
| 28.2. Informative References . . . . . . . . . . . . . . . . . 29 | 28. References . . . . . . . . . . . . . . . . . . . . . . . . . 33 | |||
| Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 32 | 28.1. Normative References . . . . . . . . . . . . . . . . . . 33 | |||
| A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 32 | 28.2. Informative References . . . . . . . . . . . . . . . . . 34 | |||
| A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 33 | Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 38 | |||
| A.3. Multiplexing Security Associations . . . . . . . . . . . 34 | A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 38 | |||
| A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 34 | A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 39 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 35 | A.3. Multiplexing Security Associations . . . . . . . . . . . 40 | |||
| A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 40 | ||||
| 1. Introduction | ||||
| This document defines a DTLS 1.2 [RFC6347] profile that offers | ||||
| communication security for Internet of Things (IoT) applications and | ||||
| is reasonably implementable on many constrained devices. The DTLS | ||||
| 1.2 protocol is based on Transport Layer Security (TLS) 1.2 [RFC5246] | ||||
| and provides equivalent security guarantees. This document aims to | ||||
| meet the following goals: | ||||
| o Serves as a one-stop shop for implementers to know which pieces of | ||||
| the specification jungle contain relevant details. | ||||
| o Does not alter the TLS/DTLS specifications. | ||||
| o Does not introduce any new extensions. | Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 41 | |||
| Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 42 | ||||
| o Aligns with the DTLS security modes of the Constrained Application | 1. Introduction | |||
| Protocol (CoAP) [RFC7252]. | ||||
| DTLS is used to secure a number of applications run over an | An engineer developing an Internet of Things (IoT) device needs to | |||
| unreliable datagram transport. CoAP [RFC7252] is one such protocol | investigate the security threats and decide about the security | |||
| and has been designed specifically for use in IoT environments. CoAP | services that can be used to mitigate these threats. | |||
| can be secured a number of different ways, also called security | ||||
| modes. These security modes are as follows, see Section 6.1, | ||||
| Section 6.2, Section 6.3 for additional details: | ||||
| No Security Protection at the Transport Layer: No DTLS is used but | Enabling IoT devices to make data available often requires | |||
| instead application layer security functionality is assumed. | authentication of the two endpoints and the ability to provide | |||
| integrity- and confidentiality-protection of exchanged data. While | ||||
| these security services can be provided at different layers in the | ||||
| protocol stack the use of Transport Layer Security (TLS)/Datagram TLS | ||||
| (DTLS) has been very popular with many application protocols and it | ||||
| is likely to be useful for IoT scenarios as well. | ||||
| Shared Secret-based DTLS Authentication: DTLS supports the use of | To make Internet protocols fit constrained devices can be difficult | |||
| shared secrets [RFC4279]. This mode is useful if the number of | but thanks to the standardization efforts new profiles and protocols | |||
| communication relationships between the IoT device and servers is | are available, such as the Constrained Application Protocol (CoAP) | |||
| small and for very constrained devices. Shared secret-based | [RFC7252]. UDP is mainly used to carry CoAP messages but other | |||
| authentication mechanisms offer good performance and require a | transports can be utilized, such as SMS or even TCP. | |||
| minimum of data to be exchanged. | ||||
| DTLS Authentication using Asymmetric Cryptography: TLS supports | While this document is inspired by the desire to protect CoAP | |||
| client and server authentication using asymmetric cryptography. | messages using DTLS 1.2 [RFC6347] the guidance in this document is | |||
| Two approaches for validating these public keys are available. | not limited to CoAP nor to DTLS itself. | |||
| First, [RFC7250] allows raw public keys to be used in TLS without | ||||
| the overhead of certificates. This approach requires out-of-band | ||||
| validation of the public key. Second, the use of X.509 | ||||
| certificates [RFC5280] with TLS is common on the Web today (at | ||||
| least for server-side authentication) and certain IoT environments | ||||
| may also re-use those capabilities. Certificates bind an | ||||
| identifier to the public key signed by a certification authority | ||||
| (CA). A trust anchor store has to be provisioned on the device to | ||||
| indicate what CAs are trusted. Furthermore, the certificate may | ||||
| contain a wealth of other information used to make authorization | ||||
| decisions. | ||||
| As described in [I-D.ietf-lwig-tls-minimal], an application designer | Instead, this document defines a profile of DTLS 1.2 [RFC6347] and | |||
| developing an IoT device needs to consider the security threats and | TLS 1.2 [RFC5246] that offers communication security for IoT | |||
| the security services that can be used to mitigate the threats. | applications and is reasonably implementable on many constrained | |||
| Enabling devices to upload data and retrieve configuration | devices. Profile thereby means that available configuration options | |||
| information, inevitably requires that Internet-connected devices be | and protocol extensions are utilized to best support the IoT | |||
| able to authenticate themselves to servers and vice versa as well as | environment. This document does not alter TLS/DTLS specifications | |||
| to ensure that the data and information exchanged is integrity and | and does not introduce any new TLS/DTLS extensions. | |||
| confidentiality protected. While these security services can be | ||||
| provided at different layers in the protocol stack the use of | ||||
| communication security, as offered by DTLS, has been very popular on | ||||
| the Internet and it is likely to be useful for IoT scenarios as well. | ||||
| In case the communication security features offered by DTLS meet the | ||||
| security requirements of your application the remainder of the | ||||
| document might offer useful guidance. | ||||
| Not every IoT deployment will use CoAP but the discussion regarding | The main target audience for this document is the embedded system | |||
| choice of credentials and cryptographic algorithms will be very | developer configuring and using a TLS/DTLS stack. This document may, | |||
| similar. As such, the content in this document is applicable beyond | however, also help those developing or selecting a suitable TLS/DTLS | |||
| the use of the CoAP protocol. | stack for an Internet of Things product development. | |||
| 2. Terminology | 2. Terminology | |||
| The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", | |||
| "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this | |||
| document are to be interpreted as described in [RFC2119]. | document are to be interpreted as described in [RFC2119]. | |||
| Note that "Client" and "Server" in this document refer to TLS roles, | Note that "Client" and "Server" in this document refer to TLS/DTLS | |||
| where the Client initiates the TLS handshake. This does not restrict | roles, where the Client initiates the TLS/DTLS handshake. This does | |||
| the interaction pattern of the protocols carried inside TLS as the | not restrict the interaction pattern of the protocols on top of TLS/ | |||
| record layer allows bi-directional communication. In the case of | DTLS since the record layer allows bi-directional communication. | |||
| CoAP the "Client" can act as a CoAP Server or Client. | This aspect is further described in Section 4. | |||
| RFC 7228 [RFC7228] introduces the notion of constrained-node | RFC 7228 [RFC7228] introduces the notion of constrained-node | |||
| networks, which are small devices with severe constraints on power, | networks, which are small devices with severe constraints on power, | |||
| memory, and processing resources. The terms constrained devices, and | memory, and processing resources. The terms constrained devices, and | |||
| Internet of Things (IoT) devices are used interchangeably. | Internet of Things (IoT) devices are used interchangeably. | |||
| 3. DTLS Protocol Overview | 3. TLS/DTLS Protocol Overview | |||
| The TLS protocol [RFC5246] provides authenticated, confidentiality- | The TLS protocol [RFC5246] provides authenticated, confidentiality- | |||
| and integrity-protected communication between two endpoints. The | and integrity-protected communication between two endpoints. The | |||
| protocol is composed of two layers: the Record Protocol and the | protocol is composed of two layers: the Record Protocol and the | |||
| Handshake Protocol. At the lowest level, layered on top of a | Handshake Protocol. At the lowest level, layered on top of a | |||
| reliable transport protocol (e.g., TCP), is the Record Protocol. It | reliable transport protocol (e.g., TCP), is the Record Protocol. It | |||
| provides connection security by using symmetric cryptography for | provides connection security by using symmetric cryptography for | |||
| confidentiality, data origin authentication, and integrity | confidentiality, data origin authentication, and integrity | |||
| protection. The Record Protocol is used for encapsulation of various | protection. The Record Protocol is used for encapsulation of various | |||
| higher-level protocols. One such encapsulated protocol, the TLS | higher-level protocols. One such encapsulated protocol, the | |||
| Handshake Protocol, allows the server and client to authenticate each | Handshake Protocol, allows the server and client to authenticate each | |||
| other and to negotiate an encryption algorithm and cryptographic keys | other and to negotiate an encryption algorithm and cryptographic keys | |||
| before the application protocol transmits or receives data. | before the application protocol transmits or receives data. | |||
| The design of DTLS [RFC6347] is intentionally very similar to TLS. | The design of DTLS [RFC6347] is intentionally very similar to TLS. | |||
| Since DTLS operates on top of an unreliable datagram transport a few | Since DTLS operates on top of an unreliable datagram transport a few | |||
| enhancements to the TLS structure are, however necessary. RFC 6347 | enhancements to the TLS structure are, however necessary. RFC 6347 | |||
| explains these differences in great detail. As a short summary, for | explains these differences in great detail. As a short summary, for | |||
| those not familiar with DTLS the differences are: | those not familiar with DTLS the differences are: | |||
| o An explicit sequence number and an epoch field is included in the | o An explicit sequence number and an epoch field is included in the | |||
| TLS Record Layer. Section 4.1 of RFC 6347 explains the processing | Record Protocol. Section 4.1 of RFC 6347 explains the processing | |||
| rules for these two new fields. The value used to compute the MAC | rules for these two new fields. The value used to compute the MAC | |||
| is the 64-bit value formed by concatenating the epoch and the | is the 64-bit value formed by concatenating the epoch and the | |||
| sequence number. | sequence number. | |||
| o Stream ciphers must not be used with DTLS. The only stream cipher | o Stream ciphers must not be used with DTLS. The only stream cipher | |||
| defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it | defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it | |||
| is not recommended anymore even for use with TLS | is not recommended anymore even for use with TLS | |||
| [I-D.ietf-tls-prohibiting-rc4]. | [I-D.ietf-tls-prohibiting-rc4]. | |||
| o The TLS Handshake Protocol has been enhanced to include a | o The TLS Handshake Protocol has been enhanced to include a | |||
| stateless cookie exchange for Denial of Service (DoS) resistance. | stateless cookie exchange for Denial of Service (DoS) resistance. | |||
| Furthermore, the header has been extended to deal with message | For this purpose a new handshake message, the HelloVerifyRequest, | |||
| loss, reordering, and fragmentation. Retransmission timers have | was added to DTLS. This handshake message is sent by the server | |||
| been included to deal with message loss. For DoS protection a new | and includes a stateless cookie, which is returned in a | |||
| handshake message, the HelloVerifyRequest, was added to DTLS. | ClientHello message back to the server. Although the exchange is | |||
| This handshake message is sent by the server and includes a | optional for the server to execute, a client implementation has to | |||
| stateless cookie, which is returned in a ClientHello message back | be prepared to respond to it. Furthermore, the handshake message | |||
| to the server. Although the exchange is optional for the server | format has been extended to deal with message loss, reordering, | |||
| to execute, a client implementation has to be prepared to respond | and fragmentation. Retransmission timers have been included to | |||
| to it. | deal with message loss. | |||
| 4. The Communication Model | 4. Communication Models | |||
| This document describes a profile of DTLS 1.2 and, to be useful, it | This document describes a profile of TLS/DTLS 1.2 and, to be useful, | |||
| has to make assumptions about the envisioned communication | it has to make assumptions about the envisioned communication | |||
| architecture. | architecture. | |||
| Two communication architectures (and consequently two profiles) are | ||||
| described in this document. | ||||
| 4.1. Constrained TLS/DTLS Clients | ||||
| The communication architecture shown in Figure 1 assumes a unicast | The communication architecture shown in Figure 1 assumes a unicast | |||
| communication interaction with an IoT device utilizing a DTLS client | communication interaction with an IoT device utilizing a constrained | |||
| and that client interacts with one or multiple DTLS servers. | TLS/DTLS client interacting with one or multiple TLS/DTLS servers. | |||
| Before a client can initiate the DTLS handshake it needs to know the | Before a client can initiate the TLS/DTLS handshake it needs to know | |||
| IP address of that server and what credentials to use. Application | the IP address of that server and what credentials to use. | |||
| layer protocols, such as CoAP, conveyed on top of DTLS may need | Application layer protocols, such as CoAP, conveyed on top of DTLS | |||
| additional information, such information about URLs of the endpoints | may need additional information, such information about URLs of the | |||
| the CoAP needs to register and publish information to. This | endpoints the CoAP needs to register and publish information to. | |||
| configuration information (including credentials) may be conveyed to | This configuration information (including credentials) may be | |||
| clients as part of a firmware/software package or via a configuration | conveyed to clients as part of a firmware/software package or via a | |||
| protocol. The following credential types are supported by this | configuration protocol. The following credential types are supported | |||
| profile: | by this profile: | |||
| o For PSK-based authentication (see Section 6.1), this includes the | o For PSK-based authentication (see Section 6.1), this includes the | |||
| paired "PSK identity" and shared secret to be used with each | paired "PSK identity" and shared secret to be used with each | |||
| server. | server. | |||
| o For raw public key-based authentication (see Section 6.2), this | o For raw public key-based authentication (see Section 6.2), this | |||
| includes either the server's public key or the hash of the | includes either the server's public key or the hash of the | |||
| server's public key. | server's public key. | |||
| o For certificate-based authentication (see Section 6.3), this | o For certificate-based authentication (see Section 6.3), this | |||
| skipping to change at page 7, line 17 ¶ | skipping to change at page 6, line 17 ¶ | |||
| |////////////////////////////////////| | |////////////////////////////////////| | |||
| | Server A --> PSK Identity, PSK | | | Server A --> PSK Identity, PSK | | |||
| | Server B --> Public Key (Server B),| | | Server B --> Public Key (Server B),| | |||
| | Public Key (Client) | | | Public Key (Client) | | |||
| | Server C --> Public Key (Client), | | | Server C --> Public Key (Client), | | |||
| | Trust Anchor Store | | | Trust Anchor Store | | |||
| +------------------------------------+ | +------------------------------------+ | |||
| oo | oo | |||
| oooooo | oooooo | |||
| o | o | |||
| +------+ | +-----------+ | |||
| |Client|--- | |Constrained| | |||
| +------+ \ | |TLS/DTLS | | |||
| |Client |- | ||||
| +-----------+ \ | ||||
| \ ,-------. | \ ,-------. | |||
| ,' `. +------+ | ,' `. +------+ | |||
| / IP-based \ |Server| | / IP-based \ |Server| | |||
| ( Network ) | A | | ( Network ) | A | | |||
| \ / +------+ | \ / +------+ | |||
| `. ,' | `. ,' | |||
| '---+---' +------+ | '---+---' +------+ | |||
| | |Server| | | |Server| | |||
| | | B | | | | B | | |||
| | +------+ | | +------+ | |||
| | | | | |||
| | +------+ | | +------+ | |||
| +----------------->|Server| | +----------------->|Server| | |||
| | C | | | C | | |||
| +------+ | +------+ | |||
| Figure 1: Constrained DTLS Client Profile. | Figure 1: Constrained Client Profile. | |||
| 5. The Ciphersuite Concept | 4.1.1. Examples of Constrained Client Exchanges | |||
| 4.1.1.1. Network Access Authentication Example | ||||
| Re-use is a recurring theme when considering constrained environments | ||||
| and is behind a lot of the directions taken in developments for | ||||
| constrained environments. The corollary of re-use is to not add | ||||
| functionality if it can be avoided. An example relevant to the use | ||||
| of TLS is network access authentication, which takes place when a | ||||
| device connects to a network and needs to go through an | ||||
| authentication and access control procedure before it is allowed to | ||||
| communicate with other devices or connect to the Internet. | ||||
| Figure 2 shows the network access architecture with the IoT device | ||||
| initiating the communication to an access point in the network using | ||||
| the procedures defined for a specific physical layer. Since | ||||
| credentials may be managed and stored centrally, in the | ||||
| Authentication, Authorization, and Accounting (AAA) server, the | ||||
| security protocol exchange may need to be relayed via the | ||||
| Authenticator, i.e., functionality running on the access point, to | ||||
| the AAA server. The authentication and key exchange protocol itself | ||||
| is encapsulated within a container, the Extensible Authentication | ||||
| Protocol (EAP), and messages are conveyed back and forth between the | ||||
| EAP endpoints, namely the EAP peer located on the IoT device and the | ||||
| EAP server located on the AAA server or the access point. To route | ||||
| EAP messages from the access point, acting as a AAA client, to the | ||||
| AAA server requires an adequate protocol mechanism, name RADIUS or | ||||
| Diameter. | ||||
| More details about the concepts and a description about the | ||||
| terminology can be found in RFC 5247 [RFC5247]. | ||||
| +--------------+ | ||||
| |Authentication| | ||||
| |Authorization | | ||||
| |Accounting | | ||||
| |Server | | ||||
| |(EAP Server) | | ||||
| | | | ||||
| +-^----------^-+ | ||||
| * EAP o RADIUS/ | ||||
| * o Diameter | ||||
| --v----------v-- | ||||
| /// \\\ | ||||
| // \\ | ||||
| | Federation | | ||||
| | Substrate | | ||||
| \\ // | ||||
| \\\ /// | ||||
| --^----------^-- | ||||
| * EAP o RADIUS/ | ||||
| * o Diameter | ||||
| +-------------+ +-v----------v--+ | ||||
| | | EAP/EAP Method | | | ||||
| | Internet of |<***************************>| Access Point | | ||||
| | Things | |(Authenticator)| | ||||
| | Device | EAP Lower Layer and |(AAA Client) | | ||||
| | (EAP Peer) | Secure Association Protocol | | | ||||
| | |<--------------------------->| | | ||||
| | | | | | ||||
| | | Physical Layer | | | ||||
| | |<===========================>| | | ||||
| +-------------+ +---------------+ | ||||
| Legend: | ||||
| <****>: Device-to-AAA Server Exchange | ||||
| <---->: Device-to-Authenticator Exchange | ||||
| <oooo>: AAA Client-to-AAA Server Exchange | ||||
| <====>: Phyiscal layer like IEEE 802.11/802.15.4 | ||||
| Figure 2: Network Access Architecture.. | ||||
| One standardized EAP method is EAP-TLS, defined in RFC 5216 | ||||
| [RFC5216], which re-uses the TLS-based protocol exchange and | ||||
| encapsulates it inside the EAP payload. In terms of re-use this | ||||
| allows many components of the TLS protocol to be shared between the | ||||
| network access security functionality and the TLS functionality | ||||
| needed for securing application layer traffic. The EAP-TLS exchange | ||||
| is shown in Figure 3 where it is worthwhile to point out that in EAP | ||||
| the client / server roles are reversed but with the use of EAP-TLS | ||||
| the IoT device acts as a TLS client. | ||||
| Authenticating Peer Authenticator | ||||
| ------------------- ------------- | ||||
| <- EAP-Request/ | ||||
| Identity | ||||
| EAP-Response/ | ||||
| Identity (MyID) -> | ||||
| <- EAP-Request/ | ||||
| EAP-Type=EAP-TLS | ||||
| (TLS Start) | ||||
| EAP-Response/ | ||||
| EAP-Type=EAP-TLS | ||||
| (TLS client_hello)-> | ||||
| <- EAP-Request/ | ||||
| EAP-Type=EAP-TLS | ||||
| (TLS server_hello, | ||||
| TLS certificate, | ||||
| [TLS server_key_exchange,] | ||||
| TLS certificate_request, | ||||
| TLS server_hello_done) | ||||
| EAP-Response/ | ||||
| EAP-Type=EAP-TLS | ||||
| (TLS certificate, | ||||
| TLS client_key_exchange, | ||||
| TLS certificate_verify, | ||||
| TLS change_cipher_spec, | ||||
| TLS finished) -> | ||||
| <- EAP-Request/ | ||||
| EAP-Type=EAP-TLS | ||||
| (TLS change_cipher_spec, | ||||
| TLS finished) | ||||
| EAP-Response/ | ||||
| EAP-Type=EAP-TLS -> | ||||
| <- EAP-Success | ||||
| Figure 3: EAP-TLS Exchange. | ||||
| The guidance in this document also applies to the use of EAP-TLS for | ||||
| network access authentication. An IoT device using a network access | ||||
| authentication solution based on TLS can re-use most parts of the | ||||
| code for the use of DTLS/TLS at the application layer thereby saving | ||||
| a significant amount of flash memory. Note, however, that the | ||||
| credentials used for network access authentication and those used for | ||||
| application layer security are very likely different. | ||||
| 4.1.1.2. CoAP-based Data Exchange Example | ||||
| When a constrained client uploads sensor data to a server | ||||
| infrastructure it may use CoAP by pushing the data via a POST to a | ||||
| pre-configured endpoint on the server. In certain circumstances this | ||||
| might be too limiting and additional functionality is needed, as | ||||
| shown in Figure 4, where the IoT device itself runs a CoAP server | ||||
| hosting the resource that is made accessible to other entities. | ||||
| Despite running a CoaP server on the IoT device it is still the DTLS | ||||
| client on the IoT device that initiates the interaction with the non- | ||||
| constrained resource server in our scenario. | ||||
| Figure 4 shows a sensor starting with a DTLS exchange with a resource | ||||
| server to register available resources. The initial DTLS interaction | ||||
| between the sensor, acting as a DTLS client, and the resource server, | ||||
| acting as a DTLS server, will be a full DTLS handshake. Once this | ||||
| handshake is complete both parties have established the DTLS record | ||||
| layer, which can subsequently be used to secure the CoAP message | ||||
| exchange, which starts with a the resource registration. Details | ||||
| about the resource registry capabilities can be found in | ||||
| [I-D.ietf-core-resource-directory]. | ||||
| After some time (assuming that the client regularly refreshes its | ||||
| registration) the resource server receives a request (not shown) from | ||||
| an application to retrieve the temperature information from the | ||||
| sensor. This request is relayed by the resource directory to the | ||||
| sensor using a GET message exchange. The already established DTLS | ||||
| record layer can be used to secure the message exchange. | ||||
| Resource | ||||
| Sensor Directory | ||||
| ------ --------- | ||||
| +--- | ||||
| | | ||||
| | ClientHello --------> | ||||
| | client_certificate_type | ||||
| F| server_certificate_type | ||||
| U| | ||||
| L| <------- HelloVerifyRequest | ||||
| L| | ||||
| | ClientHello --------> | ||||
| D| client_certificate_type | ||||
| T| server_certificate_type | ||||
| L| | ||||
| S| ServerHello | ||||
| | client_certificate_type | ||||
| H| server_certificate_type | ||||
| A| Certificate | ||||
| N| ServerKeyExchange | ||||
| D| CertificateRequest | ||||
| S| <-------- ServerHelloDone | ||||
| H| | ||||
| A| Certificate | ||||
| K| ClientKeyExchange | ||||
| E| CertificateVerify | ||||
| | [ChangeCipherSpec] | ||||
| | Finished --------> | ||||
| | | ||||
| | [ChangeCipherSpec] | ||||
| | <-------- Finished | ||||
| +--- | ||||
| +--- ///+ | ||||
| C| \ D | ||||
| O| Req: POST coap://rd.example.com/rd?ep=node1 \ T | ||||
| A| Payload: \ L | ||||
| P| </temp>;ct=41; \ S | ||||
| | rt="temperature-c";if="sensor", \ | ||||
| R| </light>;ct=41; \ R | ||||
| D| rt="light-lux";if="sensor" \ E | ||||
| | --------> \ C | ||||
| R| \ O | ||||
| E| \ R | ||||
| G| Res: 2.01 Created \ D | ||||
| .| <-------- Location: /rd/4521 \ | ||||
| | \ L | ||||
| +--- \ A | ||||
| \ Y | ||||
| * \ E | ||||
| * (time passes) \ R | ||||
| * \ | ||||
| +--- \ P | ||||
| C| \ R | ||||
| O| Req: GET coaps://sensor.example.com/temp \ O | ||||
| A| <-------- \ T | ||||
| P| \ E | ||||
| | Res: 2.05 Content \ C | ||||
| G| Payload: \ T | ||||
| E| 25.5 --------> \ E | ||||
| T| \ D | ||||
| +--- ///+ | ||||
| Figure 4: DTLS/CoAP exchange using Resource Directory. | ||||
| 4.2. Constrained TLS/DTLS Servers | ||||
| TEXT TO BE DONE | ||||
| 5. The TLS/DTLS Ciphersuite Concept | ||||
| TLS (and consequently DTLS) has the concept of ciphersuites and an | TLS (and consequently DTLS) has the concept of ciphersuites and an | |||
| IANA registry [IANA-TLS] was created to register the suites. A | IANA registry [IANA-TLS] was created to register the suites. A | |||
| ciphersuite (and the specification that defines it) contains the | ciphersuite (and the specification that defines it) contains the | |||
| following information: | following information: | |||
| o Authentication and Key Exchange Algorithm (e.g., PSK) | o Authentication and key exchange algorithm (e.g., PSK) | |||
| o Cipher and Key Length (e.g., Advanced Encryption Standard (AES) | o Cipher and key length (e.g., Advanced Encryption Standard (AES) | |||
| with 128 bit keys [AES]) | with 128 bit keys [AES]) | |||
| o Mode of operation (e.g., AES with Counter with Cipher Block | o Mode of operation (e.g., Counter with Cipher Block Chaining - | |||
| Chaining - Message Authentication Code (CBC-MAC) Mode (CCM)) | Message Authentication Code (CBC-MAC) Mode (CCM) for AES) | |||
| [RFC3610] | [RFC3610] | |||
| o Hash Algorithm for Integrity Protection, such as the Secure Hash | o Hash algorithm for integrity protection, such as the Secure Hash | |||
| Algorithm (SHA) in combination with Keyed-Hashing for Message | Algorithm (SHA) in combination with Keyed-Hashing for Message | |||
| Authentication (HMAC) (see [RFC2104] and [RFC4634]) | Authentication (HMAC) (see [RFC2104] and [RFC4634]) | |||
| o Hash Algorithm for use with the Pseudorandom Function (e.g., HMAC | o Hash algorithm for use with the pseudorandom function (e.g., HMAC | |||
| with the SHA-256) | with the SHA-256) | |||
| o Misc information (e.g., length of authentication tags) | o Misc information (e.g., length of authentication tags) | |||
| o Information whether the ciphersuite is suitable for DTLS or only | o Information whether the ciphersuite is suitable for DTLS or only | |||
| for TLS | for TLS | |||
| The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a | The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a | |||
| pre-shared authentication and key exchange algorithm. RFC 6655 | pre-shared authentication and key exchange algorithm. RFC 6655 | |||
| [RFC6655] defines this ciphersuite. It uses the Advanced Encryption | [RFC6655] defines this ciphersuite. It uses the Advanced Encryption | |||
| skipping to change at page 9, line 12 ¶ | skipping to change at page 13, line 27 ¶ | |||
| the TLS pseudo random function (PRF) used in earlier versions of TLS | the TLS pseudo random function (PRF) used in earlier versions of TLS | |||
| with cipher-suite-specified PRFs. For this reason authors of more | with cipher-suite-specified PRFs. For this reason authors of more | |||
| recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC | recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC | |||
| algorithm and the hash functions used with the TLS PRF. | algorithm and the hash functions used with the TLS PRF. | |||
| 6. Credential Types | 6. Credential Types | |||
| 6.1. Pre-Shared Secret | 6.1. Pre-Shared Secret | |||
| The use of pre-shared secret credentials is one of the most basic | The use of pre-shared secret credentials is one of the most basic | |||
| techniques for DTLS since it is both computational efficient and | techniques for TLS/DTLS since it is both computational efficient and | |||
| bandwidth conserving. Pre-shared secret based authentication was | bandwidth conserving. Pre-shared secret based authentication was | |||
| introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in | introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in | |||
| Figure 2 illustrates the DTLS exchange including the cookie exchange. | Figure 5 illustrates the DTLS exchange including the cookie exchange. | |||
| While the server is not required to initiate a cookie exchange with | While the server is not required to initiate a cookie exchange with | |||
| every handshake, the client is required to implement and to react on | every handshake, the client is required to implement and to react on | |||
| it when challenged. The cookie exchange allows the server to react | it when challenged. The cookie exchange allows the server to react | |||
| to flooding attacks. | to flooding attacks. | |||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| ClientHello --------> | ClientHello --------> | |||
| <-------- HelloVerifyRequest | <-------- HelloVerifyRequest | |||
| skipping to change at page 9, line 45 ¶ | skipping to change at page 14, line 29 ¶ | |||
| Finished --------> | Finished --------> | |||
| ChangeCipherSpec | ChangeCipherSpec | |||
| <-------- Finished | <-------- Finished | |||
| Application Data <-------> Application Data | Application Data <-------> Application Data | |||
| Legend: | Legend: | |||
| * indicates an optional message payload | * indicates an optional message payload | |||
| Figure 2: DTLS PSK Authentication including the Cookie Exchange. | Figure 5: DTLS PSK Authentication including the Cookie Exchange. | |||
| [RFC4279] does not mandate the use of any particular type of | [RFC4279] does not mandate the use of any particular type of client | |||
| identity. Hence, the TLS client and server clearly have to agree on | identity and the client and server have to agree on the identities | |||
| the identities and keys to be used. The mandated encoding of | and keys to be used. The mandated encoding of identities in | |||
| identities in Section 5.1 of RFC 4279 aims to improve | Section 5.1 of RFC 4279 aims to improve interoperability for those | |||
| interoperability for those cases where the identity is configured by | cases where the identity is configured by a person using some | |||
| a person using some management interface. Many IoT devices do, | management interface. Many IoT devices do, however, not have a user | |||
| however, not have a user interface and most of their credentials are | interface and most of their credentials are bound to the device | |||
| bound to the device rather than the user. Furthermore, credentials | rather than the user. Furthermore, credentials are often provisioned | |||
| are often provisioned into trusted hardware modules or in the | into trusted hardware modules or in the firmware by developers. As | |||
| firmware by developers. As such, the encoding considerations are not | such, the encoding considerations are not applicable to this usage | |||
| applicable to this usage environment. For use with this profile the | environment. For use with this profile the PSK identities SHOULD NOT | |||
| PSK identities SHOULD NOT assume a structured format (as domain | assume a structured format (as domain names, Distinguished Names, or | |||
| names, Distinguished Names, or IP addresses have) and a bit-by-bit | IP addresses have) and a bit-by-bit comparison operation can then be | |||
| comparison operation can then be used by the server-side | used by the server-side infrastructure. | |||
| infrastructure. | ||||
| The client indicates which key it uses by including a "PSK identity" | The client indicates which key it uses by including a "PSK identity" | |||
| in the ClientKeyExchange message. As described in Section 4 clients | in the ClientKeyExchange message. As described in Section 4 clients | |||
| may have multiple pre-shared keys with a single server and to help | may have multiple pre-shared keys with a single server and to help | |||
| the client in selecting which PSK identity / PSK pair to use, the | the client in selecting which PSK identity / PSK pair to use, the | |||
| server can provide a "PSK identity hint" in the ServerKeyExchange | server can provide a "PSK identity hint" in the ServerKeyExchange | |||
| message. If the hint for PSK key selection is based on the domain | message. If the hint for PSK key selection is based on the domain | |||
| name of the server then servers SHOULD NOT send the "PSK identity | name of the server then servers SHOULD NOT send the "PSK identity | |||
| hint" in the ServerKeyExchange message. Hence, servers SHOULD NOT | hint" in the ServerKeyExchange message. In general, servers SHOULD | |||
| send the "PSK identity hint" in the ServerKeyExchange message and | NOT send the "PSK identity hint" in the ServerKeyExchange message and | |||
| client MUST ignore the message. This approach is inline with RFC | client MUST ignore the message. This approach is inline with RFC | |||
| 4279 [RFC4279]. Note: The TLS Server Name Indication (SNI) extension | 4279 [RFC4279]. Note: The TLS Server Name Indication (SNI) extension | |||
| allows the client to tell a server the name of the server it is | allows the client to tell a server the name of the server it is | |||
| contacting, which is relevant for hosting environments. A server | contacting, which is relevant for hosting environments. A server | |||
| using the identity hint needs to guide the selection based on a | using the identity hint needs to guide the selection based on a | |||
| received SNI value from the client. | received SNI value from the client. | |||
| RFC 4279 requires TLS implementations supporting PSK ciphersuites to | RFC 4279 requires TLS implementations supporting PSK ciphersuites to | |||
| support arbitrary PSK identities up to 128 octets in length, and | support arbitrary PSK identities up to 128 octets in length, and | |||
| arbitrary PSKs up to 64 octets in length. This is a useful | arbitrary PSKs up to 64 octets in length. This is a useful | |||
| assumption for TLS stacks used in the desktop and mobile environment | assumption for TLS stacks used in the desktop and mobile environments | |||
| where management interfaces are used to provision identities and | where management interfaces are used to provision identities and | |||
| keys. For the IoT environment, however, many devices are not | keys. For the IoT environment, keys are distributed as part of | |||
| equipped with displays and input devices (e.g., keyboards). Hence, | hardware modules or are embedded into the firmware and, as such, | |||
| keys are distributed as part of hardware modules or are embedded into | these restrictions are not applicable to this profile. | |||
| the firmware. As such, these restrictions are not applicable to this | ||||
| profile. | ||||
| Constrained Application Protocol (CoAP) [RFC7252] currently specifies | Constrained Application Protocol (CoAP) [RFC7252] currently specifies | |||
| TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite | TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite | |||
| for use with shared secrets. This ciphersuite uses the AES algorithm | for use with shared secrets. This ciphersuite uses the AES algorithm | |||
| with 128 bit keys and CCM as the mode of operation. The label "_8" | with 128 bit keys and CCM as the mode of operation. The label "_8" | |||
| indicates that an 8-octet authentication tag is used. This | indicates that an 8-octet authentication tag is used. This | |||
| ciphersuite makes use of the default TLS 1.2 Pseudorandom Function | ciphersuite makes use of the default TLS 1.2 Pseudorandom Function | |||
| (PRF), which uses an HMAC with the SHA-256 hash function. (Note that | (PRF), which uses an HMAC with the SHA-256 hash function. (Note that | |||
| all IoT implementations will need a SHA-256 implementation due to the | all IoT implementations will need a SHA-256 implementation due to the | |||
| construction of the pseudo-random number function in TLS 1.2.) | construction of the pseudo-random number function in DTLS/TLS 1.2.) | |||
| A device compliant with the profile in this section MUST implement | A device compliant with the profile in this section MUST implement | |||
| TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. | TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. | |||
| 6.2. Raw Public Key | 6.2. Raw Public Key | |||
| The use of raw public keys with DTLS, as defined in [RFC7250], is the | The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is | |||
| first entry point into public key cryptography without having to pay | the first entry point into public key cryptography without having to | |||
| the price of certificates and a PKI. The specification re-uses the | pay the price of certificates and a public key infrastructure (PKI). | |||
| existing Certificate message to convey the raw public key encoded in | The specification re-uses the existing Certificate message to convey | |||
| the SubjectPublicKeyInfo structure. To indicate support two new TLS | the raw public key encoded in the SubjectPublicKeyInfo structure. To | |||
| extensions had been defined, as shown in Figure 3, namely the | indicate support two new extensions had been defined, as shown in | |||
| server_certificate_type and the client_certificate_type. To operate | Figure 6, namely the server_certificate_type and the | |||
| this mechanism securely it is necessary to authenticate and authorize | client_certificate_type. To operate this mechanism securely it is | |||
| the public keys out-of-band. This document therefore assumes that a | necessary to authenticate and authorize the public keys out-of-band. | |||
| client implementation comes with one or multiple raw public keys of | This document therefore assumes that a client implementation comes | |||
| servers, it has to communicate with, pre-provisioned. Additionally, | with one or multiple raw public keys of servers, it has to | |||
| a device will have its own raw public key. To replace, delete, or | communicate with, pre-provisioned. Additionally, a device will have | |||
| add raw public key to this list requires a software update, for | its own raw public key. To replace, delete, or add raw public key to | |||
| example using a firmware update mechanism. | this list requires a software update, for example using a firmware | |||
| update mechanism. | ||||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| ClientHello --------> | ClientHello --------> | |||
| client_certificate_type | client_certificate_type | |||
| server_certificate_type | server_certificate_type | |||
| <------- HelloVerifyRequest | <------- HelloVerifyRequest | |||
| skipping to change at page 12, line 35 ¶ | skipping to change at page 16, line 37 ¶ | |||
| Certificate | Certificate | |||
| ClientKeyExchange | ClientKeyExchange | |||
| CertificateVerify | CertificateVerify | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. | Figure 6: DTLS Raw Public Key Exchange including the Cookie Exchange. | |||
| The CoAP recommended ciphersuite for use with this credential type is | The CoAP recommended ciphersuite for use with this credential type is | |||
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve | |||
| cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral | cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral | |||
| Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment | Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment | |||
| mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) | mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) | |||
| for authentication. Due to the use of Ephemeral Elliptic Curve | for authentication. Due to the use of Ephemeral Elliptic Curve | |||
| Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman | Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman | |||
| groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this | groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this | |||
| profile. This ciphersuite make use of the AEAD capability in DTLS | profile. This ciphersuite make use of the AEAD capability in DTLS | |||
| skipping to change at page 13, line 14 ¶ | skipping to change at page 17, line 19 ¶ | |||
| methods that have been available in the literature for a long time | methods that have been available in the literature for a long time | |||
| (i.e., 20 years and more). | (i.e., 20 years and more). | |||
| A device compliant with the profile in this section MUST implement | A device compliant with the profile in this section MUST implement | |||
| TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this | TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this | |||
| section. | section. | |||
| 6.3. Certificates | 6.3. Certificates | |||
| The use of mutual certificate-based authentication is shown in | The use of mutual certificate-based authentication is shown in | |||
| Figure 4, which makes use of the cached info extension | Figure 7, which makes use of the cached info extension | |||
| [I-D.ietf-tls-cached-info]. Support of the cached info extension is | [I-D.ietf-tls-cached-info]. Support of the cached info extension is | |||
| REQUIRED. Caching certificate chains allows the client to reduce the | REQUIRED. Caching certificate chains allows the client to reduce the | |||
| communication overhead significantly since otherwise the server would | communication overhead significantly since otherwise the server would | |||
| provide the end entity certificate, and the certificate chain. | provide the end entity certificate, and the certificate chain. | |||
| Because certificate validation requires that root keys be distributed | Because certificate validation requires that root keys be distributed | |||
| independently, the self-signed certificate that specifies the root | independently, the self-signed certificate that specifies the root | |||
| certificate authority is omitted from the chain. Client | certificate authority is omitted from the chain. Client | |||
| implementations MUST be provisioned with a trust anchor store that | implementations MUST be provisioned with a trust anchor store that | |||
| contains the root certificates. The use of the Trust Anchor | contains the root certificates. The use of the Trust Anchor | |||
| Management Protocol (TAMP) [RFC5934] is, however, not envisioned. | Management Protocol (TAMP) [RFC5934] is, however, not envisioned. | |||
| Instead IoT devices using this profile MUST rely on a software update | Instead IoT devices using this profile MUST rely on a software update | |||
| mechanism to provision these trust anchors. | mechanism to provision these trust anchors. | |||
| When DTLS is used to secure CoAP messages then the server provided | ||||
| certificates MUST contain the fully qualified DNS domain name or | ||||
| "FQDN" as dNSName. The coaps URI scheme is described in Section 6.2 | ||||
| of [RFC7252]. This FQDN is stored in the SubjectAltName or in the | ||||
| leftmost CN component of subject name, as explained in | ||||
| Section 9.1.3.3 of [RFC7252], and used by the client to match it | ||||
| against the FQDN used during the look-up process, as described in RFC | ||||
| 6125 [RFC6125]. For the profile in this specification does not | ||||
| assume dynamic discovery of local servers. | ||||
| For client certificates the identifier used in the SubjectAltName or | ||||
| in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 | ||||
| of [RFC7252]. | ||||
| For certificate revocation neither the Online Certificate Status | ||||
| Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. | ||||
| Instead, this profile relies on a software update mechanism. While | ||||
| multiple OCSP stapling [RFC6961] has recently been introduced as a | ||||
| mechanism to piggyback OCSP request/responses inside the DTLS/TLS | ||||
| handshake to avoid the cost of a separate protocol handshake further | ||||
| investigations are needed to determine its suitability for the IoT | ||||
| environment. | ||||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| ClientHello --------> | ClientHello --------> | |||
| cached_information | cached_information | |||
| <------- HelloVerifyRequest | <------- HelloVerifyRequest | |||
| ClientHello --------> | ClientHello --------> | |||
| cached_information | cached_information | |||
| skipping to change at page 14, line 31 ¶ | skipping to change at page 18, line 31 ¶ | |||
| Certificate | Certificate | |||
| ClientKeyExchange | ClientKeyExchange | |||
| CertificateVerify | CertificateVerify | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| Figure 4: DTLS Mutual Certificate-based Authentication. | Figure 7: DTLS Mutual Certificate-based Authentication. | |||
| When DTLS is used to secure CoAP messages then the server provided | ||||
| certificates MUST contain the fully qualified DNS domain name or | ||||
| "FQDN" as dNSName. The coaps URI scheme is described in Section 6.2 | ||||
| of [RFC7252]. This FQDN is stored in the SubjectAltName or in the | ||||
| leftmost CN component of subject name, as explained in | ||||
| Section 9.1.3.3 of [RFC7252], and used by the client to match it | ||||
| against the FQDN used during the look-up process, as described in RFC | ||||
| 6125 [RFC6125]. For the profile in this specification does not | ||||
| assume dynamic discovery of local servers. | ||||
| For client certificates the identifier used in the SubjectAltName or | ||||
| in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 | ||||
| of [RFC7252]. | ||||
| For certificate revocation neither the Online Certificate Status | ||||
| Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. | ||||
| Instead, this profile relies on a software update mechanism. While | ||||
| multiple OCSP stapling [RFC6961] has recently been introduced as a | ||||
| mechanism to piggyback OCSP request/responses inside the DTLS/TLS | ||||
| handshake to avoid the cost of a separate protocol handshake further | ||||
| investigations are needed to determine its suitability for the IoT | ||||
| environment. | ||||
| Regarding the ciphersuite choice the discussion in Section 6.2 | Regarding the ciphersuite choice the discussion in Section 6.2 | |||
| applies. Further details about X.509 certificates can be found in | applies. Further details about X.509 certificates can be found in | |||
| Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 | Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 | |||
| ciphersuite description in Section 6.2 is also applicable to this | ciphersuite description in Section 6.2 is also applicable to this | |||
| section. | section. | |||
| When using certificates, IoT devices MUST provide support for a | When using certificates, IoT devices MUST provide support for a | |||
| server certificate chain of at least 3 not including the trust anchor | server certificate chain of at least 3 not including the trust anchor | |||
| and MAY reject connections from servers offering chains longer than | and MAY reject connections from servers offering chains longer than | |||
| skipping to change at page 15, line 17 ¶ | skipping to change at page 19, line 37 ¶ | |||
| RFC 6066 [RFC6066] allows to avoid sending client-side certificates | RFC 6066 [RFC6066] allows to avoid sending client-side certificates | |||
| and uses URLs instead. This reduces the over-the-air transmission. | and uses URLs instead. This reduces the over-the-air transmission. | |||
| Note that the TLS cached info extension does not provide any help | Note that the TLS cached info extension does not provide any help | |||
| with caching client certificates. | with caching client certificates. | |||
| Recommendation: Add support for client certificate URLs for those | Recommendation: Add support for client certificate URLs for those | |||
| environments where client-side certificates are used. | environments where client-side certificates are used. | |||
| 6.3.2. Trusted CA Indication | 6.3.2. Trusted CA Indication | |||
| RFC 6066 allows clients to indicate what trust anchor they support. | RFC 6066 [RFC6066] allows clients to indicate what trust anchor they | |||
| With certificate-based authentication a DTLS server conveys its end | support. With certificate-based authentication a DTLS server conveys | |||
| entity certificate to the client during the DTLS exchange provides. | its end entity certificate to the client during the DTLS exchange | |||
| Since the server does not necessarily know what trust anchors the | provides. Since the server does not necessarily know what trust | |||
| client has stored it includes intermediate CA certs in the | anchors the client has stored it includes intermediate CA certs in | |||
| certificate payload as well to facilitate with certification path | the certificate payload as well to facilitate with certification path | |||
| construction and path validation. | construction and path validation. | |||
| Today, in most IoT deployments there is a fairly static relationship | Today, in most IoT deployments there is a fairly static relationship | |||
| between the IoT device (and the software running on them) and the | between the IoT device (and the software running on them) and the | |||
| server- side infrastructure and no such dynamic indication of trust | server- side infrastructure and no such dynamic indication of trust | |||
| anchors is needed. | anchors is needed. | |||
| Recommendation: For IoT deployments where clients talk to a fixed, | Recommendation: For IoT deployments where clients talk to a fixed, | |||
| pre-configured set of servers and where a software update mechanism | pre-configured set of servers and where a software update mechanism | |||
| is available this extension is not recommended. Environments where | is available this extension is not recommended. Environments where | |||
| the client needs to interact with dynamically discovered DTLS servers | the client needs to interact with dynamically discovered TLS/DTLS | |||
| this extension may be useful to reduce the communication overhead. | servers this extension may be useful to reduce the communication | |||
| Note, however, in that case the TLS cached info extension may help to | overhead. Note, however, in that case the TLS cached info extension | |||
| reduce the communication overhead for everything but the first | may help to reduce the communication overhead for everything but the | |||
| protocol interaction. | first protocol interaction. | |||
| 7. Signature Algorithm Extension | 7. Signature Algorithm Extension | |||
| The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of | The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of | |||
| RFC 5246 [RFC5246], allows the client to indicate to the server which | RFC 5246 [RFC5246], allows the client to indicate to the server which | |||
| signature/hash algorithm pairs may be used in digital signatures. | signature/hash algorithm pairs may be used in digital signatures. | |||
| The client MUST send this extension to select the use of SHA-256 | The client MUST send this extension to select the use of SHA-256 | |||
| since otherwise absent this extension RFC 5246 defaults to SHA-1 / | since otherwise absent this extension RFC 5246 defaults to SHA-1 / | |||
| ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms. | ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms. | |||
| The "signature_algorithms" extension is not applicable to the PSK- | The "signature_algorithms" extension is not applicable to the PSK- | |||
| based ciphersuite described in Section 6.1. | based ciphersuite described in Section 6.1. | |||
| 8. Error Handling | 8. Error Handling | |||
| DTLS uses the Alert protocol to convey error messages and specifies a | TLS/DTLS uses the Alert protocol to convey error messages and | |||
| longer list of errors. However, not all error messages defined in | specifies a longer list of errors. However, not all error messages | |||
| the TLS specification are applicable to this profile. In general, | defined in the TLS/DTLS specification are applicable to this profile. | |||
| there are two categories of errors (as defined in Section 7.2 of RFC | In general, there are two categories of errors (as defined in | |||
| 5246), namely fatal errors and warnings. Alert messages with a level | Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert | |||
| of fatal result in the immediate termination of the connection. If | messages with a level of fatal result in the immediate termination of | |||
| possible, developers should try to develop strategies to react to | the connection. If possible, developers should try to develop | |||
| those fatal errors, such as re-starting the handshake or informing | strategies to react to those fatal errors, such as re-starting the | |||
| the user using the (often limited) user interface. Warnings may be | handshake or informing the user using the (often limited) user | |||
| ignored by the application since many IoT devices will either have | interface. Warnings may be ignored by the application since many IoT | |||
| limited ways to log errors or no ability at all. In any case, | devices will either have limited ways to log errors or no ability at | |||
| implementers have to carefully evaluate the impact of errors and ways | all. In any case, implementers have to carefully evaluate the impact | |||
| to remedy the situation since a commonly used approach for delegating | of errors and ways to remedy the situation since a commonly used | |||
| decision making to users is difficult (or impossible) to accomplish | approach for delegating decision making to users is difficult (or | |||
| in a timely fashion. | impossible) to accomplish in a timely fashion. | |||
| All error messages marked as RESERVED are only supported for | All error messages marked as RESERVED are only supported for | |||
| backwards compatibility with SSL and are therefore not applicable to | backwards compatibility with SSL and are therefore not applicable to | |||
| this profile. Those include decryption_failed_RESERVED, | this profile. Those include decryption_failed_RESERVED, | |||
| no_certificate_RESERVE, and export_restriction_RESERVED. | no_certificate_RESERVE, and export_restriction_RESERVED. | |||
| A number of the error messages are applicable only for certificate- | A number of the error messages are applicable only for certificate- | |||
| based authentication ciphersuites. Hence, for PSK and raw public key | based authentication ciphersuites. Hence, for PSK and raw public key | |||
| use the following error messages are not applicable: | use the following error messages are not applicable: | |||
| skipping to change at page 16, line 33 ¶ | skipping to change at page 21, line 4 ¶ | |||
| All error messages marked as RESERVED are only supported for | All error messages marked as RESERVED are only supported for | |||
| backwards compatibility with SSL and are therefore not applicable to | backwards compatibility with SSL and are therefore not applicable to | |||
| this profile. Those include decryption_failed_RESERVED, | this profile. Those include decryption_failed_RESERVED, | |||
| no_certificate_RESERVE, and export_restriction_RESERVED. | no_certificate_RESERVE, and export_restriction_RESERVED. | |||
| A number of the error messages are applicable only for certificate- | A number of the error messages are applicable only for certificate- | |||
| based authentication ciphersuites. Hence, for PSK and raw public key | based authentication ciphersuites. Hence, for PSK and raw public key | |||
| use the following error messages are not applicable: | use the following error messages are not applicable: | |||
| o bad_certificate, | o bad_certificate, | |||
| o unsupported_certificate, | o unsupported_certificate, | |||
| o certificate_revoked, | o certificate_revoked, | |||
| o certificate_expired, | o certificate_expired, | |||
| o certificate_unknown, | o certificate_unknown, | |||
| o unknown_ca, and | o unknown_ca, and | |||
| o access_denied. | o access_denied. | |||
| Since this profile does not make use of compression at the TLS layer | Since this profile does not make use of compression at the TLS layer | |||
| the decompression_failure error message is not applicable either. | the decompression_failure error message is not applicable either. | |||
| RFC 4279 introduced a new alert message unknown_psk_identity for PSK | RFC 4279 introduced a new alert message unknown_psk_identity for PSK | |||
| ciphersuites. As stated in Section 2 of RFC 4279 the | ciphersuites. As stated in Section 2 of RFC 4279 the | |||
| decryption_error error message may also be used instead. For this | decryption_error error message may also be used instead. For this | |||
| profile the TLS server MUST return the decryption_error error message | profile the TLS server MUST return the decryption_error error message | |||
| instead of the unknown_psk_identity. | instead of the unknown_psk_identity since the two mechanisms exist | |||
| and provide the same functionality. | ||||
| Furthermore, the following errors should not occur with devices and | Furthermore, the following errors should not occur with devices and | |||
| servers supporting this specification but implementations MUST be | servers supporting this specification but implementations MUST be | |||
| prepared to process these errors to deal with servers that are not | prepared to process these errors to deal with servers that are not | |||
| compliant to the profiles in this document: | compliant to the profiles in this document: | |||
| protocol_version: While this document focuses only on one version of | protocol_version: While this document focuses only on one version of | |||
| the DTLS protocol, namely version 1.2, ongoing work on TLS/DTLS | the TLS/DTLS protocol, namely version 1.2, ongoing work on TLS/ | |||
| 1.3 is taking place. | DTLS 1.3 is in progress at the time of writing. | |||
| insufficient_security: This error message indicates that the server | insufficient_security: This error message indicates that the server | |||
| requires ciphers to be more secure. This document specifies only | requires ciphers to be more secure. This document specifies only | |||
| only one ciphersuite per profile but it is likely that additional | only one ciphersuite per profile but it is likely that additional | |||
| ciphtersuites get added over time. | ciphtersuites get added over time. | |||
| user_canceled: Many IoT devices are unattended. | user_canceled: Many IoT devices are unattended and hence this error | |||
| message is unlikely to occur. | ||||
| 9. Session Resumption | 9. Session Resumption | |||
| Session resumption is a feature of DTLS that allows a client to | Session resumption is a feature of TLS/DTLS that allows a client to | |||
| continue with an earlier established session state. The resulting | continue with an earlier established session state. The resulting | |||
| exchange is shown in Figure 5. In addition, the server may choose | exchange is shown in Figure 8. In addition, the server may choose | |||
| not to do a cookie exchange when a session is resumed. Still, | not to do a cookie exchange when a session is resumed. Still, | |||
| clients have to be prepared to do a cookie exchange with every | clients have to be prepared to do a cookie exchange with every | |||
| handshake. | handshake. | |||
| Client Server | Client Server | |||
| ------ ------ | ------ ------ | |||
| ClientHello --------> | ClientHello --------> | |||
| ServerHello | ServerHello | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| <-------- Finished | <-------- Finished | |||
| [ChangeCipherSpec] | [ChangeCipherSpec] | |||
| Finished --------> | Finished --------> | |||
| Application Data <-------> Application Data | Application Data <-------> Application Data | |||
| Figure 5: DTLS Session Resumption. | Figure 8: DTLS Session Resumption. | |||
| Clients MUST implement session resumption to improve the performance | Clients MUST implement session resumption to improve the performance | |||
| of the handshake (in terms of reduced number of message exchanges, | of the handshake (in terms of reduced number of message exchanges, | |||
| lower computational overhead, and less bandwidth conserved). | lower computational overhead, and less bandwidth conserved). | |||
| Since the communication model described in Section 4 does not assume | Since the communication model described in Section 4 does not assume | |||
| that the server is constrained RFC 5077 [RFC5077] specifying TLS | that the server is constrained, RFC 5077 [RFC5077] specifying TLS/ | |||
| session resumption without server-side state is not utilized by this | DTLS session resumption without server-side state is not utilized by | |||
| profile. | this profile. | |||
| 10. Compression | 10. Compression | |||
| [I-D.ietf-uta-tls-bcp] recommends to always disable DTLS-level | Section 3.3 of [I-D.ietf-uta-tls-bcp] recommends to disable TLS/DTLS- | |||
| compression due to attacks. For IoT applications compression at the | level compression due to attacks, such as CRIME. For IoT | |||
| DTLS is not needed since application layer protocols are highly | applications compression at the TLS/DTLS layer is not needed since | |||
| optimized and the compression algorithms at the DTLS layer increase | application layer protocols are highly optimized and the compression | |||
| code size and complexity. | algorithms at the DTLS layer increases code size and complexity. | |||
| This DTLS client profile does not include DTLS layer compression. | Recommendation: This TLS/DTLS profile MUST NOT implement and use TLS/ | |||
| DTLS layer compression. | ||||
| 11. Perfect Forward Secrecy | 11. Perfect Forward Secrecy | |||
| Perfect forward secrecy (PFS) is a property that preserves the | Perfect forward secrecy (PFS) is a property that preserves the | |||
| confidentiality of past conversations even in situations where the | confidentiality of past conversations even in situations where the | |||
| long-term secret is compromised. | long-term secret is compromised. | |||
| The PSK ciphersuite recommended in Section 6.1 does not offer this | The PSK ciphersuite recommended in Section 6.1 does not offer this | |||
| property since it does not utilize a Diffie-Hellman exchange. New | property since it does not utilize a Diffie-Hellman exchange. New | |||
| ciphersuites that support PFS for PSK-based authentication, such as | ciphersuites that support PFS for PSK-based authentication, such as | |||
| proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become | proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become | |||
| available as standardized ciphersuite in the (near) future. | available as standardized ciphersuite in the (near) future. The | |||
| recommended PSK-based ciphersuite offers excellent performance, a | ||||
| very small memory footprint, and has the lowest on the wire overhead | ||||
| at the expense of not using any public cryptography. For deployments | ||||
| where public key cryptography is acceptable the raw public might | ||||
| offer an acceptable middleground between the PSK ciphersuite in terms | ||||
| of out-of-band validation and the functionality offered by asymmetric | ||||
| cryptography. | ||||
| The use of PFS is a trade-off decision since on one hand the | The use of PFS is a trade-off decision since on one hand the | |||
| compromise of long-term secrets of embedded devices is more likely | compromise of long-term secrets of embedded devices is more likely | |||
| than with many other Internet hosts but on the other hand a Diffie- | than with many other Internet hosts but on the other hand a Diffie- | |||
| Hellman exchange requires ephemeral key pairs to be generated, which | Hellman exchange requires ephemeral key pairs to be generated, which | |||
| is demanding from a performance point of view. For performance | is demanding from a performance point of view. For performance | |||
| reasons some implementations re-use key pairs over multiple exchanges | reasons some implementations re-use key pairs over multiple exchanges | |||
| (rather than generating new keys for each exchange) for the obvious | (rather than generating new keys for each exchange) for the obvious | |||
| performance improvement. Note, however, that such key re-use over | performance improvement. Note, however, that such key re-use over | |||
| long periods voids the benefits of forward secrecy when an attack | long periods voids the benefits of forward secrecy when an attack | |||
| gains access to this DH key pair. | gains access to this DH key pair. | |||
| The impact of the disclosure of past conversations and the desire to | The impact of the disclosure of past conversations and the desire to | |||
| increase the cost for pervasive monitoring (as demanded by [RFC7258]) | increase the cost for pervasive monitoring (as demanded by [RFC7258]) | |||
| has to be taken into account when making a deployment decision. | has to be taken into account when making a deployment decision. | |||
| This specification recommends the use of the ciphersuites listed in | Recommendation: Client implementations claiming support of this | |||
| Section 6. | profile MUST implement the ciphersuites listed in Section 6 according | |||
| to the selected credential type. | ||||
| 12. Keep-Alive | 12. Keep-Alive | |||
| RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the | RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the | |||
| other peer is still alive. The same mechanism can also be used to | other peer is still alive. The same mechanism can also be used to | |||
| perform Path Maximum Transmission Unit (MTU) Discovery. | perform Path Maximum Transmission Unit (MTU) Discovery. | |||
| A recommendation about the use of RFC 6520 depends on the type of | A recommendation about the use of RFC 6520 depends on the type of | |||
| message exchange an IoT device performs. There are three types of | message exchange an IoT device performs. There are three types of | |||
| exchanges that need to be analysed: | exchanges that need to be analysed: | |||
| Client-Initiated, One-Shot Messages | Client-Initiated, One-Shot Messages | |||
| This is a common communication pattern where IoT devices upload | This is a common communication pattern where IoT devices upload | |||
| data to a server on the Internet on an irregular basis. The | data to a server on the Internet on an irregular basis. The | |||
| communication may be triggered by specific events, such as opening | communication may be triggered by specific events, such as opening | |||
| a door. | a door. | |||
| Since the upload happens on an irregular and unpredictable basis | Since the upload happens on an irregular and unpredictable basis | |||
| and due to renumbering and Network Address Translation (NAT) a new | and due to renumbering and Network Address Translation (NAT) the | |||
| DTLS session or DTLS session resumption can be used. | DTLS handshake may need to be re-started (ideally using session | |||
| resumption, if possible). | ||||
| In this case there is no use for a keep-alive extension for this | In this case there is no use for a keep-alive extension for this | |||
| scenario. | scenario. | |||
| Client-Initiated, Regular Data Uploads | Client-Initiated, Regular Data Uploads | |||
| This is a variation of the previous case whereby data gets | This is a variation of the previous case whereby data gets | |||
| uploaded on a regular basis, for example, based on frequent | uploaded on a regular basis, for example, based on frequent | |||
| temperature readings. If neither NAT bindings nor IP address | temperature readings. If neither NAT bindings nor IP address | |||
| changes occurred then the DTLS record layer will not notice any | changes occurred then the record layer will not notice any | |||
| changes. For the case where the IP address and port number | changes. For the case where the IP address and port number | |||
| changes, it is necessary to re-create the DTLS record layer using | changes, it is necessary to re-create the record layer using | |||
| session resumption. | session resumption. | |||
| In this scenario there is no use for a keep-alive extension. It | In this scenario there is no use for a keep-alive extension. It | |||
| is also very likely that the device will enter a sleep cycle in | is also very likely that the device will enter a sleep cycle in | |||
| between data transmissions to keep power consumption low. | between data transmissions to keep power consumption low. | |||
| Server-Initiated Messages | Server-Initiated Messages | |||
| In the two previous scenarios the client initiated the protocol | In the two previous scenarios the client initiated the protocol | |||
| interaction but in this case we consider server-initiated | interaction but in this case we consider server-initiated | |||
| messages. Since messages to the client may get blocked by | messages. Since messages to the client may get blocked by | |||
| intermediaries, such as NATs (including IPv4/IPv6 protocol | intermediaries, such as NATs (including IPv4/IPv6 protocol | |||
| translators) and stateful packet filtering firewalls, the initial | translators) and stateful packet filtering firewalls, the initial | |||
| connection setup is triggered by the client and then kept alive. | connection setup is triggered by the client and then kept alive. | |||
| Since state at middleboxes expires fairly quickly (according to | Since state at middleboxes expires fairly quickly (according to | |||
| measurements described in [HomeGateway]), regular heartbeats are | measurements described in [HomeGateway]), regular heartbeats are | |||
| necessary whereby these keep-alive messages may be exchanged at | necessary whereby these keep-alive messages may be exchanged at | |||
| the application layer or within DTLS itself. | the application layer or within DTLS itself. | |||
| For this message exchange pattern the use of DTLS heartbeat | For this message exchange pattern the use of DTLS heartbeat | |||
| messages is quite useful. The MTU discovery mechanism, which is | messages is quite useful but may interfere with registrations kept | |||
| also part of [RFC6520], is less likely to be relevant since for | at the application layer (for example when the CoAP resource | |||
| many IoT deployments the most constrained link is the wireless | directory is used). The MTU discovery mechanism, which is also | |||
| part of [RFC6520], is less likely to be relevant since for many | ||||
| IoT deployments the most constrained link is the wireless | ||||
| interface between the IoT device and the network itself (rather | interface between the IoT device and the network itself (rather | |||
| than some links along the end-to-end path). Only in more complex | than some links along the end-to-end path). Only in more complex | |||
| network topologies, such as multi-hop mesh networks, the situation | network topologies, such as multi-hop mesh networks, path MTU | |||
| is. | discovery might be appropriate. It also has to be noted that DTLS | |||
| itself already provides a basic path discovery mechanism (see | ||||
| Section 4.1.1.1 of RFC 6347 by using the fragmentation capability | ||||
| of the handshake protocol). | ||||
| For server-initiated messages the heartbeat extension can be | For server-initiated messages the heartbeat extension can be | |||
| RECOMMENDED. | RECOMMENDED. | |||
| 13. Timeouts | 13. Timeouts | |||
| To connect to the Internet a variety of wired and wireless | To connect to the Internet a variety of wired and wireless | |||
| technologies are available. Many of the low power radio | technologies are available. Many of the low power radio | |||
| technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support | technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support | |||
| small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as | small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as | |||
| skipping to change at page 20, line 48 ¶ | skipping to change at page 25, line 34 ¶ | |||
| To deal with the unreliable message delivery provided by UDP, DTLS | To deal with the unreliable message delivery provided by UDP, DTLS | |||
| adds timeouts and re-transmissions, as described in Section 4.2.4 of | adds timeouts and re-transmissions, as described in Section 4.2.4 of | |||
| [RFC6347]. Although the timeout values are implementation specific, | [RFC6347]. Although the timeout values are implementation specific, | |||
| recommendations are provided in Section 4.2.4.1 of [RFC6347], with an | recommendations are provided in Section 4.2.4.1 of [RFC6347], with an | |||
| initial timer value of 1 second and twice the value at each | initial timer value of 1 second and twice the value at each | |||
| retransmission up to no less than 60 seconds. Due to the nature of | retransmission up to no less than 60 seconds. Due to the nature of | |||
| some radio technologies, these values are too aggressive and lead to | some radio technologies, these values are too aggressive and lead to | |||
| spurious failures when messages in flight need longer. | spurious failures when messages in flight need longer. | |||
| Choosing appropriate timeout values is difficult with infrequent data | ||||
| transmissions, changing network conditions, and large variance in | ||||
| latency. This specification therefore RECOMMENDS an initial timer | ||||
| value of 10 seconds with exponential back off up to no less then 60 | ||||
| seconds. | ||||
| Note: If a round-trip time estimator (such as proposed in | Note: If a round-trip time estimator (such as proposed in | |||
| [I-D.bormann-core-cocoa]) is available in the protocol stack of the | [I-D.bormann-core-cocoa]) is available in the protocol stack of the | |||
| device, it could be used to dynamically update the setting of the | device, it could be used to dynamically update the setting of the | |||
| retransmit timeout. | retransmit timeout. | |||
| Appendix A provides additional information for carrying DTLS over | Recommendation: Choosing appropriate timeout values is difficult with | |||
| SMS. | infrequent data transmissions, changing network conditions, and large | |||
| variance in latency. This specification therefore RECOMMENDS an | ||||
| initial timer value of 10 seconds with exponential back off up to no | ||||
| less then 60 seconds. Appendix A provides additional normative text | ||||
| for carrying DTLS over SMS. | ||||
| 14. Random Number Generation | 14. Random Number Generation | |||
| The DTLS protocol requires random numbers to be available during the | The TLS/DTLS protocol requires random numbers to be available during | |||
| protocol run. For example, during the ClientHello and the | the protocol run. For example, during the ClientHello and the | |||
| ServerHello exchange the client and the server exchange random | ServerHello exchange the client and the server exchange random | |||
| numbers. Also, the use of the Diffie-Hellman exchange requires | numbers. Also, the use of the Diffie-Hellman exchange requires | |||
| random numbers during the key pair generation. Special care has to | random numbers during the key pair generation. Special care has to | |||
| be paid when generating random numbers in embedded systems as many | be paid when generating random numbers in embedded systems as many | |||
| entropy sources available on desktop operating systems or mobile | entropy sources available on desktop operating systems or mobile | |||
| devices might be missing, as described in [Heninger]. Consequently, | devices might be missing, as described in [Heninger]. Consequently, | |||
| if not enough time is given during system start time to fill the | if not enough time is given during system start time to fill the | |||
| entropy pool then the output might be predictable and repeatable, for | entropy pool then the output might be predictable and repeatable, for | |||
| example leading to the same keys generated again and again. | example leading to the same keys generated again and again. | |||
| Recommendation: IoT devices using DTLS MUST offer ways to generate | ||||
| quality random numbers. Guidelines and requirements for random | ||||
| number generation can be found in RFC 4086 [RFC4086]. | ||||
| It is important to note that sources contributing to the randomness | It is important to note that sources contributing to the randomness | |||
| pool on laptops, or desktop PCs are not available on many IoT device, | pool on laptops, or desktop PCs are not available on many IoT device, | |||
| such as mouse movement, timing of keystrokes, air turbulence on the | such as mouse movement, timing of keystrokes, air turbulence on the | |||
| movement of hard drive heads, etc. Other sources have to be found or | movement of hard drive heads, etc. Other sources have to be found or | |||
| dedicated hardware has to be added. | dedicated hardware has to be added. | |||
| The ClientHello and the ServerHello message contains the 'Random' | The ClientHello and the ServerHello messages contains the 'Random' | |||
| structure, which has two components: gmt_unix_time and a random | structure, which has two components: gmt_unix_time and a random | |||
| sequence of 28 random bytes. gmt_unix_time holds the current time | sequence of 28 random bytes. gmt_unix_time holds the current time | |||
| and date in standard UNIX 32-bit format (seconds since the midnight | and date in standard UNIX 32-bit format (seconds since the midnight | |||
| starting Jan 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues | starting Jan 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues | |||
| that the entire value the ClientHello.Random and ServerHello.Random | that the entire ClientHello.Random value (including gmt_unix_time) | |||
| fields, including gmt_unix_time, should be set to a cryptographically | should be set to a cryptographically random sequence because of | |||
| random sequence because of privacy concerns (fingerprinting). Since | privacy concerns regarding device fingerprinting. Since many IoT | |||
| many IoT devices do not have access to a real-time clock this | devices do not have access to a real-time clock this recommendation | |||
| recommendation is even more relevant in the embedded systems | it is RECOMMENDED to follow the guidance outlined in | |||
| environment. | [I-D.mathewson-no-gmtunixtime] regarding the content of the | |||
| ClientHello.Random field. However, for the ServerHello.Random | ||||
| structure it is RECOMMENDED to maintain the existing structure with | ||||
| gmt_unix_time followed by a random sequence of 28 random bytes since | ||||
| the client can use the received time information to securely obtain | ||||
| time information. | ||||
| 15. Truncated MAC Extension | Recommendation: IoT devices using TLS/DTLS MUST offer ways to | |||
| generate quality random numbers. Guidelines and requirements for | ||||
| random number generation can be found in RFC 4086 [RFC4086]. | ||||
| The truncated MAC extension was introduced with RFC 6066 with the | 15. Truncated MAC and Encrypt-then-MAC Extension | |||
| goal to reduces the size of the MAC used at the Record Layer. This | ||||
| extension was developed for TLS ciphersuites that used older modes of | ||||
| operation where the MAC and the encryption operation was performed | ||||
| independently. | ||||
| For CoAP, however, the recommended ciphersuites use the newer | The truncated MAC extension was introduced with RFC 6066 [RFC6066] | |||
| with the goal to reduce the size of the MAC used at the Record Layer. | ||||
| This extension was developed for TLS ciphersuites that used older | ||||
| modes of operation where the MAC and the encryption operation was | ||||
| performed independently. | ||||
| The recommended ciphersuites in this document use the newer | ||||
| Authenticated Encryption with Associated Data (AEAD) construct, | Authenticated Encryption with Associated Data (AEAD) construct, | |||
| namely the CBC-MAC mode (CCM) with eight-octet authentication tags. | namely the CBC-MAC mode (CCM) with eight-octet authentication tags, | |||
| Furthermore, the extension [RFC7366] introducing the encrypt-then-MAC | and are therefore not appliable to the truncated MAC extension. | |||
| security mechanism (instead of the MAC-then-encrypt) is also not | ||||
| applicable for this profile. | RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead | |||
| of the previously used MAC-then-encrypt) since the MAC-then-encrypt | ||||
| mechanism has been the subject of a number of security | ||||
| vulnerabilities. RFC 7366 is, however, also not applicable to the | ||||
| AEAD ciphers recommended in this document. | ||||
| Recommendation: Since this profile only supports AEAD ciphersuites | Recommendation: Since this profile only supports AEAD ciphersuites | |||
| this extension is not applicable. | these two extensions are not applicable. | |||
| 16. Server Name Indication (SNI) | 16. Server Name Indication (SNI) | |||
| This RFC 6066 extension defines a mechanism for a client to tell a | This RFC 6066 extension defines a mechanism for a client to tell a | |||
| TLS server the name of the server it wants to contact. This is a | TLS/DTLS server the name of the server it wants to contact. This is | |||
| useful extension for many hosting environments where multiple virtual | a useful extension for many hosting environments where multiple | |||
| servers are run on single IP address. | virtual servers are run on single IP address. | |||
| Recommendation: Unless it is known that a DTLS client does not | Recommendation: Unless it is known that a TLS/DTLS client does not | |||
| interact with a server in a hosting environment that requires such an | interact with a server in a hosting environment we RECOMMEND clients | |||
| extension we advice to offer support for the SNI extension in this | to implement the SNI extension. | |||
| profile. | ||||
| 17. Maximum Fragment Length Negotiation | 17. Maximum Fragment Length Negotiation | |||
| This RFC 6066 extension lowers the maximum fragment length support | This RFC 6066 extension lowers the maximum fragment length support | |||
| needed for the Record Layer from 2^14 bytes to 2^9 bytes. | needed for the Record Layer from 2^14 bytes to 2^9 bytes. | |||
| This is a very useful extension that allows the client to indicate to | This is a very useful extension that allows the client to indicate to | |||
| the server how much maximum memory buffers it uses for incoming | the server how much maximum memory buffers it uses for incoming | |||
| messages. Ultimately, the main benefit of this extension is it to | messages. Ultimately, the main benefit of this extension is it to | |||
| allows client implementations to lower their RAM requirements since | allows client implementations to lower their RAM requirements since | |||
| the client does not need to accept packets of large size (such as 16k | the client does not need to accept packets of large size (such as 16k | |||
| packets as required by plain TLS/DTLS). | packets as required by plain TLS/DTLS). | |||
| Recommendation: Client implementations MUST support this extension. | Recommendation: Client implementations MUST support this extension. | |||
| 18. TLS Session Hash | 18. Session Hash | |||
| The TLS master secret is not cryptographically bound to important | In order to begin connection protection, the Record Protocol requires | |||
| session parameters such as the client and server identities. This | specification of a suite of algorithms, a master secret, and the | |||
| client and server random values. The algorithm for computing the | ||||
| master secret is defined in Section 8.1 of RFC 5246 but only includes | ||||
| a small number of parameters exchanged during the handshake and does | ||||
| not include parameters like the client and server identities. This | ||||
| can be utilized by an attacker to mount a man-in-the-middle attack | can be utilized by an attacker to mount a man-in-the-middle attack | |||
| since the master secret is not guaranteed to be unique across | since the master secret is not guaranteed to be unique across | |||
| sessions. | sessions, as discovered in the 'Triple Handshake' attack | |||
| [Tripple-HS]. | ||||
| [I-D.ietf-tls-session-hash] defines a TLS extension that binds the | [I-D.ietf-tls-session-hash] defines a TLS extension that binds the | |||
| master secret to a log of the full handshake that computes it, thus | master secret to a log of the full handshake that computes it, thus | |||
| preventing such attacks. | preventing such attacks. | |||
| Recommendation: Client implementations SHOULD implement this | Recommendation: Client implementations SHOULD implement this | |||
| extension even though the ciphersuites recommended by this profile | extension even though the ciphersuites recommended by this profile | |||
| are not vulnerable to this attack. For Diffie-Hellman-based | are not vulnerable to this attack. For Diffie-Hellman-based | |||
| ciphersuites the keying material is contributed by both parties and | ciphersuites the keying material is contributed by both parties and | |||
| in case of the pre-shared secret key ciphersuite both parties need to | in case of the pre-shared secret key ciphersuite both parties need to | |||
| be in possession of the shared secret to ensure that the handshake | be in possession of the shared secret to ensure that the handshake | |||
| completes successfully. It is, however, possible that some | completes successfully. It is, however, possible that some | |||
| application layer protocols will tunnel other authentication | application layer protocols will tunnel other authentication | |||
| protocols on top of DTLS making this attack relevant again. | protocols on top of DTLS making this attack relevant again. | |||
| 19. Re-Negotiation Attacks | 19. Re-Negotiation Attacks | |||
| TLS and DTLS allows a client and a server who already have a TLS | TLS/DTLS allows a client and a server who already have a TLS/DTLS | |||
| connection to negotiate new parameters, generate new keys, etc by | connection to negotiate new parameters, generate new keys, etc by | |||
| using a feature in TLS called re-negotiation. Renegotiation happens | using the re-negotiation feature. Renegotiation happens in the | |||
| in the existing TLS connection, with the new handshake packets being | existing connection, with the new handshake packets being encrypted | |||
| encrypted along with application data. Upon completion of the re- | along with application data. Upon completion of the re-negotiation | |||
| negotiation procedure the new channel replaces the old channel. | procedure the new channel replaces the old channel. | |||
| As described in RFC 5746 [RFC5746] there is no cryptographic binding | As described in RFC 5746 [RFC5746] there is no cryptographic binding | |||
| between the two handshakes, although the new handshake is carried out | between the two handshakes, although the new handshake is carried out | |||
| using the cryptographic parameters established by the original | using the cryptographic parameters established by the original | |||
| handshake. | handshake. | |||
| To prevent the TLS re-negotiation attack [RFC5746] this specification | Recommendation: To prevent the re-negotiation attack [RFC5746] this | |||
| RECOMMENDS not to use the TLS renegotigation feature. Clients MUST | specification RECOMMENDS to disable the TLS renegotigation feature. | |||
| respond to server-initiated re-negotiation attempts with an Alert | Clients MUST respond to server-initiated re-negotiation attempts with | |||
| message (no_renegotiation) and clients MUST NOT initiate them. | an alert message (no_renegotiation) and clients MUST NOT initiate | |||
| them. | ||||
| 20. Downgrading Attacks | 20. Downgrading Attacks | |||
| [Editor's Note: Additional text needed.] | When a client sends a ClientHello with a version higher than the | |||
| highest version known to the server, the server is supposed to reply | ||||
| with ServerHello.version equal to the highest version known to the | ||||
| server and the handshake can proceed. This behaviour is known as | ||||
| version tolerance. Version-intolerance is when the server (or a | ||||
| middlebox) breaks the handshake when it sees a ClientHello.version | ||||
| higher than what it knows about. This is the behaviour that leads | ||||
| some clients to re-run the handshake with lower version. As a | ||||
| result, a potential security vulnerability is introduced when a | ||||
| system is running an old TLS/SSL version (e.g., because of the need | ||||
| to integrate with legacy systems). In the worst case, this allows an | ||||
| attacker to downgrade the protocol handshake to SSL 3.0. SSL 3.0 is | ||||
| so broken that there is no secure cipher available for it (see | ||||
| [I-D.ietf-tls-sslv3-diediedie]). | ||||
| This specification demands version 1.2 of DTLS to be used and DTLS | The above-described downgrade vulnerability is solved by the TLS | |||
| version 1.1 is not supported. Unlike with TLS where many earlier | Fallback Signaling Cipher Suite Value (SCSV) | |||
| versions exist there is no risk of downgrading to an older version of | [I-D.ietf-tls-downgrade-scsv] extension. However, the solution is | |||
| DTLS in context of this profile. The work described in | not appliable to implementations conforming to this profile since the | |||
| [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to | version negotiation MUST use TLS/DTLS version 1.2 (or higher). More | |||
| this environment since there is no legacy DTLS/TLS IoT server | specifically, this implies: | |||
| infrastructure when this profiled is followed. | ||||
| o Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in | ||||
| the ClientHello. | ||||
| o Clients MUST NOT retry a failed negotiation offering a TLS/DTLS | ||||
| version lower than 1.2. | ||||
| o Servers MUST fail the handshake by sending a protocol_version | ||||
| fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated. | ||||
| Note that the aborted connection is non-resumable. | ||||
| If at some time in the future the TLS/DTLS 1.2 profile reaches the | ||||
| quality of SSL 3.0 a software update mechanism is needed since | ||||
| constrained devices are unlikely to run multiple TLS/DTLS versions | ||||
| due to memory size restrictions. | ||||
| 21. Crypto Agility | 21. Crypto Agility | |||
| This document recommends software and chip manufacturers to implement | This document recommends software and chip manufacturers to implement | |||
| AES and the CCM mode of operation. This document references the CoAP | AES and the CCM mode of operation. This document references the CoAP | |||
| recommended ciphersuite choices, which have been selected based on | recommended ciphersuite choices, which have been selected based on | |||
| implementation and deployment experience from the IoT community. | implementation and deployment experience from the IoT community. | |||
| Over time the preference for algorithms will, however, change. Not | Over time the preference for algorithms will, however, change. Not | |||
| all components of a ciphersuite are likely to change at the same | all components of a ciphersuite are likely to change at the same | |||
| speed. Changes are more likely expected for ciphers, the mode of | speed. Changes are more likely expected for ciphers, the mode of | |||
| skipping to change at page 25, line 4 ¶ | skipping to change at page 30, line 25 ¶ | |||
| o Offer access to building blocks in addition (or as an alternative) | o Offer access to building blocks in addition (or as an alternative) | |||
| to the complete functionality. For example, a chip manufacturer | to the complete functionality. For example, a chip manufacturer | |||
| who gives developers access to an the AES crypto function can use | who gives developers access to an the AES crypto function can use | |||
| it in functions to build an efficient AES-GCM implementations. | it in functions to build an efficient AES-GCM implementations. | |||
| Another example is to make a special instruction available that | Another example is to make a special instruction available that | |||
| increases the speed of speed-up carryless multiplications. | increases the speed of speed-up carryless multiplications. | |||
| As a recommendation for developers and product architects we | As a recommendation for developers and product architects we | |||
| recommend that sufficient headroom is provided to allow an upgrade to | recommend that sufficient headroom is provided to allow an upgrade to | |||
| a newer cryptographic algorithms over the lifetime of the product. | a newer cryptographic algorithms over the lifetime of the product. | |||
| As an example, while AES-CCM is recommended thoughout this | As an example, while AES-CCM is recommended thoughout this | |||
| specification future products might use the ChaCha20 cipher in | specification future products might use the ChaCha20 cipher in | |||
| combination with the Poly1305 authenticator | combination with the Poly1305 authenticator | |||
| [I-D.irtf-cfrg-chacha20-poly1305]. The assumption is made that a | [I-D.irtf-cfrg-chacha20-poly1305]. The assumption is made that a | |||
| robust software update mechanism is offered. | robust software update mechanism is offered. | |||
| 22. Key Length Recommendations | 22. Key Length Recommendations | |||
| RFC 4492 [RFC4492] gives approximate comparable key sizes for | RFC 4492 [RFC4492] gives approximate comparable key sizes for | |||
| symmetric- and asymmetric-key cryptosystems based on the best-known | symmetric- and asymmetric-key cryptosystems based on the best-known | |||
| algorithms for attacking them. While other publications suggest | algorithms for attacking them. While other publications suggest | |||
| slightly different numbers, such as [Keylength], the approximate | slightly different numbers, such as [Keylength], the approximate | |||
| relationship still holds true. Figure 6 illustrates the comparable | relationship still holds true. Figure 9 illustrates the comparable | |||
| key sizes in bits. | key sizes in bits. | |||
| At the time of writing the key size recommendations for use with TLS- | At the time of writing the key size recommendations for use with TLS- | |||
| based ciphers found in [I-D.ietf-uta-tls-bcp] recommend DH key | based ciphers found in [I-D.ietf-uta-tls-bcp] recommend DH key | |||
| lengths of at least 2048 bit, which corresponds to a 112-bit | lengths of at least 2048 bit, which corresponds to a 112-bit | |||
| symmetric key and a 233 bit ECC keys. These recommendations are | symmetric key and a 233 bit ECC keys. These recommendations are | |||
| inline with those from other organizations, such as National | inline with those from other organizations, such as National | |||
| Institute of Standards and Technology (NIST) or European Network and | Institute of Standards and Technology (NIST) or European Network and | |||
| Information Security Agency (ENISA). The authors of | Information Security Agency (ENISA). The authors of | |||
| [ENISA-Report2013] add that a symmetric 80-bit security level is | [ENISA-Report2013] add that a symmetric 80-bit security level is | |||
| skipping to change at page 25, line 44 ¶ | skipping to change at page 31, line 15 ¶ | |||
| long lived data. | long lived data. | |||
| Symmetric | ECC | DH/DSA/RSA | Symmetric | ECC | DH/DSA/RSA | |||
| ------------+---------+------------- | ------------+---------+------------- | |||
| 80 | 163 | 1024 | 80 | 163 | 1024 | |||
| 112 | 233 | 2048 | 112 | 233 | 2048 | |||
| 128 | 283 | 3072 | 128 | 283 | 3072 | |||
| 192 | 409 | 7680 | 192 | 409 | 7680 | |||
| 256 | 571 | 15360 | 256 | 571 | 15360 | |||
| Figure 6: Comparable Key Sizes (in bits). | Figure 9: Comparable Key Sizes (in bits). | |||
| 23. TLS False Start | 23. False Start | |||
| A full TLS handshake as specified in [RFC5246] requires two full | A full TLS handshake as specified in [RFC5246] requires two full | |||
| protocol rounds (four flights) before the handshake is complete and | protocol rounds (four flights) before the handshake is complete and | |||
| the protocol parties may begin to send application data. | the protocol parties may begin to send application data. | |||
| An abbreviated handshake (resuming an earlier TLS session) is | An abbreviated handshake (resuming an earlier TLS session) is | |||
| complete after three flights, thus adding just one round-trip time if | complete after three flights, thus adding just one round-trip time if | |||
| the client sends application data first. | the client sends application data first. | |||
| If the conditions outlined in [I-D.bmoeller-tls-falsestart] are met, | If the conditions outlined in [I-D.bmoeller-tls-falsestart] are met, | |||
| skipping to change at page 26, line 28 ¶ | skipping to change at page 31, line 46 ¶ | |||
| conditions are | conditions are | |||
| o Modern symmetric ciphers with an effective key length of 128 bits, | o Modern symmetric ciphers with an effective key length of 128 bits, | |||
| such as AES-128-CCM | such as AES-128-CCM | |||
| o Client certificate types, such as ecdsa_sign | o Client certificate types, such as ecdsa_sign | |||
| o Key exchange methods, such as ECDHE_ECDSA | o Key exchange methods, such as ECDHE_ECDSA | |||
| Based on the improvement over a full roundtrip for the full TLS/DTLS | Based on the improvement over a full roundtrip for the full TLS/DTLS | |||
| exchange this specification RECOMMENDS the use of the TLS False Start | exchange this specification RECOMMENDS the use of the False Start | |||
| mechanism when clients send application data first. | mechanism when clients send application data first. | |||
| 24. Privacy Considerations | 24. Privacy Considerations | |||
| The DTLS handshake exchange conveys various identifiers, which can be | The DTLS handshake exchange conveys various identifiers, which can be | |||
| observed by an on-path eavesdropper. For example, the DTLS PSK | observed by an on-path eavesdropper. For example, the DTLS PSK | |||
| exchange reveals the PSK identity, the supported extensions, the | exchange reveals the PSK identity, the supported extensions, the | |||
| session id, algorithm parameters, etc. When session resumption is | session id, algorithm parameters, etc. When session resumption is | |||
| used then individual TLS sessions can be correlated by an on-path | used then individual TLS sessions can be correlated by an on-path | |||
| adversary. With many IoT deployments it is likely that keying | adversary. With many IoT deployments it is likely that keying | |||
| skipping to change at page 27, line 36 ¶ | skipping to change at page 33, line 13 ¶ | |||
| keying related information. | keying related information. | |||
| 26. IANA Considerations | 26. IANA Considerations | |||
| This document includes no request to IANA. | This document includes no request to IANA. | |||
| 27. Acknowledgements | 27. Acknowledgements | |||
| Thanks to Paul Bakker, Robert Cragie, Russ Housley, Rene Hummen, | Thanks to Paul Bakker, Robert Cragie, Russ Housley, Rene Hummen, | |||
| Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh, Alexey Melnikov, | Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh, Alexey Melnikov, | |||
| Akbar Rahman, Eric Rescorla, Michael Richardson, Zach Shelby, Michael | Manuel Pegourie-Gonnard, Akbar Rahman, Eric Rescorla, Michael | |||
| StJohns, Rene Struik, and Sean Turner for their helpful comments and | Richardson, Zach Shelby, Michael StJohns, Rene Struik, and Sean | |||
| discussions that have shaped the document. | Turner for their helpful comments and discussions that have shaped | |||
| the document. | ||||
| Big thanks also to Klaus Hartke, who wrote the initial version of | Big thanks also to Klaus Hartke, who wrote the initial version of | |||
| this document. | this document. | |||
| Finally, we would like to thank our area director (Stephen Farrell) | Finally, we would like to thank our area director (Stephen Farrell) | |||
| and our working group chairs (Zach Shelby and Dorothy Gellert) for | and our working group chairs (Zach Shelby and Dorothy Gellert) for | |||
| their support. | their support. | |||
| 28. References | 28. References | |||
| 28.1. Normative References | 28.1. Normative References | |||
| [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) | [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) | |||
| REGISTRATION AUTHORITY", April 2010, | REGISTRATION AUTHORITY", April 2010, | |||
| <http://standards.ieee.org/regauth/oui/tutorials/ | <http://standards.ieee.org/regauth/oui/tutorials/ | |||
| EUI64.html>. | EUI64.html>. | |||
| [GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation | [GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation | |||
| Partnership Project; Technical Specification Group Core | Partnership Project; Technical Specification Group Core | |||
| Network and Terminals; Technical realization of the Short | Network and Terminals; Technical realization of the Short | |||
| skipping to change at page 29, line 46 ¶ | skipping to change at page 35, line 24 ¶ | |||
| Weak Keys in Network Devices", 21st USENIX Security | Weak Keys in Network Devices", 21st USENIX Security | |||
| Symposium, | Symposium, | |||
| https://www.usenix.org/conference/usenixsecurity12/ | https://www.usenix.org/conference/usenixsecurity12/ | |||
| technical-sessions/presentation/heninger, 2012. | technical-sessions/presentation/heninger, 2012. | |||
| [HomeGateway] | [HomeGateway] | |||
| Eggert, L., "An experimental study of home gateway | Eggert, L., "An experimental study of home gateway | |||
| characteristics, In Proceedings of the '10th annual | characteristics, In Proceedings of the '10th annual | |||
| conference on Internet measurement'", 2010. | conference on Internet measurement'", 2010. | |||
| [I-D.bmoeller-tls-downgrade-scsv] | ||||
| Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher | ||||
| Suite Value (SCSV) for Preventing Protocol Downgrade | ||||
| Attacks", draft-bmoeller-tls-downgrade-scsv-02 (work in | ||||
| progress), May 2014. | ||||
| [I-D.bmoeller-tls-falsestart] | [I-D.bmoeller-tls-falsestart] | |||
| Langley, A., Modadugu, N., and B. Moeller, "Transport | Langley, A., Modadugu, N., and B. Moeller, "Transport | |||
| Layer Security (TLS) False Start", draft-bmoeller-tls- | Layer Security (TLS) False Start", draft-bmoeller-tls- | |||
| falsestart-01 (work in progress), November 2014. | falsestart-01 (work in progress), November 2014. | |||
| [I-D.bormann-core-cocoa] | [I-D.bormann-core-cocoa] | |||
| Bormann, C., Betzler, A., Gomez, C., and I. Demirkol, | Bormann, C., Betzler, A., Gomez, C., and I. Demirkol, | |||
| "CoAP Simple Congestion Control/Advanced", draft-bormann- | "CoAP Simple Congestion Control/Advanced", draft-bormann- | |||
| core-cocoa-02 (work in progress), July 2014. | core-cocoa-02 (work in progress), July 2014. | |||
| [I-D.ietf-core-resource-directory] | ||||
| Shelby, Z. and C. Bormann, "CoRE Resource Directory", | ||||
| draft-ietf-core-resource-directory-02 (work in progress), | ||||
| November 2014. | ||||
| [I-D.ietf-lwig-tls-minimal] | [I-D.ietf-lwig-tls-minimal] | |||
| Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's | Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's | |||
| Guide to the (Datagram) Transport Layer Security Protocol | Guide to the (Datagram) Transport Layer Security Protocol | |||
| for Smart Objects and Constrained Node Networks", draft- | for Smart Objects and Constrained Node Networks", draft- | |||
| ietf-lwig-tls-minimal-01 (work in progress), March 2014. | ietf-lwig-tls-minimal-01 (work in progress), March 2014. | |||
| [I-D.ietf-tls-downgrade-scsv] | ||||
| Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher | ||||
| Suite Value (SCSV) for Preventing Protocol Downgrade | ||||
| Attacks", draft-ietf-tls-downgrade-scsv-02 (work in | ||||
| progress), November 2014. | ||||
| [I-D.ietf-tls-negotiated-dl-dhe] | [I-D.ietf-tls-negotiated-dl-dhe] | |||
| Gillmor, D., "Negotiated Discrete Log Diffie-Hellman | Gillmor, D., "Negotiated Discrete Log Diffie-Hellman | |||
| Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- | Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- | |||
| dl-dhe-00 (work in progress), July 2014. | dl-dhe-00 (work in progress), July 2014. | |||
| [I-D.ietf-tls-prohibiting-rc4] | [I-D.ietf-tls-prohibiting-rc4] | |||
| Popov, A., "Prohibiting RC4 Cipher Suites", draft-ietf- | Popov, A., "Prohibiting RC4 Cipher Suites", draft-ietf- | |||
| tls-prohibiting-rc4-01 (work in progress), October 2014. | tls-prohibiting-rc4-01 (work in progress), October 2014. | |||
| [I-D.ietf-tls-sslv3-diediedie] | ||||
| Barnes, R., Thomson, M., Pironti, A., and A. Langley, | ||||
| "Deprecating Secure Sockets Layer Version 3.0", draft- | ||||
| ietf-tls-sslv3-diediedie-00 (work in progress), December | ||||
| 2014. | ||||
| [I-D.ietf-uta-tls-bcp] | [I-D.ietf-uta-tls-bcp] | |||
| Sheffer, Y., Holz, R., and P. Saint-Andre, | Sheffer, Y., Holz, R., and P. Saint-Andre, | |||
| "Recommendations for Secure Use of TLS and DTLS", draft- | "Recommendations for Secure Use of TLS and DTLS", draft- | |||
| ietf-uta-tls-bcp-07 (work in progress), November 2014. | ietf-uta-tls-bcp-08 (work in progress), December 2014. | |||
| [I-D.irtf-cfrg-chacha20-poly1305] | [I-D.irtf-cfrg-chacha20-poly1305] | |||
| Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF | Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF | |||
| protocols", draft-irtf-cfrg-chacha20-poly1305-03 (work in | protocols", draft-irtf-cfrg-chacha20-poly1305-03 (work in | |||
| progress), November 2014. | progress), November 2014. | |||
| [I-D.mathewson-no-gmtunixtime] | [I-D.mathewson-no-gmtunixtime] | |||
| Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in | Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in | |||
| TLS", draft-mathewson-no-gmtunixtime-00 (work in | TLS", draft-mathewson-no-gmtunixtime-00 (work in | |||
| progress), December 2013. | progress), December 2013. | |||
| skipping to change at page 31, line 43 ¶ | skipping to change at page 37, line 30 ¶ | |||
| Overview, Assumptions, Problem Statement, and Goals", RFC | Overview, Assumptions, Problem Statement, and Goals", RFC | |||
| 4919, August 2007. | 4919, August 2007. | |||
| [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, | [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, | |||
| "Transport Layer Security (TLS) Session Resumption without | "Transport Layer Security (TLS) Session Resumption without | |||
| Server-Side State", RFC 5077, January 2008. | Server-Side State", RFC 5077, January 2008. | |||
| [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated | [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated | |||
| Encryption", RFC 5116, January 2008. | Encryption", RFC 5116, January 2008. | |||
| [RFC5216] Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS | ||||
| Authentication Protocol", RFC 5216, March 2008. | ||||
| [RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible | ||||
| Authentication Protocol (EAP) Key Management Framework", | ||||
| RFC 5247, August 2008. | ||||
| [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., | [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., | |||
| Housley, R., and W. Polk, "Internet X.509 Public Key | Housley, R., and W. Polk, "Internet X.509 Public Key | |||
| Infrastructure Certificate and Certificate Revocation List | Infrastructure Certificate and Certificate Revocation List | |||
| (CRL) Profile", RFC 5280, May 2008. | (CRL) Profile", RFC 5280, May 2008. | |||
| [RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois | [RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois | |||
| Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, | Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, | |||
| August 2008. | August 2008. | |||
| [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor | [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor | |||
| skipping to change at page 32, line 31 ¶ | skipping to change at page 38, line 25 ¶ | |||
| [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained | [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained | |||
| Application Protocol (CoAP)", RFC 7252, June 2014. | Application Protocol (CoAP)", RFC 7252, June 2014. | |||
| [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an | [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an | |||
| Attack", BCP 188, RFC 7258, May 2014. | Attack", BCP 188, RFC 7258, May 2014. | |||
| [RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer | [RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer | |||
| Security (TLS) and Datagram Transport Layer Security | Security (TLS) and Datagram Transport Layer Security | |||
| (DTLS)", RFC 7366, September 2014. | (DTLS)", RFC 7366, September 2014. | |||
| [RFC7400] Bormann, C., "6LoWPAN-GHC: Generic Header Compression for | ||||
| IPv6 over Low-Power Wireless Personal Area Networks | ||||
| (6LoWPANs)", RFC 7400, November 2014. | ||||
| [Tripple-HS] | ||||
| Bhargavan, K., Delignat-Lavaud, C., Pironti, A., and P. | ||||
| Strub, "Triple Handshakes and Cookie Cutters: Breaking and | ||||
| Fixing Authentication over TLS", IEEE Symposium on | ||||
| Security and Privacy, pages 98-113, 2014. | ||||
| Appendix A. Conveying DTLS over SMS | Appendix A. Conveying DTLS over SMS | |||
| This section is normative for the use of DTLS over SMS. Timer | This section is normative for the use of DTLS over SMS. Timer | |||
| recommendations are already outlined in Section 13 and also | recommendations are already outlined in Section 13 and also | |||
| applicable to the transport of DTLS over SMS. | applicable to the transport of DTLS over SMS. | |||
| This section requires readers to be familiar with the terminology and | This section requires readers to be familiar with the terminology and | |||
| concepts described in [GSM-SMS], and [WAP-WDP]. | concepts described in [GSM-SMS], and [WAP-WDP]. | |||
| The remainder of this section assumes Mobile Stations are capable of | The remainder of this section assumes Mobile Stations are capable of | |||
| skipping to change at page 35, line 5 ¶ | skipping to change at page 41, line 7 ¶ | |||
| taken into account by the DTLS timeout and retransmission function. | taken into account by the DTLS timeout and retransmission function. | |||
| Handshake messages MUST carry a validity period (TP-VP parameter in a | Handshake messages MUST carry a validity period (TP-VP parameter in a | |||
| SMS-SUBMIT TPDU) that is not less than the current value of the | SMS-SUBMIT TPDU) that is not less than the current value of the | |||
| retransmission timeout. In order to avoid persisting messages in the | retransmission timeout. In order to avoid persisting messages in the | |||
| network that will be discarded by the receiving party, handshake | network that will be discarded by the receiving party, handshake | |||
| messages SHOULD carry a validity period that is the same as, or just | messages SHOULD carry a validity period that is the same as, or just | |||
| slightly higher than, the current value of the retransmission | slightly higher than, the current value of the retransmission | |||
| timeout. | timeout. | |||
| Appendix B. DTLS Record Layer Per-Packet Overhead | ||||
| Figure 10 shows the overhead for the DTLS record layer for protecting | ||||
| data traffic when AES-128-CCM with an 8-octet Integrity Check Value | ||||
| (ICV) is used. | ||||
| DTLS Record Layer Header................13 bytes | ||||
| Nonce (Explicit).........................8 bytes | ||||
| ICV..................................... 8 bytes | ||||
| ------------------------------------------------ | ||||
| Overhead................................29 bytes | ||||
| ------------------------------------------------ | ||||
| Figure 10: AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead. | ||||
| The DTLS record layer header has 13 octets and consists of | ||||
| o 1 octet content type field, | ||||
| o 2 octet version field, | ||||
| o 2 octet epoch field, | ||||
| o 6 octet sequence number, | ||||
| o 2 octet length field. | ||||
| The "nonce" input to the AEAD algorithm is exactly that of [RFC5288], | ||||
| i.e., 12 bytes long. It consists of a 4 octet salt and an 8 octet | ||||
| nonce. The salt is the "implicit" part of the nonce and is not sent | ||||
| in the packet. Since the nonce_explicit may be the 8 octet sequence | ||||
| number and, in DTLS, it is the 8 octet epoch concatenated with the 6 | ||||
| octet sequence number. | ||||
| RFC 6655 [RFC6655] allows the nonce_explicit to be a sequence number | ||||
| or something else. This document makes this use more restrictive for | ||||
| use with DTLS: the 64-bit none_explicit MUST be the 16-bit epoch | ||||
| concatenated with the 48-bit seq_num. The sequence number component | ||||
| of the nonce_explicit field at the AES-CCM layer is an exact copy of | ||||
| the sequence number in the record layer header field. This leads to | ||||
| a duplication of 8-bytes per record. | ||||
| To avoid this 8-byte duplication RFC 7400 [RFC7400] provides help | ||||
| with the use of the generic header compression technique for IPv6 | ||||
| over Low-Power Wireless Personal Area Networks (6LoWPANs). Note that | ||||
| this header compression technique is not available when DTLS is | ||||
| exchanged over transports that do not use IPv6 or 6LoWPAN, such as | ||||
| the SMS transport described in Appendix A. | ||||
| Authors' Addresses | Authors' Addresses | |||
| Hannes Tschofenig (editor) | Hannes Tschofenig (editor) | |||
| ARM Ltd. | ARM Ltd. | |||
| 110 Fulbourn Rd | 110 Fulbourn Rd | |||
| Cambridge CB1 9NJ | Cambridge CB1 9NJ | |||
| Great Britain | Great Britain | |||
| Email: Hannes.tschofenig@gmx.net | Email: Hannes.tschofenig@gmx.net | |||
| URI: http://www.tschofenig.priv.at | URI: http://www.tschofenig.priv.at | |||
| End of changes. 101 change blocks. | ||||
| 354 lines changed or deleted | 688 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/ | ||||