< draft-ietf-dice-profile-06.txt   draft-ietf-dice-profile-07.txt >
dice H. Tschofenig, Ed. dice H. Tschofenig, Ed.
Internet-Draft ARM Ltd. Internet-Draft ARM Ltd.
Intended status: Standards Track T. Fossati Intended status: Standards Track T. Fossati
Expires: June 11, 2015 Alcatel-Lucent Expires: June 18, 2015 Alcatel-Lucent
December 8, 2014 December 15, 2014
A Datagram Transport Layer Security (DTLS) 1.2 Profile for the Internet A TLS/DTLS 1.2 Profile for the Internet of Things
of Things draft-ietf-dice-profile-07.txt
draft-ietf-dice-profile-06.txt
Abstract Abstract
This document defines a DTLS 1.2 profile that is suitable for A common design pattern in Internet of Things (IoT) deployments is
Internet of Things applications and is reasonably implementable on the use of a constrained device (typically providing sensor data)
many constrained devices. that makes data available for home automation, industrial control
systems, smart cities and other IoT deployments.
A common design pattern in IoT deployments is the use of a This document defines a Transport Layer Security (TLS) and Datagram
constrained device (typically providing sensor data) that interacts TLS 1.2 profile that offers communications security for this data
with the web infrastructure. This document focuses on this exchange thereby preventing eavesdropping, tampering, and message
particular pattern. forgery.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on June 11, 2015. This Internet-Draft will expire on June 18, 2015.
Copyright Notice Copyright Notice
Copyright (c) 2014 IETF Trust and the persons identified as the Copyright (c) 2014 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. DTLS Protocol Overview . . . . . . . . . . . . . . . . . . . 4 3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4
4. The Communication Model . . . . . . . . . . . . . . . . . . . 5 4. Communication Models . . . . . . . . . . . . . . . . . . . . 5
5. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 7 4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 5
6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 9 4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 12
6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 9 5. The TLS/DTLS Ciphersuite Concept . . . . . . . . . . . . . . 12
6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 11 6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 13
6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 13 6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 13
7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 15 6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 15
8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 16 6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 17
9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 17 7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 20
10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 18 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 20
11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 18 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 21
12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 19 10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 22
13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 20 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 22
14. Random Number Generation . . . . . . . . . . . . . . . . . . 21 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 23
15. Truncated MAC Extension . . . . . . . . . . . . . . . . . . . 22 13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 25
16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 22 14. Random Number Generation . . . . . . . . . . . . . . . . . . 25
17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 22 15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 26
18. TLS Session Hash . . . . . . . . . . . . . . . . . . . . . . 23 16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 27
19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 23 17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 27
20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 23 18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 27
21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 24 19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 28
22. Key Length Recommendations . . . . . . . . . . . . . . . . . 25 20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 28
23. TLS False Start . . . . . . . . . . . . . . . . . . . . . . . 25 21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 29
24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 26 22. Key Length Recommendations . . . . . . . . . . . . . . . . . 30
25. Security Considerations . . . . . . . . . . . . . . . . . . . 27 23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 31
26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27 24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 32
27. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 27 25. Security Considerations . . . . . . . . . . . . . . . . . . . 32
28. References . . . . . . . . . . . . . . . . . . . . . . . . . 27 26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 33
28.1. Normative References . . . . . . . . . . . . . . . . . . 28 27. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 33
28.2. Informative References . . . . . . . . . . . . . . . . . 29 28. References . . . . . . . . . . . . . . . . . . . . . . . . . 33
Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 32 28.1. Normative References . . . . . . . . . . . . . . . . . . 33
A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 32 28.2. Informative References . . . . . . . . . . . . . . . . . 34
A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 33 Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 38
A.3. Multiplexing Security Associations . . . . . . . . . . . 34 A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 38
A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 34 A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 39
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 35 A.3. Multiplexing Security Associations . . . . . . . . . . . 40
A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 40
1. Introduction
This document defines a DTLS 1.2 [RFC6347] profile that offers
communication security for Internet of Things (IoT) applications and
is reasonably implementable on many constrained devices. The DTLS
1.2 protocol is based on Transport Layer Security (TLS) 1.2 [RFC5246]
and provides equivalent security guarantees. This document aims to
meet the following goals:
o Serves as a one-stop shop for implementers to know which pieces of
the specification jungle contain relevant details.
o Does not alter the TLS/DTLS specifications.
o Does not introduce any new extensions. Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 41
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 42
o Aligns with the DTLS security modes of the Constrained Application 1. Introduction
Protocol (CoAP) [RFC7252].
DTLS is used to secure a number of applications run over an An engineer developing an Internet of Things (IoT) device needs to
unreliable datagram transport. CoAP [RFC7252] is one such protocol investigate the security threats and decide about the security
and has been designed specifically for use in IoT environments. CoAP services that can be used to mitigate these threats.
can be secured a number of different ways, also called security
modes. These security modes are as follows, see Section 6.1,
Section 6.2, Section 6.3 for additional details:
No Security Protection at the Transport Layer: No DTLS is used but Enabling IoT devices to make data available often requires
instead application layer security functionality is assumed. authentication of the two endpoints and the ability to provide
integrity- and confidentiality-protection of exchanged data. While
these security services can be provided at different layers in the
protocol stack the use of Transport Layer Security (TLS)/Datagram TLS
(DTLS) has been very popular with many application protocols and it
is likely to be useful for IoT scenarios as well.
Shared Secret-based DTLS Authentication: DTLS supports the use of To make Internet protocols fit constrained devices can be difficult
shared secrets [RFC4279]. This mode is useful if the number of but thanks to the standardization efforts new profiles and protocols
communication relationships between the IoT device and servers is are available, such as the Constrained Application Protocol (CoAP)
small and for very constrained devices. Shared secret-based [RFC7252]. UDP is mainly used to carry CoAP messages but other
authentication mechanisms offer good performance and require a transports can be utilized, such as SMS or even TCP.
minimum of data to be exchanged.
DTLS Authentication using Asymmetric Cryptography: TLS supports While this document is inspired by the desire to protect CoAP
client and server authentication using asymmetric cryptography. messages using DTLS 1.2 [RFC6347] the guidance in this document is
Two approaches for validating these public keys are available. not limited to CoAP nor to DTLS itself.
First, [RFC7250] allows raw public keys to be used in TLS without
the overhead of certificates. This approach requires out-of-band
validation of the public key. Second, the use of X.509
certificates [RFC5280] with TLS is common on the Web today (at
least for server-side authentication) and certain IoT environments
may also re-use those capabilities. Certificates bind an
identifier to the public key signed by a certification authority
(CA). A trust anchor store has to be provisioned on the device to
indicate what CAs are trusted. Furthermore, the certificate may
contain a wealth of other information used to make authorization
decisions.
As described in [I-D.ietf-lwig-tls-minimal], an application designer Instead, this document defines a profile of DTLS 1.2 [RFC6347] and
developing an IoT device needs to consider the security threats and TLS 1.2 [RFC5246] that offers communication security for IoT
the security services that can be used to mitigate the threats. applications and is reasonably implementable on many constrained
Enabling devices to upload data and retrieve configuration devices. Profile thereby means that available configuration options
information, inevitably requires that Internet-connected devices be and protocol extensions are utilized to best support the IoT
able to authenticate themselves to servers and vice versa as well as environment. This document does not alter TLS/DTLS specifications
to ensure that the data and information exchanged is integrity and and does not introduce any new TLS/DTLS extensions.
confidentiality protected. While these security services can be
provided at different layers in the protocol stack the use of
communication security, as offered by DTLS, has been very popular on
the Internet and it is likely to be useful for IoT scenarios as well.
In case the communication security features offered by DTLS meet the
security requirements of your application the remainder of the
document might offer useful guidance.
Not every IoT deployment will use CoAP but the discussion regarding The main target audience for this document is the embedded system
choice of credentials and cryptographic algorithms will be very developer configuring and using a TLS/DTLS stack. This document may,
similar. As such, the content in this document is applicable beyond however, also help those developing or selecting a suitable TLS/DTLS
the use of the CoAP protocol. stack for an Internet of Things product development.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
Note that "Client" and "Server" in this document refer to TLS roles, Note that "Client" and "Server" in this document refer to TLS/DTLS
where the Client initiates the TLS handshake. This does not restrict roles, where the Client initiates the TLS/DTLS handshake. This does
the interaction pattern of the protocols carried inside TLS as the not restrict the interaction pattern of the protocols on top of TLS/
record layer allows bi-directional communication. In the case of DTLS since the record layer allows bi-directional communication.
CoAP the "Client" can act as a CoAP Server or Client. This aspect is further described in Section 4.
RFC 7228 [RFC7228] introduces the notion of constrained-node RFC 7228 [RFC7228] introduces the notion of constrained-node
networks, which are small devices with severe constraints on power, networks, which are small devices with severe constraints on power,
memory, and processing resources. The terms constrained devices, and memory, and processing resources. The terms constrained devices, and
Internet of Things (IoT) devices are used interchangeably. Internet of Things (IoT) devices are used interchangeably.
3. DTLS Protocol Overview 3. TLS/DTLS Protocol Overview
The TLS protocol [RFC5246] provides authenticated, confidentiality- The TLS protocol [RFC5246] provides authenticated, confidentiality-
and integrity-protected communication between two endpoints. The and integrity-protected communication between two endpoints. The
protocol is composed of two layers: the Record Protocol and the protocol is composed of two layers: the Record Protocol and the
Handshake Protocol. At the lowest level, layered on top of a Handshake Protocol. At the lowest level, layered on top of a
reliable transport protocol (e.g., TCP), is the Record Protocol. It reliable transport protocol (e.g., TCP), is the Record Protocol. It
provides connection security by using symmetric cryptography for provides connection security by using symmetric cryptography for
confidentiality, data origin authentication, and integrity confidentiality, data origin authentication, and integrity
protection. The Record Protocol is used for encapsulation of various protection. The Record Protocol is used for encapsulation of various
higher-level protocols. One such encapsulated protocol, the TLS higher-level protocols. One such encapsulated protocol, the
Handshake Protocol, allows the server and client to authenticate each Handshake Protocol, allows the server and client to authenticate each
other and to negotiate an encryption algorithm and cryptographic keys other and to negotiate an encryption algorithm and cryptographic keys
before the application protocol transmits or receives data. before the application protocol transmits or receives data.
The design of DTLS [RFC6347] is intentionally very similar to TLS. The design of DTLS [RFC6347] is intentionally very similar to TLS.
Since DTLS operates on top of an unreliable datagram transport a few Since DTLS operates on top of an unreliable datagram transport a few
enhancements to the TLS structure are, however necessary. RFC 6347 enhancements to the TLS structure are, however necessary. RFC 6347
explains these differences in great detail. As a short summary, for explains these differences in great detail. As a short summary, for
those not familiar with DTLS the differences are: those not familiar with DTLS the differences are:
o An explicit sequence number and an epoch field is included in the o An explicit sequence number and an epoch field is included in the
TLS Record Layer. Section 4.1 of RFC 6347 explains the processing Record Protocol. Section 4.1 of RFC 6347 explains the processing
rules for these two new fields. The value used to compute the MAC rules for these two new fields. The value used to compute the MAC
is the 64-bit value formed by concatenating the epoch and the is the 64-bit value formed by concatenating the epoch and the
sequence number. sequence number.
o Stream ciphers must not be used with DTLS. The only stream cipher o Stream ciphers must not be used with DTLS. The only stream cipher
defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it
is not recommended anymore even for use with TLS is not recommended anymore even for use with TLS
[I-D.ietf-tls-prohibiting-rc4]. [I-D.ietf-tls-prohibiting-rc4].
o The TLS Handshake Protocol has been enhanced to include a o The TLS Handshake Protocol has been enhanced to include a
stateless cookie exchange for Denial of Service (DoS) resistance. stateless cookie exchange for Denial of Service (DoS) resistance.
Furthermore, the header has been extended to deal with message For this purpose a new handshake message, the HelloVerifyRequest,
loss, reordering, and fragmentation. Retransmission timers have was added to DTLS. This handshake message is sent by the server
been included to deal with message loss. For DoS protection a new and includes a stateless cookie, which is returned in a
handshake message, the HelloVerifyRequest, was added to DTLS. ClientHello message back to the server. Although the exchange is
This handshake message is sent by the server and includes a optional for the server to execute, a client implementation has to
stateless cookie, which is returned in a ClientHello message back be prepared to respond to it. Furthermore, the handshake message
to the server. Although the exchange is optional for the server format has been extended to deal with message loss, reordering,
to execute, a client implementation has to be prepared to respond and fragmentation. Retransmission timers have been included to
to it. deal with message loss.
4. The Communication Model 4. Communication Models
This document describes a profile of DTLS 1.2 and, to be useful, it This document describes a profile of TLS/DTLS 1.2 and, to be useful,
has to make assumptions about the envisioned communication it has to make assumptions about the envisioned communication
architecture. architecture.
Two communication architectures (and consequently two profiles) are
described in this document.
4.1. Constrained TLS/DTLS Clients
The communication architecture shown in Figure 1 assumes a unicast The communication architecture shown in Figure 1 assumes a unicast
communication interaction with an IoT device utilizing a DTLS client communication interaction with an IoT device utilizing a constrained
and that client interacts with one or multiple DTLS servers. TLS/DTLS client interacting with one or multiple TLS/DTLS servers.
Before a client can initiate the DTLS handshake it needs to know the Before a client can initiate the TLS/DTLS handshake it needs to know
IP address of that server and what credentials to use. Application the IP address of that server and what credentials to use.
layer protocols, such as CoAP, conveyed on top of DTLS may need Application layer protocols, such as CoAP, conveyed on top of DTLS
additional information, such information about URLs of the endpoints may need additional information, such information about URLs of the
the CoAP needs to register and publish information to. This endpoints the CoAP needs to register and publish information to.
configuration information (including credentials) may be conveyed to This configuration information (including credentials) may be
clients as part of a firmware/software package or via a configuration conveyed to clients as part of a firmware/software package or via a
protocol. The following credential types are supported by this configuration protocol. The following credential types are supported
profile: by this profile:
o For PSK-based authentication (see Section 6.1), this includes the o For PSK-based authentication (see Section 6.1), this includes the
paired "PSK identity" and shared secret to be used with each paired "PSK identity" and shared secret to be used with each
server. server.
o For raw public key-based authentication (see Section 6.2), this o For raw public key-based authentication (see Section 6.2), this
includes either the server's public key or the hash of the includes either the server's public key or the hash of the
server's public key. server's public key.
o For certificate-based authentication (see Section 6.3), this o For certificate-based authentication (see Section 6.3), this
skipping to change at page 7, line 17 skipping to change at page 6, line 17
|////////////////////////////////////| |////////////////////////////////////|
| Server A --> PSK Identity, PSK | | Server A --> PSK Identity, PSK |
| Server B --> Public Key (Server B),| | Server B --> Public Key (Server B),|
| Public Key (Client) | | Public Key (Client) |
| Server C --> Public Key (Client), | | Server C --> Public Key (Client), |
| Trust Anchor Store | | Trust Anchor Store |
+------------------------------------+ +------------------------------------+
oo oo
oooooo oooooo
o o
+------+ +-----------+
|Client|--- |Constrained|
+------+ \ |TLS/DTLS |
|Client |-
+-----------+ \
\ ,-------. \ ,-------.
,' `. +------+ ,' `. +------+
/ IP-based \ |Server| / IP-based \ |Server|
( Network ) | A | ( Network ) | A |
\ / +------+ \ / +------+
`. ,' `. ,'
'---+---' +------+ '---+---' +------+
| |Server| | |Server|
| | B | | | B |
| +------+ | +------+
| |
| +------+ | +------+
+----------------->|Server| +----------------->|Server|
| C | | C |
+------+ +------+
Figure 1: Constrained DTLS Client Profile. Figure 1: Constrained Client Profile.
5. The Ciphersuite Concept 4.1.1. Examples of Constrained Client Exchanges
4.1.1.1. Network Access Authentication Example
Re-use is a recurring theme when considering constrained environments
and is behind a lot of the directions taken in developments for
constrained environments. The corollary of re-use is to not add
functionality if it can be avoided. An example relevant to the use
of TLS is network access authentication, which takes place when a
device connects to a network and needs to go through an
authentication and access control procedure before it is allowed to
communicate with other devices or connect to the Internet.
Figure 2 shows the network access architecture with the IoT device
initiating the communication to an access point in the network using
the procedures defined for a specific physical layer. Since
credentials may be managed and stored centrally, in the
Authentication, Authorization, and Accounting (AAA) server, the
security protocol exchange may need to be relayed via the
Authenticator, i.e., functionality running on the access point, to
the AAA server. The authentication and key exchange protocol itself
is encapsulated within a container, the Extensible Authentication
Protocol (EAP), and messages are conveyed back and forth between the
EAP endpoints, namely the EAP peer located on the IoT device and the
EAP server located on the AAA server or the access point. To route
EAP messages from the access point, acting as a AAA client, to the
AAA server requires an adequate protocol mechanism, name RADIUS or
Diameter.
More details about the concepts and a description about the
terminology can be found in RFC 5247 [RFC5247].
+--------------+
|Authentication|
|Authorization |
|Accounting |
|Server |
|(EAP Server) |
| |
+-^----------^-+
* EAP o RADIUS/
* o Diameter
--v----------v--
/// \\\
// \\
| Federation |
| Substrate |
\\ //
\\\ ///
--^----------^--
* EAP o RADIUS/
* o Diameter
+-------------+ +-v----------v--+
| | EAP/EAP Method | |
| Internet of |<***************************>| Access Point |
| Things | |(Authenticator)|
| Device | EAP Lower Layer and |(AAA Client) |
| (EAP Peer) | Secure Association Protocol | |
| |<--------------------------->| |
| | | |
| | Physical Layer | |
| |<===========================>| |
+-------------+ +---------------+
Legend:
<****>: Device-to-AAA Server Exchange
<---->: Device-to-Authenticator Exchange
<oooo>: AAA Client-to-AAA Server Exchange
<====>: Phyiscal layer like IEEE 802.11/802.15.4
Figure 2: Network Access Architecture..
One standardized EAP method is EAP-TLS, defined in RFC 5216
[RFC5216], which re-uses the TLS-based protocol exchange and
encapsulates it inside the EAP payload. In terms of re-use this
allows many components of the TLS protocol to be shared between the
network access security functionality and the TLS functionality
needed for securing application layer traffic. The EAP-TLS exchange
is shown in Figure 3 where it is worthwhile to point out that in EAP
the client / server roles are reversed but with the use of EAP-TLS
the IoT device acts as a TLS client.
Authenticating Peer Authenticator
------------------- -------------
<- EAP-Request/
Identity
EAP-Response/
Identity (MyID) ->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS Start)
EAP-Response/
EAP-Type=EAP-TLS
(TLS client_hello)->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS server_hello,
TLS certificate,
[TLS server_key_exchange,]
TLS certificate_request,
TLS server_hello_done)
EAP-Response/
EAP-Type=EAP-TLS
(TLS certificate,
TLS client_key_exchange,
TLS certificate_verify,
TLS change_cipher_spec,
TLS finished) ->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS change_cipher_spec,
TLS finished)
EAP-Response/
EAP-Type=EAP-TLS ->
<- EAP-Success
Figure 3: EAP-TLS Exchange.
The guidance in this document also applies to the use of EAP-TLS for
network access authentication. An IoT device using a network access
authentication solution based on TLS can re-use most parts of the
code for the use of DTLS/TLS at the application layer thereby saving
a significant amount of flash memory. Note, however, that the
credentials used for network access authentication and those used for
application layer security are very likely different.
4.1.1.2. CoAP-based Data Exchange Example
When a constrained client uploads sensor data to a server
infrastructure it may use CoAP by pushing the data via a POST to a
pre-configured endpoint on the server. In certain circumstances this
might be too limiting and additional functionality is needed, as
shown in Figure 4, where the IoT device itself runs a CoAP server
hosting the resource that is made accessible to other entities.
Despite running a CoaP server on the IoT device it is still the DTLS
client on the IoT device that initiates the interaction with the non-
constrained resource server in our scenario.
Figure 4 shows a sensor starting with a DTLS exchange with a resource
server to register available resources. The initial DTLS interaction
between the sensor, acting as a DTLS client, and the resource server,
acting as a DTLS server, will be a full DTLS handshake. Once this
handshake is complete both parties have established the DTLS record
layer, which can subsequently be used to secure the CoAP message
exchange, which starts with a the resource registration. Details
about the resource registry capabilities can be found in
[I-D.ietf-core-resource-directory].
After some time (assuming that the client regularly refreshes its
registration) the resource server receives a request (not shown) from
an application to retrieve the temperature information from the
sensor. This request is relayed by the resource directory to the
sensor using a GET message exchange. The already established DTLS
record layer can be used to secure the message exchange.
Resource
Sensor Directory
------ ---------
+---
|
| ClientHello -------->
| client_certificate_type
F| server_certificate_type
U|
L| <------- HelloVerifyRequest
L|
| ClientHello -------->
D| client_certificate_type
T| server_certificate_type
L|
S| ServerHello
| client_certificate_type
H| server_certificate_type
A| Certificate
N| ServerKeyExchange
D| CertificateRequest
S| <-------- ServerHelloDone
H|
A| Certificate
K| ClientKeyExchange
E| CertificateVerify
| [ChangeCipherSpec]
| Finished -------->
|
| [ChangeCipherSpec]
| <-------- Finished
+---
+--- ///+
C| \ D
O| Req: POST coap://rd.example.com/rd?ep=node1 \ T
A| Payload: \ L
P| </temp>;ct=41; \ S
| rt="temperature-c";if="sensor", \
R| </light>;ct=41; \ R
D| rt="light-lux";if="sensor" \ E
| --------> \ C
R| \ O
E| \ R
G| Res: 2.01 Created \ D
.| <-------- Location: /rd/4521 \
| \ L
+--- \ A
\ Y
* \ E
* (time passes) \ R
* \
+--- \ P
C| \ R
O| Req: GET coaps://sensor.example.com/temp \ O
A| <-------- \ T
P| \ E
| Res: 2.05 Content \ C
G| Payload: \ T
E| 25.5 --------> \ E
T| \ D
+--- ///+
Figure 4: DTLS/CoAP exchange using Resource Directory.
4.2. Constrained TLS/DTLS Servers
TEXT TO BE DONE
5. The TLS/DTLS Ciphersuite Concept
TLS (and consequently DTLS) has the concept of ciphersuites and an TLS (and consequently DTLS) has the concept of ciphersuites and an
IANA registry [IANA-TLS] was created to register the suites. A IANA registry [IANA-TLS] was created to register the suites. A
ciphersuite (and the specification that defines it) contains the ciphersuite (and the specification that defines it) contains the
following information: following information:
o Authentication and Key Exchange Algorithm (e.g., PSK) o Authentication and key exchange algorithm (e.g., PSK)
o Cipher and Key Length (e.g., Advanced Encryption Standard (AES) o Cipher and key length (e.g., Advanced Encryption Standard (AES)
with 128 bit keys [AES]) with 128 bit keys [AES])
o Mode of operation (e.g., AES with Counter with Cipher Block o Mode of operation (e.g., Counter with Cipher Block Chaining -
Chaining - Message Authentication Code (CBC-MAC) Mode (CCM)) Message Authentication Code (CBC-MAC) Mode (CCM) for AES)
[RFC3610] [RFC3610]
o Hash Algorithm for Integrity Protection, such as the Secure Hash o Hash algorithm for integrity protection, such as the Secure Hash
Algorithm (SHA) in combination with Keyed-Hashing for Message Algorithm (SHA) in combination with Keyed-Hashing for Message
Authentication (HMAC) (see [RFC2104] and [RFC4634]) Authentication (HMAC) (see [RFC2104] and [RFC4634])
o Hash Algorithm for use with the Pseudorandom Function (e.g., HMAC o Hash algorithm for use with the pseudorandom function (e.g., HMAC
with the SHA-256) with the SHA-256)
o Misc information (e.g., length of authentication tags) o Misc information (e.g., length of authentication tags)
o Information whether the ciphersuite is suitable for DTLS or only o Information whether the ciphersuite is suitable for DTLS or only
for TLS for TLS
The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a
pre-shared authentication and key exchange algorithm. RFC 6655 pre-shared authentication and key exchange algorithm. RFC 6655
[RFC6655] defines this ciphersuite. It uses the Advanced Encryption [RFC6655] defines this ciphersuite. It uses the Advanced Encryption
skipping to change at page 9, line 12 skipping to change at page 13, line 27
the TLS pseudo random function (PRF) used in earlier versions of TLS the TLS pseudo random function (PRF) used in earlier versions of TLS
with cipher-suite-specified PRFs. For this reason authors of more with cipher-suite-specified PRFs. For this reason authors of more
recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC
algorithm and the hash functions used with the TLS PRF. algorithm and the hash functions used with the TLS PRF.
6. Credential Types 6. Credential Types
6.1. Pre-Shared Secret 6.1. Pre-Shared Secret
The use of pre-shared secret credentials is one of the most basic The use of pre-shared secret credentials is one of the most basic
techniques for DTLS since it is both computational efficient and techniques for TLS/DTLS since it is both computational efficient and
bandwidth conserving. Pre-shared secret based authentication was bandwidth conserving. Pre-shared secret based authentication was
introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in
Figure 2 illustrates the DTLS exchange including the cookie exchange. Figure 5 illustrates the DTLS exchange including the cookie exchange.
While the server is not required to initiate a cookie exchange with While the server is not required to initiate a cookie exchange with
every handshake, the client is required to implement and to react on every handshake, the client is required to implement and to react on
it when challenged. The cookie exchange allows the server to react it when challenged. The cookie exchange allows the server to react
to flooding attacks. to flooding attacks.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
<-------- HelloVerifyRequest <-------- HelloVerifyRequest
skipping to change at page 9, line 45 skipping to change at page 14, line 29
Finished --------> Finished -------->
ChangeCipherSpec ChangeCipherSpec
<-------- Finished <-------- Finished
Application Data <-------> Application Data Application Data <-------> Application Data
Legend: Legend:
* indicates an optional message payload * indicates an optional message payload
Figure 2: DTLS PSK Authentication including the Cookie Exchange. Figure 5: DTLS PSK Authentication including the Cookie Exchange.
[RFC4279] does not mandate the use of any particular type of [RFC4279] does not mandate the use of any particular type of client
identity. Hence, the TLS client and server clearly have to agree on identity and the client and server have to agree on the identities
the identities and keys to be used. The mandated encoding of and keys to be used. The mandated encoding of identities in
identities in Section 5.1 of RFC 4279 aims to improve Section 5.1 of RFC 4279 aims to improve interoperability for those
interoperability for those cases where the identity is configured by cases where the identity is configured by a person using some
a person using some management interface. Many IoT devices do, management interface. Many IoT devices do, however, not have a user
however, not have a user interface and most of their credentials are interface and most of their credentials are bound to the device
bound to the device rather than the user. Furthermore, credentials rather than the user. Furthermore, credentials are often provisioned
are often provisioned into trusted hardware modules or in the into trusted hardware modules or in the firmware by developers. As
firmware by developers. As such, the encoding considerations are not such, the encoding considerations are not applicable to this usage
applicable to this usage environment. For use with this profile the environment. For use with this profile the PSK identities SHOULD NOT
PSK identities SHOULD NOT assume a structured format (as domain assume a structured format (as domain names, Distinguished Names, or
names, Distinguished Names, or IP addresses have) and a bit-by-bit IP addresses have) and a bit-by-bit comparison operation can then be
comparison operation can then be used by the server-side used by the server-side infrastructure.
infrastructure.
The client indicates which key it uses by including a "PSK identity" The client indicates which key it uses by including a "PSK identity"
in the ClientKeyExchange message. As described in Section 4 clients in the ClientKeyExchange message. As described in Section 4 clients
may have multiple pre-shared keys with a single server and to help may have multiple pre-shared keys with a single server and to help
the client in selecting which PSK identity / PSK pair to use, the the client in selecting which PSK identity / PSK pair to use, the
server can provide a "PSK identity hint" in the ServerKeyExchange server can provide a "PSK identity hint" in the ServerKeyExchange
message. If the hint for PSK key selection is based on the domain message. If the hint for PSK key selection is based on the domain
name of the server then servers SHOULD NOT send the "PSK identity name of the server then servers SHOULD NOT send the "PSK identity
hint" in the ServerKeyExchange message. Hence, servers SHOULD NOT hint" in the ServerKeyExchange message. In general, servers SHOULD
send the "PSK identity hint" in the ServerKeyExchange message and NOT send the "PSK identity hint" in the ServerKeyExchange message and
client MUST ignore the message. This approach is inline with RFC client MUST ignore the message. This approach is inline with RFC
4279 [RFC4279]. Note: The TLS Server Name Indication (SNI) extension 4279 [RFC4279]. Note: The TLS Server Name Indication (SNI) extension
allows the client to tell a server the name of the server it is allows the client to tell a server the name of the server it is
contacting, which is relevant for hosting environments. A server contacting, which is relevant for hosting environments. A server
using the identity hint needs to guide the selection based on a using the identity hint needs to guide the selection based on a
received SNI value from the client. received SNI value from the client.
RFC 4279 requires TLS implementations supporting PSK ciphersuites to RFC 4279 requires TLS implementations supporting PSK ciphersuites to
support arbitrary PSK identities up to 128 octets in length, and support arbitrary PSK identities up to 128 octets in length, and
arbitrary PSKs up to 64 octets in length. This is a useful arbitrary PSKs up to 64 octets in length. This is a useful
assumption for TLS stacks used in the desktop and mobile environment assumption for TLS stacks used in the desktop and mobile environments
where management interfaces are used to provision identities and where management interfaces are used to provision identities and
keys. For the IoT environment, however, many devices are not keys. For the IoT environment, keys are distributed as part of
equipped with displays and input devices (e.g., keyboards). Hence, hardware modules or are embedded into the firmware and, as such,
keys are distributed as part of hardware modules or are embedded into these restrictions are not applicable to this profile.
the firmware. As such, these restrictions are not applicable to this
profile.
Constrained Application Protocol (CoAP) [RFC7252] currently specifies Constrained Application Protocol (CoAP) [RFC7252] currently specifies
TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite
for use with shared secrets. This ciphersuite uses the AES algorithm for use with shared secrets. This ciphersuite uses the AES algorithm
with 128 bit keys and CCM as the mode of operation. The label "_8" with 128 bit keys and CCM as the mode of operation. The label "_8"
indicates that an 8-octet authentication tag is used. This indicates that an 8-octet authentication tag is used. This
ciphersuite makes use of the default TLS 1.2 Pseudorandom Function ciphersuite makes use of the default TLS 1.2 Pseudorandom Function
(PRF), which uses an HMAC with the SHA-256 hash function. (Note that (PRF), which uses an HMAC with the SHA-256 hash function. (Note that
all IoT implementations will need a SHA-256 implementation due to the all IoT implementations will need a SHA-256 implementation due to the
construction of the pseudo-random number function in TLS 1.2.) construction of the pseudo-random number function in DTLS/TLS 1.2.)
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section.
6.2. Raw Public Key 6.2. Raw Public Key
The use of raw public keys with DTLS, as defined in [RFC7250], is the The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is
first entry point into public key cryptography without having to pay the first entry point into public key cryptography without having to
the price of certificates and a PKI. The specification re-uses the pay the price of certificates and a public key infrastructure (PKI).
existing Certificate message to convey the raw public key encoded in The specification re-uses the existing Certificate message to convey
the SubjectPublicKeyInfo structure. To indicate support two new TLS the raw public key encoded in the SubjectPublicKeyInfo structure. To
extensions had been defined, as shown in Figure 3, namely the indicate support two new extensions had been defined, as shown in
server_certificate_type and the client_certificate_type. To operate Figure 6, namely the server_certificate_type and the
this mechanism securely it is necessary to authenticate and authorize client_certificate_type. To operate this mechanism securely it is
the public keys out-of-band. This document therefore assumes that a necessary to authenticate and authorize the public keys out-of-band.
client implementation comes with one or multiple raw public keys of This document therefore assumes that a client implementation comes
servers, it has to communicate with, pre-provisioned. Additionally, with one or multiple raw public keys of servers, it has to
a device will have its own raw public key. To replace, delete, or communicate with, pre-provisioned. Additionally, a device will have
add raw public key to this list requires a software update, for its own raw public key. To replace, delete, or add raw public key to
example using a firmware update mechanism. this list requires a software update, for example using a firmware
update mechanism.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
client_certificate_type client_certificate_type
server_certificate_type server_certificate_type
<------- HelloVerifyRequest <------- HelloVerifyRequest
skipping to change at page 12, line 35 skipping to change at page 16, line 37
Certificate Certificate
ClientKeyExchange ClientKeyExchange
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. Figure 6: DTLS Raw Public Key Exchange including the Cookie Exchange.
The CoAP recommended ciphersuite for use with this credential type is The CoAP recommended ciphersuite for use with this credential type is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve
cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral
Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment
mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA)
for authentication. Due to the use of Ephemeral Elliptic Curve for authentication. Due to the use of Ephemeral Elliptic Curve
Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman
groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this
profile. This ciphersuite make use of the AEAD capability in DTLS profile. This ciphersuite make use of the AEAD capability in DTLS
skipping to change at page 13, line 14 skipping to change at page 17, line 19
methods that have been available in the literature for a long time methods that have been available in the literature for a long time
(i.e., 20 years and more). (i.e., 20 years and more).
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
6.3. Certificates 6.3. Certificates
The use of mutual certificate-based authentication is shown in The use of mutual certificate-based authentication is shown in
Figure 4, which makes use of the cached info extension Figure 7, which makes use of the cached info extension
[I-D.ietf-tls-cached-info]. Support of the cached info extension is [I-D.ietf-tls-cached-info]. Support of the cached info extension is
REQUIRED. Caching certificate chains allows the client to reduce the REQUIRED. Caching certificate chains allows the client to reduce the
communication overhead significantly since otherwise the server would communication overhead significantly since otherwise the server would
provide the end entity certificate, and the certificate chain. provide the end entity certificate, and the certificate chain.
Because certificate validation requires that root keys be distributed Because certificate validation requires that root keys be distributed
independently, the self-signed certificate that specifies the root independently, the self-signed certificate that specifies the root
certificate authority is omitted from the chain. Client certificate authority is omitted from the chain. Client
implementations MUST be provisioned with a trust anchor store that implementations MUST be provisioned with a trust anchor store that
contains the root certificates. The use of the Trust Anchor contains the root certificates. The use of the Trust Anchor
Management Protocol (TAMP) [RFC5934] is, however, not envisioned. Management Protocol (TAMP) [RFC5934] is, however, not envisioned.
Instead IoT devices using this profile MUST rely on a software update Instead IoT devices using this profile MUST rely on a software update
mechanism to provision these trust anchors. mechanism to provision these trust anchors.
When DTLS is used to secure CoAP messages then the server provided
certificates MUST contain the fully qualified DNS domain name or
"FQDN" as dNSName. The coaps URI scheme is described in Section 6.2
of [RFC7252]. This FQDN is stored in the SubjectAltName or in the
leftmost CN component of subject name, as explained in
Section 9.1.3.3 of [RFC7252], and used by the client to match it
against the FQDN used during the look-up process, as described in RFC
6125 [RFC6125]. For the profile in this specification does not
assume dynamic discovery of local servers.
For client certificates the identifier used in the SubjectAltName or
in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3
of [RFC7252].
For certificate revocation neither the Online Certificate Status
Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
Instead, this profile relies on a software update mechanism. While
multiple OCSP stapling [RFC6961] has recently been introduced as a
mechanism to piggyback OCSP request/responses inside the DTLS/TLS
handshake to avoid the cost of a separate protocol handshake further
investigations are needed to determine its suitability for the IoT
environment.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
cached_information cached_information
<------- HelloVerifyRequest <------- HelloVerifyRequest
ClientHello --------> ClientHello -------->
cached_information cached_information
skipping to change at page 14, line 31 skipping to change at page 18, line 31
Certificate Certificate
ClientKeyExchange ClientKeyExchange
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Figure 4: DTLS Mutual Certificate-based Authentication. Figure 7: DTLS Mutual Certificate-based Authentication.
When DTLS is used to secure CoAP messages then the server provided
certificates MUST contain the fully qualified DNS domain name or
"FQDN" as dNSName. The coaps URI scheme is described in Section 6.2
of [RFC7252]. This FQDN is stored in the SubjectAltName or in the
leftmost CN component of subject name, as explained in
Section 9.1.3.3 of [RFC7252], and used by the client to match it
against the FQDN used during the look-up process, as described in RFC
6125 [RFC6125]. For the profile in this specification does not
assume dynamic discovery of local servers.
For client certificates the identifier used in the SubjectAltName or
in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3
of [RFC7252].
For certificate revocation neither the Online Certificate Status
Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
Instead, this profile relies on a software update mechanism. While
multiple OCSP stapling [RFC6961] has recently been introduced as a
mechanism to piggyback OCSP request/responses inside the DTLS/TLS
handshake to avoid the cost of a separate protocol handshake further
investigations are needed to determine its suitability for the IoT
environment.
Regarding the ciphersuite choice the discussion in Section 6.2 Regarding the ciphersuite choice the discussion in Section 6.2
applies. Further details about X.509 certificates can be found in applies. Further details about X.509 certificates can be found in
Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
ciphersuite description in Section 6.2 is also applicable to this ciphersuite description in Section 6.2 is also applicable to this
section. section.
When using certificates, IoT devices MUST provide support for a When using certificates, IoT devices MUST provide support for a
server certificate chain of at least 3 not including the trust anchor server certificate chain of at least 3 not including the trust anchor
and MAY reject connections from servers offering chains longer than and MAY reject connections from servers offering chains longer than
skipping to change at page 15, line 17 skipping to change at page 19, line 37
RFC 6066 [RFC6066] allows to avoid sending client-side certificates RFC 6066 [RFC6066] allows to avoid sending client-side certificates
and uses URLs instead. This reduces the over-the-air transmission. and uses URLs instead. This reduces the over-the-air transmission.
Note that the TLS cached info extension does not provide any help Note that the TLS cached info extension does not provide any help
with caching client certificates. with caching client certificates.
Recommendation: Add support for client certificate URLs for those Recommendation: Add support for client certificate URLs for those
environments where client-side certificates are used. environments where client-side certificates are used.
6.3.2. Trusted CA Indication 6.3.2. Trusted CA Indication
RFC 6066 allows clients to indicate what trust anchor they support. RFC 6066 [RFC6066] allows clients to indicate what trust anchor they
With certificate-based authentication a DTLS server conveys its end support. With certificate-based authentication a DTLS server conveys
entity certificate to the client during the DTLS exchange provides. its end entity certificate to the client during the DTLS exchange
Since the server does not necessarily know what trust anchors the provides. Since the server does not necessarily know what trust
client has stored it includes intermediate CA certs in the anchors the client has stored it includes intermediate CA certs in
certificate payload as well to facilitate with certification path the certificate payload as well to facilitate with certification path
construction and path validation. construction and path validation.
Today, in most IoT deployments there is a fairly static relationship Today, in most IoT deployments there is a fairly static relationship
between the IoT device (and the software running on them) and the between the IoT device (and the software running on them) and the
server- side infrastructure and no such dynamic indication of trust server- side infrastructure and no such dynamic indication of trust
anchors is needed. anchors is needed.
Recommendation: For IoT deployments where clients talk to a fixed, Recommendation: For IoT deployments where clients talk to a fixed,
pre-configured set of servers and where a software update mechanism pre-configured set of servers and where a software update mechanism
is available this extension is not recommended. Environments where is available this extension is not recommended. Environments where
the client needs to interact with dynamically discovered DTLS servers the client needs to interact with dynamically discovered TLS/DTLS
this extension may be useful to reduce the communication overhead. servers this extension may be useful to reduce the communication
Note, however, in that case the TLS cached info extension may help to overhead. Note, however, in that case the TLS cached info extension
reduce the communication overhead for everything but the first may help to reduce the communication overhead for everything but the
protocol interaction. first protocol interaction.
7. Signature Algorithm Extension 7. Signature Algorithm Extension
The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of
RFC 5246 [RFC5246], allows the client to indicate to the server which RFC 5246 [RFC5246], allows the client to indicate to the server which
signature/hash algorithm pairs may be used in digital signatures. signature/hash algorithm pairs may be used in digital signatures.
The client MUST send this extension to select the use of SHA-256 The client MUST send this extension to select the use of SHA-256
since otherwise absent this extension RFC 5246 defaults to SHA-1 / since otherwise absent this extension RFC 5246 defaults to SHA-1 /
ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms. ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms.
The "signature_algorithms" extension is not applicable to the PSK- The "signature_algorithms" extension is not applicable to the PSK-
based ciphersuite described in Section 6.1. based ciphersuite described in Section 6.1.
8. Error Handling 8. Error Handling
DTLS uses the Alert protocol to convey error messages and specifies a TLS/DTLS uses the Alert protocol to convey error messages and
longer list of errors. However, not all error messages defined in specifies a longer list of errors. However, not all error messages
the TLS specification are applicable to this profile. In general, defined in the TLS/DTLS specification are applicable to this profile.
there are two categories of errors (as defined in Section 7.2 of RFC In general, there are two categories of errors (as defined in
5246), namely fatal errors and warnings. Alert messages with a level Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert
of fatal result in the immediate termination of the connection. If messages with a level of fatal result in the immediate termination of
possible, developers should try to develop strategies to react to the connection. If possible, developers should try to develop
those fatal errors, such as re-starting the handshake or informing strategies to react to those fatal errors, such as re-starting the
the user using the (often limited) user interface. Warnings may be handshake or informing the user using the (often limited) user
ignored by the application since many IoT devices will either have interface. Warnings may be ignored by the application since many IoT
limited ways to log errors or no ability at all. In any case, devices will either have limited ways to log errors or no ability at
implementers have to carefully evaluate the impact of errors and ways all. In any case, implementers have to carefully evaluate the impact
to remedy the situation since a commonly used approach for delegating of errors and ways to remedy the situation since a commonly used
decision making to users is difficult (or impossible) to accomplish approach for delegating decision making to users is difficult (or
in a timely fashion. impossible) to accomplish in a timely fashion.
All error messages marked as RESERVED are only supported for All error messages marked as RESERVED are only supported for
backwards compatibility with SSL and are therefore not applicable to backwards compatibility with SSL and are therefore not applicable to
this profile. Those include decryption_failed_RESERVED, this profile. Those include decryption_failed_RESERVED,
no_certificate_RESERVE, and export_restriction_RESERVED. no_certificate_RESERVE, and export_restriction_RESERVED.
A number of the error messages are applicable only for certificate- A number of the error messages are applicable only for certificate-
based authentication ciphersuites. Hence, for PSK and raw public key based authentication ciphersuites. Hence, for PSK and raw public key
use the following error messages are not applicable: use the following error messages are not applicable:
skipping to change at page 16, line 33 skipping to change at page 21, line 4
All error messages marked as RESERVED are only supported for All error messages marked as RESERVED are only supported for
backwards compatibility with SSL and are therefore not applicable to backwards compatibility with SSL and are therefore not applicable to
this profile. Those include decryption_failed_RESERVED, this profile. Those include decryption_failed_RESERVED,
no_certificate_RESERVE, and export_restriction_RESERVED. no_certificate_RESERVE, and export_restriction_RESERVED.
A number of the error messages are applicable only for certificate- A number of the error messages are applicable only for certificate-
based authentication ciphersuites. Hence, for PSK and raw public key based authentication ciphersuites. Hence, for PSK and raw public key
use the following error messages are not applicable: use the following error messages are not applicable:
o bad_certificate, o bad_certificate,
o unsupported_certificate, o unsupported_certificate,
o certificate_revoked, o certificate_revoked,
o certificate_expired, o certificate_expired,
o certificate_unknown, o certificate_unknown,
o unknown_ca, and o unknown_ca, and
o access_denied. o access_denied.
Since this profile does not make use of compression at the TLS layer Since this profile does not make use of compression at the TLS layer
the decompression_failure error message is not applicable either. the decompression_failure error message is not applicable either.
RFC 4279 introduced a new alert message unknown_psk_identity for PSK RFC 4279 introduced a new alert message unknown_psk_identity for PSK
ciphersuites. As stated in Section 2 of RFC 4279 the ciphersuites. As stated in Section 2 of RFC 4279 the
decryption_error error message may also be used instead. For this decryption_error error message may also be used instead. For this
profile the TLS server MUST return the decryption_error error message profile the TLS server MUST return the decryption_error error message
instead of the unknown_psk_identity. instead of the unknown_psk_identity since the two mechanisms exist
and provide the same functionality.
Furthermore, the following errors should not occur with devices and Furthermore, the following errors should not occur with devices and
servers supporting this specification but implementations MUST be servers supporting this specification but implementations MUST be
prepared to process these errors to deal with servers that are not prepared to process these errors to deal with servers that are not
compliant to the profiles in this document: compliant to the profiles in this document:
protocol_version: While this document focuses only on one version of protocol_version: While this document focuses only on one version of
the DTLS protocol, namely version 1.2, ongoing work on TLS/DTLS the TLS/DTLS protocol, namely version 1.2, ongoing work on TLS/
1.3 is taking place. DTLS 1.3 is in progress at the time of writing.
insufficient_security: This error message indicates that the server insufficient_security: This error message indicates that the server
requires ciphers to be more secure. This document specifies only requires ciphers to be more secure. This document specifies only
only one ciphersuite per profile but it is likely that additional only one ciphersuite per profile but it is likely that additional
ciphtersuites get added over time. ciphtersuites get added over time.
user_canceled: Many IoT devices are unattended. user_canceled: Many IoT devices are unattended and hence this error
message is unlikely to occur.
9. Session Resumption 9. Session Resumption
Session resumption is a feature of DTLS that allows a client to Session resumption is a feature of TLS/DTLS that allows a client to
continue with an earlier established session state. The resulting continue with an earlier established session state. The resulting
exchange is shown in Figure 5. In addition, the server may choose exchange is shown in Figure 8. In addition, the server may choose
not to do a cookie exchange when a session is resumed. Still, not to do a cookie exchange when a session is resumed. Still,
clients have to be prepared to do a cookie exchange with every clients have to be prepared to do a cookie exchange with every
handshake. handshake.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
ServerHello ServerHello
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
Application Data <-------> Application Data Application Data <-------> Application Data
Figure 5: DTLS Session Resumption. Figure 8: DTLS Session Resumption.
Clients MUST implement session resumption to improve the performance Clients MUST implement session resumption to improve the performance
of the handshake (in terms of reduced number of message exchanges, of the handshake (in terms of reduced number of message exchanges,
lower computational overhead, and less bandwidth conserved). lower computational overhead, and less bandwidth conserved).
Since the communication model described in Section 4 does not assume Since the communication model described in Section 4 does not assume
that the server is constrained RFC 5077 [RFC5077] specifying TLS that the server is constrained, RFC 5077 [RFC5077] specifying TLS/
session resumption without server-side state is not utilized by this DTLS session resumption without server-side state is not utilized by
profile. this profile.
10. Compression 10. Compression
[I-D.ietf-uta-tls-bcp] recommends to always disable DTLS-level Section 3.3 of [I-D.ietf-uta-tls-bcp] recommends to disable TLS/DTLS-
compression due to attacks. For IoT applications compression at the level compression due to attacks, such as CRIME. For IoT
DTLS is not needed since application layer protocols are highly applications compression at the TLS/DTLS layer is not needed since
optimized and the compression algorithms at the DTLS layer increase application layer protocols are highly optimized and the compression
code size and complexity. algorithms at the DTLS layer increases code size and complexity.
This DTLS client profile does not include DTLS layer compression. Recommendation: This TLS/DTLS profile MUST NOT implement and use TLS/
DTLS layer compression.
11. Perfect Forward Secrecy 11. Perfect Forward Secrecy
Perfect forward secrecy (PFS) is a property that preserves the Perfect forward secrecy (PFS) is a property that preserves the
confidentiality of past conversations even in situations where the confidentiality of past conversations even in situations where the
long-term secret is compromised. long-term secret is compromised.
The PSK ciphersuite recommended in Section 6.1 does not offer this The PSK ciphersuite recommended in Section 6.1 does not offer this
property since it does not utilize a Diffie-Hellman exchange. New property since it does not utilize a Diffie-Hellman exchange. New
ciphersuites that support PFS for PSK-based authentication, such as ciphersuites that support PFS for PSK-based authentication, such as
proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become
available as standardized ciphersuite in the (near) future. available as standardized ciphersuite in the (near) future. The
recommended PSK-based ciphersuite offers excellent performance, a
very small memory footprint, and has the lowest on the wire overhead
at the expense of not using any public cryptography. For deployments
where public key cryptography is acceptable the raw public might
offer an acceptable middleground between the PSK ciphersuite in terms
of out-of-band validation and the functionality offered by asymmetric
cryptography.
The use of PFS is a trade-off decision since on one hand the The use of PFS is a trade-off decision since on one hand the
compromise of long-term secrets of embedded devices is more likely compromise of long-term secrets of embedded devices is more likely
than with many other Internet hosts but on the other hand a Diffie- than with many other Internet hosts but on the other hand a Diffie-
Hellman exchange requires ephemeral key pairs to be generated, which Hellman exchange requires ephemeral key pairs to be generated, which
is demanding from a performance point of view. For performance is demanding from a performance point of view. For performance
reasons some implementations re-use key pairs over multiple exchanges reasons some implementations re-use key pairs over multiple exchanges
(rather than generating new keys for each exchange) for the obvious (rather than generating new keys for each exchange) for the obvious
performance improvement. Note, however, that such key re-use over performance improvement. Note, however, that such key re-use over
long periods voids the benefits of forward secrecy when an attack long periods voids the benefits of forward secrecy when an attack
gains access to this DH key pair. gains access to this DH key pair.
The impact of the disclosure of past conversations and the desire to The impact of the disclosure of past conversations and the desire to
increase the cost for pervasive monitoring (as demanded by [RFC7258]) increase the cost for pervasive monitoring (as demanded by [RFC7258])
has to be taken into account when making a deployment decision. has to be taken into account when making a deployment decision.
This specification recommends the use of the ciphersuites listed in Recommendation: Client implementations claiming support of this
Section 6. profile MUST implement the ciphersuites listed in Section 6 according
to the selected credential type.
12. Keep-Alive 12. Keep-Alive
RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the
other peer is still alive. The same mechanism can also be used to other peer is still alive. The same mechanism can also be used to
perform Path Maximum Transmission Unit (MTU) Discovery. perform Path Maximum Transmission Unit (MTU) Discovery.
A recommendation about the use of RFC 6520 depends on the type of A recommendation about the use of RFC 6520 depends on the type of
message exchange an IoT device performs. There are three types of message exchange an IoT device performs. There are three types of
exchanges that need to be analysed: exchanges that need to be analysed:
Client-Initiated, One-Shot Messages Client-Initiated, One-Shot Messages
This is a common communication pattern where IoT devices upload This is a common communication pattern where IoT devices upload
data to a server on the Internet on an irregular basis. The data to a server on the Internet on an irregular basis. The
communication may be triggered by specific events, such as opening communication may be triggered by specific events, such as opening
a door. a door.
Since the upload happens on an irregular and unpredictable basis Since the upload happens on an irregular and unpredictable basis
and due to renumbering and Network Address Translation (NAT) a new and due to renumbering and Network Address Translation (NAT) the
DTLS session or DTLS session resumption can be used. DTLS handshake may need to be re-started (ideally using session
resumption, if possible).
In this case there is no use for a keep-alive extension for this In this case there is no use for a keep-alive extension for this
scenario. scenario.
Client-Initiated, Regular Data Uploads Client-Initiated, Regular Data Uploads
This is a variation of the previous case whereby data gets This is a variation of the previous case whereby data gets
uploaded on a regular basis, for example, based on frequent uploaded on a regular basis, for example, based on frequent
temperature readings. If neither NAT bindings nor IP address temperature readings. If neither NAT bindings nor IP address
changes occurred then the DTLS record layer will not notice any changes occurred then the record layer will not notice any
changes. For the case where the IP address and port number changes. For the case where the IP address and port number
changes, it is necessary to re-create the DTLS record layer using changes, it is necessary to re-create the record layer using
session resumption. session resumption.
In this scenario there is no use for a keep-alive extension. It In this scenario there is no use for a keep-alive extension. It
is also very likely that the device will enter a sleep cycle in is also very likely that the device will enter a sleep cycle in
between data transmissions to keep power consumption low. between data transmissions to keep power consumption low.
Server-Initiated Messages Server-Initiated Messages
In the two previous scenarios the client initiated the protocol In the two previous scenarios the client initiated the protocol
interaction but in this case we consider server-initiated interaction but in this case we consider server-initiated
messages. Since messages to the client may get blocked by messages. Since messages to the client may get blocked by
intermediaries, such as NATs (including IPv4/IPv6 protocol intermediaries, such as NATs (including IPv4/IPv6 protocol
translators) and stateful packet filtering firewalls, the initial translators) and stateful packet filtering firewalls, the initial
connection setup is triggered by the client and then kept alive. connection setup is triggered by the client and then kept alive.
Since state at middleboxes expires fairly quickly (according to Since state at middleboxes expires fairly quickly (according to
measurements described in [HomeGateway]), regular heartbeats are measurements described in [HomeGateway]), regular heartbeats are
necessary whereby these keep-alive messages may be exchanged at necessary whereby these keep-alive messages may be exchanged at
the application layer or within DTLS itself. the application layer or within DTLS itself.
For this message exchange pattern the use of DTLS heartbeat For this message exchange pattern the use of DTLS heartbeat
messages is quite useful. The MTU discovery mechanism, which is messages is quite useful but may interfere with registrations kept
also part of [RFC6520], is less likely to be relevant since for at the application layer (for example when the CoAP resource
many IoT deployments the most constrained link is the wireless directory is used). The MTU discovery mechanism, which is also
part of [RFC6520], is less likely to be relevant since for many
IoT deployments the most constrained link is the wireless
interface between the IoT device and the network itself (rather interface between the IoT device and the network itself (rather
than some links along the end-to-end path). Only in more complex than some links along the end-to-end path). Only in more complex
network topologies, such as multi-hop mesh networks, the situation network topologies, such as multi-hop mesh networks, path MTU
is. discovery might be appropriate. It also has to be noted that DTLS
itself already provides a basic path discovery mechanism (see
Section 4.1.1.1 of RFC 6347 by using the fragmentation capability
of the handshake protocol).
For server-initiated messages the heartbeat extension can be For server-initiated messages the heartbeat extension can be
RECOMMENDED. RECOMMENDED.
13. Timeouts 13. Timeouts
To connect to the Internet a variety of wired and wireless To connect to the Internet a variety of wired and wireless
technologies are available. Many of the low power radio technologies are available. Many of the low power radio
technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support
small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as
skipping to change at page 20, line 48 skipping to change at page 25, line 34
To deal with the unreliable message delivery provided by UDP, DTLS To deal with the unreliable message delivery provided by UDP, DTLS
adds timeouts and re-transmissions, as described in Section 4.2.4 of adds timeouts and re-transmissions, as described in Section 4.2.4 of
[RFC6347]. Although the timeout values are implementation specific, [RFC6347]. Although the timeout values are implementation specific,
recommendations are provided in Section 4.2.4.1 of [RFC6347], with an recommendations are provided in Section 4.2.4.1 of [RFC6347], with an
initial timer value of 1 second and twice the value at each initial timer value of 1 second and twice the value at each
retransmission up to no less than 60 seconds. Due to the nature of retransmission up to no less than 60 seconds. Due to the nature of
some radio technologies, these values are too aggressive and lead to some radio technologies, these values are too aggressive and lead to
spurious failures when messages in flight need longer. spurious failures when messages in flight need longer.
Choosing appropriate timeout values is difficult with infrequent data
transmissions, changing network conditions, and large variance in
latency. This specification therefore RECOMMENDS an initial timer
value of 10 seconds with exponential back off up to no less then 60
seconds.
Note: If a round-trip time estimator (such as proposed in Note: If a round-trip time estimator (such as proposed in
[I-D.bormann-core-cocoa]) is available in the protocol stack of the [I-D.bormann-core-cocoa]) is available in the protocol stack of the
device, it could be used to dynamically update the setting of the device, it could be used to dynamically update the setting of the
retransmit timeout. retransmit timeout.
Appendix A provides additional information for carrying DTLS over Recommendation: Choosing appropriate timeout values is difficult with
SMS. infrequent data transmissions, changing network conditions, and large
variance in latency. This specification therefore RECOMMENDS an
initial timer value of 10 seconds with exponential back off up to no
less then 60 seconds. Appendix A provides additional normative text
for carrying DTLS over SMS.
14. Random Number Generation 14. Random Number Generation
The DTLS protocol requires random numbers to be available during the The TLS/DTLS protocol requires random numbers to be available during
protocol run. For example, during the ClientHello and the the protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie-Hellman exchange requires numbers. Also, the use of the Diffie-Hellman exchange requires
random numbers during the key pair generation. Special care has to random numbers during the key pair generation. Special care has to
be paid when generating random numbers in embedded systems as many be paid when generating random numbers in embedded systems as many
entropy sources available on desktop operating systems or mobile entropy sources available on desktop operating systems or mobile
devices might be missing, as described in [Heninger]. Consequently, devices might be missing, as described in [Heninger]. Consequently,
if not enough time is given during system start time to fill the if not enough time is given during system start time to fill the
entropy pool then the output might be predictable and repeatable, for entropy pool then the output might be predictable and repeatable, for
example leading to the same keys generated again and again. example leading to the same keys generated again and again.
Recommendation: IoT devices using DTLS MUST offer ways to generate
quality random numbers. Guidelines and requirements for random
number generation can be found in RFC 4086 [RFC4086].
It is important to note that sources contributing to the randomness It is important to note that sources contributing to the randomness
pool on laptops, or desktop PCs are not available on many IoT device, pool on laptops, or desktop PCs are not available on many IoT device,
such as mouse movement, timing of keystrokes, air turbulence on the such as mouse movement, timing of keystrokes, air turbulence on the
movement of hard drive heads, etc. Other sources have to be found or movement of hard drive heads, etc. Other sources have to be found or
dedicated hardware has to be added. dedicated hardware has to be added.
The ClientHello and the ServerHello message contains the 'Random' The ClientHello and the ServerHello messages contains the 'Random'
structure, which has two components: gmt_unix_time and a random structure, which has two components: gmt_unix_time and a random
sequence of 28 random bytes. gmt_unix_time holds the current time sequence of 28 random bytes. gmt_unix_time holds the current time
and date in standard UNIX 32-bit format (seconds since the midnight and date in standard UNIX 32-bit format (seconds since the midnight
starting Jan 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues starting Jan 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues
that the entire value the ClientHello.Random and ServerHello.Random that the entire ClientHello.Random value (including gmt_unix_time)
fields, including gmt_unix_time, should be set to a cryptographically should be set to a cryptographically random sequence because of
random sequence because of privacy concerns (fingerprinting). Since privacy concerns regarding device fingerprinting. Since many IoT
many IoT devices do not have access to a real-time clock this devices do not have access to a real-time clock this recommendation
recommendation is even more relevant in the embedded systems it is RECOMMENDED to follow the guidance outlined in
environment. [I-D.mathewson-no-gmtunixtime] regarding the content of the
ClientHello.Random field. However, for the ServerHello.Random
structure it is RECOMMENDED to maintain the existing structure with
gmt_unix_time followed by a random sequence of 28 random bytes since
the client can use the received time information to securely obtain
time information.
15. Truncated MAC Extension Recommendation: IoT devices using TLS/DTLS MUST offer ways to
generate quality random numbers. Guidelines and requirements for
random number generation can be found in RFC 4086 [RFC4086].
The truncated MAC extension was introduced with RFC 6066 with the 15. Truncated MAC and Encrypt-then-MAC Extension
goal to reduces the size of the MAC used at the Record Layer. This
extension was developed for TLS ciphersuites that used older modes of
operation where the MAC and the encryption operation was performed
independently.
For CoAP, however, the recommended ciphersuites use the newer The truncated MAC extension was introduced with RFC 6066 [RFC6066]
with the goal to reduce the size of the MAC used at the Record Layer.
This extension was developed for TLS ciphersuites that used older
modes of operation where the MAC and the encryption operation was
performed independently.
The recommended ciphersuites in this document use the newer
Authenticated Encryption with Associated Data (AEAD) construct, Authenticated Encryption with Associated Data (AEAD) construct,
namely the CBC-MAC mode (CCM) with eight-octet authentication tags. namely the CBC-MAC mode (CCM) with eight-octet authentication tags,
Furthermore, the extension [RFC7366] introducing the encrypt-then-MAC and are therefore not appliable to the truncated MAC extension.
security mechanism (instead of the MAC-then-encrypt) is also not
applicable for this profile. RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead
of the previously used MAC-then-encrypt) since the MAC-then-encrypt
mechanism has been the subject of a number of security
vulnerabilities. RFC 7366 is, however, also not applicable to the
AEAD ciphers recommended in this document.
Recommendation: Since this profile only supports AEAD ciphersuites Recommendation: Since this profile only supports AEAD ciphersuites
this extension is not applicable. these two extensions are not applicable.
16. Server Name Indication (SNI) 16. Server Name Indication (SNI)
This RFC 6066 extension defines a mechanism for a client to tell a This RFC 6066 extension defines a mechanism for a client to tell a
TLS server the name of the server it wants to contact. This is a TLS/DTLS server the name of the server it wants to contact. This is
useful extension for many hosting environments where multiple virtual a useful extension for many hosting environments where multiple
servers are run on single IP address. virtual servers are run on single IP address.
Recommendation: Unless it is known that a DTLS client does not Recommendation: Unless it is known that a TLS/DTLS client does not
interact with a server in a hosting environment that requires such an interact with a server in a hosting environment we RECOMMEND clients
extension we advice to offer support for the SNI extension in this to implement the SNI extension.
profile.
17. Maximum Fragment Length Negotiation 17. Maximum Fragment Length Negotiation
This RFC 6066 extension lowers the maximum fragment length support This RFC 6066 extension lowers the maximum fragment length support
needed for the Record Layer from 2^14 bytes to 2^9 bytes. needed for the Record Layer from 2^14 bytes to 2^9 bytes.
This is a very useful extension that allows the client to indicate to This is a very useful extension that allows the client to indicate to
the server how much maximum memory buffers it uses for incoming the server how much maximum memory buffers it uses for incoming
messages. Ultimately, the main benefit of this extension is it to messages. Ultimately, the main benefit of this extension is it to
allows client implementations to lower their RAM requirements since allows client implementations to lower their RAM requirements since
the client does not need to accept packets of large size (such as 16k the client does not need to accept packets of large size (such as 16k
packets as required by plain TLS/DTLS). packets as required by plain TLS/DTLS).
Recommendation: Client implementations MUST support this extension. Recommendation: Client implementations MUST support this extension.
18. TLS Session Hash 18. Session Hash
The TLS master secret is not cryptographically bound to important In order to begin connection protection, the Record Protocol requires
session parameters such as the client and server identities. This specification of a suite of algorithms, a master secret, and the
client and server random values. The algorithm for computing the
master secret is defined in Section 8.1 of RFC 5246 but only includes
a small number of parameters exchanged during the handshake and does
not include parameters like the client and server identities. This
can be utilized by an attacker to mount a man-in-the-middle attack can be utilized by an attacker to mount a man-in-the-middle attack
since the master secret is not guaranteed to be unique across since the master secret is not guaranteed to be unique across
sessions. sessions, as discovered in the 'Triple Handshake' attack
[Tripple-HS].
[I-D.ietf-tls-session-hash] defines a TLS extension that binds the [I-D.ietf-tls-session-hash] defines a TLS extension that binds the
master secret to a log of the full handshake that computes it, thus master secret to a log of the full handshake that computes it, thus
preventing such attacks. preventing such attacks.
Recommendation: Client implementations SHOULD implement this Recommendation: Client implementations SHOULD implement this
extension even though the ciphersuites recommended by this profile extension even though the ciphersuites recommended by this profile
are not vulnerable to this attack. For Diffie-Hellman-based are not vulnerable to this attack. For Diffie-Hellman-based
ciphersuites the keying material is contributed by both parties and ciphersuites the keying material is contributed by both parties and
in case of the pre-shared secret key ciphersuite both parties need to in case of the pre-shared secret key ciphersuite both parties need to
be in possession of the shared secret to ensure that the handshake be in possession of the shared secret to ensure that the handshake
completes successfully. It is, however, possible that some completes successfully. It is, however, possible that some
application layer protocols will tunnel other authentication application layer protocols will tunnel other authentication
protocols on top of DTLS making this attack relevant again. protocols on top of DTLS making this attack relevant again.
19. Re-Negotiation Attacks 19. Re-Negotiation Attacks
TLS and DTLS allows a client and a server who already have a TLS TLS/DTLS allows a client and a server who already have a TLS/DTLS
connection to negotiate new parameters, generate new keys, etc by connection to negotiate new parameters, generate new keys, etc by
using a feature in TLS called re-negotiation. Renegotiation happens using the re-negotiation feature. Renegotiation happens in the
in the existing TLS connection, with the new handshake packets being existing connection, with the new handshake packets being encrypted
encrypted along with application data. Upon completion of the re- along with application data. Upon completion of the re-negotiation
negotiation procedure the new channel replaces the old channel. procedure the new channel replaces the old channel.
As described in RFC 5746 [RFC5746] there is no cryptographic binding As described in RFC 5746 [RFC5746] there is no cryptographic binding
between the two handshakes, although the new handshake is carried out between the two handshakes, although the new handshake is carried out
using the cryptographic parameters established by the original using the cryptographic parameters established by the original
handshake. handshake.
To prevent the TLS re-negotiation attack [RFC5746] this specification Recommendation: To prevent the re-negotiation attack [RFC5746] this
RECOMMENDS not to use the TLS renegotigation feature. Clients MUST specification RECOMMENDS to disable the TLS renegotigation feature.
respond to server-initiated re-negotiation attempts with an Alert Clients MUST respond to server-initiated re-negotiation attempts with
message (no_renegotiation) and clients MUST NOT initiate them. an alert message (no_renegotiation) and clients MUST NOT initiate
them.
20. Downgrading Attacks 20. Downgrading Attacks
[Editor's Note: Additional text needed.] When a client sends a ClientHello with a version higher than the
highest version known to the server, the server is supposed to reply
with ServerHello.version equal to the highest version known to the
server and the handshake can proceed. This behaviour is known as
version tolerance. Version-intolerance is when the server (or a
middlebox) breaks the handshake when it sees a ClientHello.version
higher than what it knows about. This is the behaviour that leads
some clients to re-run the handshake with lower version. As a
result, a potential security vulnerability is introduced when a
system is running an old TLS/SSL version (e.g., because of the need
to integrate with legacy systems). In the worst case, this allows an
attacker to downgrade the protocol handshake to SSL 3.0. SSL 3.0 is
so broken that there is no secure cipher available for it (see
[I-D.ietf-tls-sslv3-diediedie]).
This specification demands version 1.2 of DTLS to be used and DTLS The above-described downgrade vulnerability is solved by the TLS
version 1.1 is not supported. Unlike with TLS where many earlier Fallback Signaling Cipher Suite Value (SCSV)
versions exist there is no risk of downgrading to an older version of [I-D.ietf-tls-downgrade-scsv] extension. However, the solution is
DTLS in context of this profile. The work described in not appliable to implementations conforming to this profile since the
[I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to version negotiation MUST use TLS/DTLS version 1.2 (or higher). More
this environment since there is no legacy DTLS/TLS IoT server specifically, this implies:
infrastructure when this profiled is followed.
o Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in
the ClientHello.
o Clients MUST NOT retry a failed negotiation offering a TLS/DTLS
version lower than 1.2.
o Servers MUST fail the handshake by sending a protocol_version
fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated.
Note that the aborted connection is non-resumable.
If at some time in the future the TLS/DTLS 1.2 profile reaches the
quality of SSL 3.0 a software update mechanism is needed since
constrained devices are unlikely to run multiple TLS/DTLS versions
due to memory size restrictions.
21. Crypto Agility 21. Crypto Agility
This document recommends software and chip manufacturers to implement This document recommends software and chip manufacturers to implement
AES and the CCM mode of operation. This document references the CoAP AES and the CCM mode of operation. This document references the CoAP
recommended ciphersuite choices, which have been selected based on recommended ciphersuite choices, which have been selected based on
implementation and deployment experience from the IoT community. implementation and deployment experience from the IoT community.
Over time the preference for algorithms will, however, change. Not Over time the preference for algorithms will, however, change. Not
all components of a ciphersuite are likely to change at the same all components of a ciphersuite are likely to change at the same
speed. Changes are more likely expected for ciphers, the mode of speed. Changes are more likely expected for ciphers, the mode of
skipping to change at page 25, line 4 skipping to change at page 30, line 25
o Offer access to building blocks in addition (or as an alternative) o Offer access to building blocks in addition (or as an alternative)
to the complete functionality. For example, a chip manufacturer to the complete functionality. For example, a chip manufacturer
who gives developers access to an the AES crypto function can use who gives developers access to an the AES crypto function can use
it in functions to build an efficient AES-GCM implementations. it in functions to build an efficient AES-GCM implementations.
Another example is to make a special instruction available that Another example is to make a special instruction available that
increases the speed of speed-up carryless multiplications. increases the speed of speed-up carryless multiplications.
As a recommendation for developers and product architects we As a recommendation for developers and product architects we
recommend that sufficient headroom is provided to allow an upgrade to recommend that sufficient headroom is provided to allow an upgrade to
a newer cryptographic algorithms over the lifetime of the product. a newer cryptographic algorithms over the lifetime of the product.
As an example, while AES-CCM is recommended thoughout this As an example, while AES-CCM is recommended thoughout this
specification future products might use the ChaCha20 cipher in specification future products might use the ChaCha20 cipher in
combination with the Poly1305 authenticator combination with the Poly1305 authenticator
[I-D.irtf-cfrg-chacha20-poly1305]. The assumption is made that a [I-D.irtf-cfrg-chacha20-poly1305]. The assumption is made that a
robust software update mechanism is offered. robust software update mechanism is offered.
22. Key Length Recommendations 22. Key Length Recommendations
RFC 4492 [RFC4492] gives approximate comparable key sizes for RFC 4492 [RFC4492] gives approximate comparable key sizes for
symmetric- and asymmetric-key cryptosystems based on the best-known symmetric- and asymmetric-key cryptosystems based on the best-known
algorithms for attacking them. While other publications suggest algorithms for attacking them. While other publications suggest
slightly different numbers, such as [Keylength], the approximate slightly different numbers, such as [Keylength], the approximate
relationship still holds true. Figure 6 illustrates the comparable relationship still holds true. Figure 9 illustrates the comparable
key sizes in bits. key sizes in bits.
At the time of writing the key size recommendations for use with TLS- At the time of writing the key size recommendations for use with TLS-
based ciphers found in [I-D.ietf-uta-tls-bcp] recommend DH key based ciphers found in [I-D.ietf-uta-tls-bcp] recommend DH key
lengths of at least 2048 bit, which corresponds to a 112-bit lengths of at least 2048 bit, which corresponds to a 112-bit
symmetric key and a 233 bit ECC keys. These recommendations are symmetric key and a 233 bit ECC keys. These recommendations are
inline with those from other organizations, such as National inline with those from other organizations, such as National
Institute of Standards and Technology (NIST) or European Network and Institute of Standards and Technology (NIST) or European Network and
Information Security Agency (ENISA). The authors of Information Security Agency (ENISA). The authors of
[ENISA-Report2013] add that a symmetric 80-bit security level is [ENISA-Report2013] add that a symmetric 80-bit security level is
skipping to change at page 25, line 44 skipping to change at page 31, line 15
long lived data. long lived data.
Symmetric | ECC | DH/DSA/RSA Symmetric | ECC | DH/DSA/RSA
------------+---------+------------- ------------+---------+-------------
80 | 163 | 1024 80 | 163 | 1024
112 | 233 | 2048 112 | 233 | 2048
128 | 283 | 3072 128 | 283 | 3072
192 | 409 | 7680 192 | 409 | 7680
256 | 571 | 15360 256 | 571 | 15360
Figure 6: Comparable Key Sizes (in bits). Figure 9: Comparable Key Sizes (in bits).
23. TLS False Start 23. False Start
A full TLS handshake as specified in [RFC5246] requires two full A full TLS handshake as specified in [RFC5246] requires two full
protocol rounds (four flights) before the handshake is complete and protocol rounds (four flights) before the handshake is complete and
the protocol parties may begin to send application data. the protocol parties may begin to send application data.
An abbreviated handshake (resuming an earlier TLS session) is An abbreviated handshake (resuming an earlier TLS session) is
complete after three flights, thus adding just one round-trip time if complete after three flights, thus adding just one round-trip time if
the client sends application data first. the client sends application data first.
If the conditions outlined in [I-D.bmoeller-tls-falsestart] are met, If the conditions outlined in [I-D.bmoeller-tls-falsestart] are met,
skipping to change at page 26, line 28 skipping to change at page 31, line 46
conditions are conditions are
o Modern symmetric ciphers with an effective key length of 128 bits, o Modern symmetric ciphers with an effective key length of 128 bits,
such as AES-128-CCM such as AES-128-CCM
o Client certificate types, such as ecdsa_sign o Client certificate types, such as ecdsa_sign
o Key exchange methods, such as ECDHE_ECDSA o Key exchange methods, such as ECDHE_ECDSA
Based on the improvement over a full roundtrip for the full TLS/DTLS Based on the improvement over a full roundtrip for the full TLS/DTLS
exchange this specification RECOMMENDS the use of the TLS False Start exchange this specification RECOMMENDS the use of the False Start
mechanism when clients send application data first. mechanism when clients send application data first.
24. Privacy Considerations 24. Privacy Considerations
The DTLS handshake exchange conveys various identifiers, which can be The DTLS handshake exchange conveys various identifiers, which can be
observed by an on-path eavesdropper. For example, the DTLS PSK observed by an on-path eavesdropper. For example, the DTLS PSK
exchange reveals the PSK identity, the supported extensions, the exchange reveals the PSK identity, the supported extensions, the
session id, algorithm parameters, etc. When session resumption is session id, algorithm parameters, etc. When session resumption is
used then individual TLS sessions can be correlated by an on-path used then individual TLS sessions can be correlated by an on-path
adversary. With many IoT deployments it is likely that keying adversary. With many IoT deployments it is likely that keying
skipping to change at page 27, line 36 skipping to change at page 33, line 13
keying related information. keying related information.
26. IANA Considerations 26. IANA Considerations
This document includes no request to IANA. This document includes no request to IANA.
27. Acknowledgements 27. Acknowledgements
Thanks to Paul Bakker, Robert Cragie, Russ Housley, Rene Hummen, Thanks to Paul Bakker, Robert Cragie, Russ Housley, Rene Hummen,
Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh, Alexey Melnikov, Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh, Alexey Melnikov,
Akbar Rahman, Eric Rescorla, Michael Richardson, Zach Shelby, Michael Manuel Pegourie-Gonnard, Akbar Rahman, Eric Rescorla, Michael
StJohns, Rene Struik, and Sean Turner for their helpful comments and Richardson, Zach Shelby, Michael StJohns, Rene Struik, and Sean
discussions that have shaped the document. Turner for their helpful comments and discussions that have shaped
the document.
Big thanks also to Klaus Hartke, who wrote the initial version of Big thanks also to Klaus Hartke, who wrote the initial version of
this document. this document.
Finally, we would like to thank our area director (Stephen Farrell) Finally, we would like to thank our area director (Stephen Farrell)
and our working group chairs (Zach Shelby and Dorothy Gellert) for and our working group chairs (Zach Shelby and Dorothy Gellert) for
their support. their support.
28. References 28. References
28.1. Normative References 28.1. Normative References
[EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64)
REGISTRATION AUTHORITY", April 2010, REGISTRATION AUTHORITY", April 2010,
<http://standards.ieee.org/regauth/oui/tutorials/ <http://standards.ieee.org/regauth/oui/tutorials/
EUI64.html>. EUI64.html>.
[GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation [GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation
Partnership Project; Technical Specification Group Core Partnership Project; Technical Specification Group Core
Network and Terminals; Technical realization of the Short Network and Terminals; Technical realization of the Short
skipping to change at page 29, line 46 skipping to change at page 35, line 24
Weak Keys in Network Devices", 21st USENIX Security Weak Keys in Network Devices", 21st USENIX Security
Symposium, Symposium,
https://www.usenix.org/conference/usenixsecurity12/ https://www.usenix.org/conference/usenixsecurity12/
technical-sessions/presentation/heninger, 2012. technical-sessions/presentation/heninger, 2012.
[HomeGateway] [HomeGateway]
Eggert, L., "An experimental study of home gateway Eggert, L., "An experimental study of home gateway
characteristics, In Proceedings of the '10th annual characteristics, In Proceedings of the '10th annual
conference on Internet measurement'", 2010. conference on Internet measurement'", 2010.
[I-D.bmoeller-tls-downgrade-scsv]
Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher
Suite Value (SCSV) for Preventing Protocol Downgrade
Attacks", draft-bmoeller-tls-downgrade-scsv-02 (work in
progress), May 2014.
[I-D.bmoeller-tls-falsestart] [I-D.bmoeller-tls-falsestart]
Langley, A., Modadugu, N., and B. Moeller, "Transport Langley, A., Modadugu, N., and B. Moeller, "Transport
Layer Security (TLS) False Start", draft-bmoeller-tls- Layer Security (TLS) False Start", draft-bmoeller-tls-
falsestart-01 (work in progress), November 2014. falsestart-01 (work in progress), November 2014.
[I-D.bormann-core-cocoa] [I-D.bormann-core-cocoa]
Bormann, C., Betzler, A., Gomez, C., and I. Demirkol, Bormann, C., Betzler, A., Gomez, C., and I. Demirkol,
"CoAP Simple Congestion Control/Advanced", draft-bormann- "CoAP Simple Congestion Control/Advanced", draft-bormann-
core-cocoa-02 (work in progress), July 2014. core-cocoa-02 (work in progress), July 2014.
[I-D.ietf-core-resource-directory]
Shelby, Z. and C. Bormann, "CoRE Resource Directory",
draft-ietf-core-resource-directory-02 (work in progress),
November 2014.
[I-D.ietf-lwig-tls-minimal] [I-D.ietf-lwig-tls-minimal]
Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's
Guide to the (Datagram) Transport Layer Security Protocol Guide to the (Datagram) Transport Layer Security Protocol
for Smart Objects and Constrained Node Networks", draft- for Smart Objects and Constrained Node Networks", draft-
ietf-lwig-tls-minimal-01 (work in progress), March 2014. ietf-lwig-tls-minimal-01 (work in progress), March 2014.
[I-D.ietf-tls-downgrade-scsv]
Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher
Suite Value (SCSV) for Preventing Protocol Downgrade
Attacks", draft-ietf-tls-downgrade-scsv-02 (work in
progress), November 2014.
[I-D.ietf-tls-negotiated-dl-dhe] [I-D.ietf-tls-negotiated-dl-dhe]
Gillmor, D., "Negotiated Discrete Log Diffie-Hellman Gillmor, D., "Negotiated Discrete Log Diffie-Hellman
Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- Ephemeral Parameters for TLS", draft-ietf-tls-negotiated-
dl-dhe-00 (work in progress), July 2014. dl-dhe-00 (work in progress), July 2014.
[I-D.ietf-tls-prohibiting-rc4] [I-D.ietf-tls-prohibiting-rc4]
Popov, A., "Prohibiting RC4 Cipher Suites", draft-ietf- Popov, A., "Prohibiting RC4 Cipher Suites", draft-ietf-
tls-prohibiting-rc4-01 (work in progress), October 2014. tls-prohibiting-rc4-01 (work in progress), October 2014.
[I-D.ietf-tls-sslv3-diediedie]
Barnes, R., Thomson, M., Pironti, A., and A. Langley,
"Deprecating Secure Sockets Layer Version 3.0", draft-
ietf-tls-sslv3-diediedie-00 (work in progress), December
2014.
[I-D.ietf-uta-tls-bcp] [I-D.ietf-uta-tls-bcp]
Sheffer, Y., Holz, R., and P. Saint-Andre, Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of TLS and DTLS", draft- "Recommendations for Secure Use of TLS and DTLS", draft-
ietf-uta-tls-bcp-07 (work in progress), November 2014. ietf-uta-tls-bcp-08 (work in progress), December 2014.
[I-D.irtf-cfrg-chacha20-poly1305] [I-D.irtf-cfrg-chacha20-poly1305]
Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF
protocols", draft-irtf-cfrg-chacha20-poly1305-03 (work in protocols", draft-irtf-cfrg-chacha20-poly1305-03 (work in
progress), November 2014. progress), November 2014.
[I-D.mathewson-no-gmtunixtime] [I-D.mathewson-no-gmtunixtime]
Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in
TLS", draft-mathewson-no-gmtunixtime-00 (work in TLS", draft-mathewson-no-gmtunixtime-00 (work in
progress), December 2013. progress), December 2013.
skipping to change at page 31, line 43 skipping to change at page 37, line 30
Overview, Assumptions, Problem Statement, and Goals", RFC Overview, Assumptions, Problem Statement, and Goals", RFC
4919, August 2007. 4919, August 2007.
[RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,
"Transport Layer Security (TLS) Session Resumption without "Transport Layer Security (TLS) Session Resumption without
Server-Side State", RFC 5077, January 2008. Server-Side State", RFC 5077, January 2008.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, January 2008. Encryption", RFC 5116, January 2008.
[RFC5216] Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS
Authentication Protocol", RFC 5216, March 2008.
[RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible
Authentication Protocol (EAP) Key Management Framework",
RFC 5247, August 2008.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, May 2008. (CRL) Profile", RFC 5280, May 2008.
[RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois [RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois
Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, Counter Mode (GCM) Cipher Suites for TLS", RFC 5288,
August 2008. August 2008.
[RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor
skipping to change at page 32, line 31 skipping to change at page 38, line 25
[RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained
Application Protocol (CoAP)", RFC 7252, June 2014. Application Protocol (CoAP)", RFC 7252, June 2014.
[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
Attack", BCP 188, RFC 7258, May 2014. Attack", BCP 188, RFC 7258, May 2014.
[RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer [RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer
Security (TLS) and Datagram Transport Layer Security Security (TLS) and Datagram Transport Layer Security
(DTLS)", RFC 7366, September 2014. (DTLS)", RFC 7366, September 2014.
[RFC7400] Bormann, C., "6LoWPAN-GHC: Generic Header Compression for
IPv6 over Low-Power Wireless Personal Area Networks
(6LoWPANs)", RFC 7400, November 2014.
[Tripple-HS]
Bhargavan, K., Delignat-Lavaud, C., Pironti, A., and P.
Strub, "Triple Handshakes and Cookie Cutters: Breaking and
Fixing Authentication over TLS", IEEE Symposium on
Security and Privacy, pages 98-113, 2014.
Appendix A. Conveying DTLS over SMS Appendix A. Conveying DTLS over SMS
This section is normative for the use of DTLS over SMS. Timer This section is normative for the use of DTLS over SMS. Timer
recommendations are already outlined in Section 13 and also recommendations are already outlined in Section 13 and also
applicable to the transport of DTLS over SMS. applicable to the transport of DTLS over SMS.
This section requires readers to be familiar with the terminology and This section requires readers to be familiar with the terminology and
concepts described in [GSM-SMS], and [WAP-WDP]. concepts described in [GSM-SMS], and [WAP-WDP].
The remainder of this section assumes Mobile Stations are capable of The remainder of this section assumes Mobile Stations are capable of
skipping to change at page 35, line 5 skipping to change at page 41, line 7
taken into account by the DTLS timeout and retransmission function. taken into account by the DTLS timeout and retransmission function.
Handshake messages MUST carry a validity period (TP-VP parameter in a Handshake messages MUST carry a validity period (TP-VP parameter in a
SMS-SUBMIT TPDU) that is not less than the current value of the SMS-SUBMIT TPDU) that is not less than the current value of the
retransmission timeout. In order to avoid persisting messages in the retransmission timeout. In order to avoid persisting messages in the
network that will be discarded by the receiving party, handshake network that will be discarded by the receiving party, handshake
messages SHOULD carry a validity period that is the same as, or just messages SHOULD carry a validity period that is the same as, or just
slightly higher than, the current value of the retransmission slightly higher than, the current value of the retransmission
timeout. timeout.
Appendix B. DTLS Record Layer Per-Packet Overhead
Figure 10 shows the overhead for the DTLS record layer for protecting
data traffic when AES-128-CCM with an 8-octet Integrity Check Value
(ICV) is used.
DTLS Record Layer Header................13 bytes
Nonce (Explicit).........................8 bytes
ICV..................................... 8 bytes
------------------------------------------------
Overhead................................29 bytes
------------------------------------------------
Figure 10: AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead.
The DTLS record layer header has 13 octets and consists of
o 1 octet content type field,
o 2 octet version field,
o 2 octet epoch field,
o 6 octet sequence number,
o 2 octet length field.
The "nonce" input to the AEAD algorithm is exactly that of [RFC5288],
i.e., 12 bytes long. It consists of a 4 octet salt and an 8 octet
nonce. The salt is the "implicit" part of the nonce and is not sent
in the packet. Since the nonce_explicit may be the 8 octet sequence
number and, in DTLS, it is the 8 octet epoch concatenated with the 6
octet sequence number.
RFC 6655 [RFC6655] allows the nonce_explicit to be a sequence number
or something else. This document makes this use more restrictive for
use with DTLS: the 64-bit none_explicit MUST be the 16-bit epoch
concatenated with the 48-bit seq_num. The sequence number component
of the nonce_explicit field at the AES-CCM layer is an exact copy of
the sequence number in the record layer header field. This leads to
a duplication of 8-bytes per record.
To avoid this 8-byte duplication RFC 7400 [RFC7400] provides help
with the use of the generic header compression technique for IPv6
over Low-Power Wireless Personal Area Networks (6LoWPANs). Note that
this header compression technique is not available when DTLS is
exchanged over transports that do not use IPv6 or 6LoWPAN, such as
the SMS transport described in Appendix A.
Authors' Addresses Authors' Addresses
Hannes Tschofenig (editor) Hannes Tschofenig (editor)
ARM Ltd. ARM Ltd.
110 Fulbourn Rd 110 Fulbourn Rd
Cambridge CB1 9NJ Cambridge CB1 9NJ
Great Britain Great Britain
Email: Hannes.tschofenig@gmx.net Email: Hannes.tschofenig@gmx.net
URI: http://www.tschofenig.priv.at URI: http://www.tschofenig.priv.at
 End of changes. 101 change blocks. 
354 lines changed or deleted 688 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/