< draft-ietf-dice-profile-09.txt   draft-ietf-dice-profile-10.txt >
dice H. Tschofenig, Ed. dice H. Tschofenig, Ed.
Internet-Draft ARM Ltd. Internet-Draft ARM Ltd.
Intended status: Standards Track T. Fossati Intended status: Standards Track T. Fossati
Expires: July 23, 2015 Alcatel-Lucent Expires: September 9, 2015 Alcatel-Lucent
January 19, 2015 March 8, 2015
A TLS/DTLS 1.2 Profile for the Internet of Things A TLS/DTLS Profile for the Internet of Things
draft-ietf-dice-profile-09.txt draft-ietf-dice-profile-10.txt
Abstract Abstract
A common design pattern in Internet of Things (IoT) deployments is A common design pattern in Internet of Things (IoT) deployments is
the use of a constrained device (typically providing sensor data) the use of a constrained device that collects data via sensor or
that makes data available for home automation, industrial control controls actuators for use in home automation, industrial control
systems, smart cities and other IoT deployments. systems, smart cities and other IoT deployments.
This document defines a Transport Layer Security (TLS) and Datagram This document defines a Transport Layer Security (TLS) and Datagram
TLS 1.2 profile that offers communications security for this data TLS (DTLS) 1.2 profile that offers communications security for this
exchange thereby preventing eavesdropping, tampering, and message data exchange thereby preventing eavesdropping, tampering, and
forgery. message forgery. The lack of communication security is a common
vulnerability in Internet of Things products that can easily be
solved by using these well-researched and widely deployed Internet
security protocols.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on July 23, 2015. This Internet-Draft will expire on September 9, 2015.
Copyright Notice Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4 3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4
4. Communication Models . . . . . . . . . . . . . . . . . . . . 5 4. Communication Models . . . . . . . . . . . . . . . . . . . . 5
4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 5 4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 6
4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 12 4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 13
5. The TLS/DTLS Ciphersuite Concept . . . . . . . . . . . . . . 16 5. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 18
6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 18 6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 19
6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 18 6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 19
6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 20 6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 21
6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 22 6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 23
7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 26 7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 27
8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 26 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 28
9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 28 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 29
10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 29 10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 30
11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 29 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 30
12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 30 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 31
13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 31 13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 33
14. Random Number Generation . . . . . . . . . . . . . . . . . . 32 14. Random Number Generation . . . . . . . . . . . . . . . . . . 34
15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 33 15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 35
16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 34 16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 35
17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 34 17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 36
18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 34 18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 36
19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 35 19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 36
20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 35 20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 37
21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 36 21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 38
22. Key Length Recommendations . . . . . . . . . . . . . . . . . 37 22. Key Length Recommendations . . . . . . . . . . . . . . . . . 39
23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 38 23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 39
24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 38 24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 40
25. Security Considerations . . . . . . . . . . . . . . . . . . . 39 25. Security Considerations . . . . . . . . . . . . . . . . . . . 41
26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 39 26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 41
27. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 40 27. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 41
28. References . . . . . . . . . . . . . . . . . . . . . . . . . 40 28. References . . . . . . . . . . . . . . . . . . . . . . . . . 42
28.1. Normative References . . . . . . . . . . . . . . . . . . 40 28.1. Normative References . . . . . . . . . . . . . . . . . . 42
28.2. Informative References . . . . . . . . . . . . . . . . . 41 28.2. Informative References . . . . . . . . . . . . . . . . . 43
Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 46 Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 49
A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 47 A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 49
A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 47 A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 50
A.3. Multiplexing Security Associations . . . . . . . . . . . 48 A.3. Multiplexing Security Associations . . . . . . . . . . . 50
A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 48 A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 51
Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 52
Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 49 Appendix C. DTLS Fragmentation . . . . . . . . . . . . . . . . . 53
Appendix C. DTLS Fragmentation . . . . . . . . . . . . . . . . . 50 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 53
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 50
1. Introduction 1. Introduction
An engineer developing an Internet of Things (IoT) device needs to An engineer developing an Internet of Things (IoT) device needs to
investigate the security threats and decide about the security investigate the security threats and decide about the security
services that can be used to mitigate these threats. services that can be used to mitigate these threats.
Enabling IoT devices to make data available often requires Enabling IoT devices to exchange data often requires authentication
authentication of the two endpoints and the ability to provide of the two endpoints and the ability to provide integrity- and
integrity- and confidentiality-protection of exchanged data. While confidentiality-protection of exchanged data. While these security
these security services can be provided at different layers in the services can be provided at different layers in the protocol stack,
protocol stack the use of Transport Layer Security (TLS)/Datagram TLS the use of Transport Layer Security (TLS)/Datagram TLS (DTLS) has
(DTLS) has been very popular with many application protocols and it been very popular with many application protocols and it is likely to
is likely to be useful for IoT scenarios as well. be useful for IoT scenarios as well.
To make Internet protocols fit constrained devices can be difficult Fitting Internet protocols into constrained devices can be difficult
but thanks to the standardization efforts new profiles and protocols but thanks to the standardization efforts new profiles and protocols
are available, such as the Constrained Application Protocol (CoAP) are available, such as the Constrained Application Protocol (CoAP)
[RFC7252]. UDP is mainly used to carry CoAP messages but other [RFC7252]. UDP is mainly used to carry CoAP messages but other
transports can be utilized, such as SMS or even TCP. transports can be utilized, such as SMS or even TCP.
While this document is inspired by the desire to protect CoAP While the main goal for this document is to protect CoAP messages
messages using DTLS 1.2 [RFC6347] the guidance in this document is using DTLS 1.2 [RFC6347] the information contained in the following
not limited to CoAP nor to DTLS itself. sections is not limited to CoAP nor to DTLS itself.
Instead, this document defines a profile of DTLS 1.2 [RFC6347] and Instead, this document defines a profile of DTLS 1.2 [RFC6347] and
TLS 1.2 [RFC5246] that offers communication security for IoT TLS 1.2 [RFC5246] that offers communication security services for IoT
applications and is reasonably implementable on many constrained applications and is reasonably implementable on many constrained
devices. Profile thereby means that available configuration options devices. Profile thereby means that available configuration options
and protocol extensions are utilized to best support the IoT and protocol extensions are utilized to best support the IoT
environment. This document does not alter TLS/DTLS specifications environment. This document does not alter TLS/DTLS specifications
and does not introduce any new TLS/DTLS extensions. and does not introduce any new TLS/DTLS extension.
The main target audience for this document is the embedded system The main target audience for this document is the embedded system
developer configuring and using a TLS/DTLS stack. This document may, developer configuring and using a TLS/DTLS stack. This document may,
however, also help those developing or selecting a suitable TLS/DTLS however, also help those developing or selecting a suitable TLS/DTLS
stack for an Internet of Things product development. stack for an Internet of Things product.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
This specification refers to TLS as well as DTLS and particularly to
version 1.2, which is the most recent version at the time of writing.
We refer to TLS/DTLS whenever the text is applicable to both versions
of the protocol and to TLS or DTLS when there are differences between
the two protocols.
Note that "Client" and "Server" in this document refer to TLS/DTLS Note that "Client" and "Server" in this document refer to TLS/DTLS
roles, where the Client initiates the TLS/DTLS handshake. This does roles, where the client initiates the handshake. This does not
not restrict the interaction pattern of the protocols on top of TLS/ restrict the interaction pattern of the protocols on top of DTLS
DTLS since the record layer allows bi-directional communication. since the record layer allows bi-directional communication. This
This aspect is further described in Section 4. aspect is further described in Section 4.
RFC 7228 [RFC7228] introduces the notion of constrained-node RFC 7228 [RFC7228] introduces the notion of constrained-node
networks, which are small devices with severe constraints on power, networks, which are made of small devices with severe constraints on
memory, and processing resources. The terms constrained devices, and power, memory, and processing resources. The terms constrained
Internet of Things (IoT) devices are used interchangeably. devices, and Internet of Things (IoT) devices are used
interchangeably.
The terms "Certification Authority" (CA) and "Distinguished Name"
(DN) are taken from [RFC5280]. The terms "trust anchor" and "trust
anchor store" are defined in [RFC6024] as
"A trust anchor represents an authoritative entity via a public
key and associated data. The public key is used to verify digital
signatures, and the associated data is used to constrain the types
of information for which the trust anchor is authoritative."
"A trust anchor store is a set of one or more trust anchors stored
in a device. A device may have more than one trust anchor store,
each of which may be used by one or more applications."
3. TLS/DTLS Protocol Overview 3. TLS/DTLS Protocol Overview
The TLS protocol [RFC5246] provides authenticated, confidentiality- The TLS protocol [RFC5246] provides authenticated, confidentiality-
and integrity-protected communication between two endpoints. The and integrity-protected communication between two endpoints. The
protocol is composed of two layers: the Record Protocol and the protocol is composed of two layers: the Record Protocol and the
Handshake Protocol. At the lowest level, layered on top of a Handshaking Protocols. At the lowest level, layered on top of a
reliable transport protocol (e.g., TCP), is the Record Protocol. It reliable transport protocol (e.g., TCP), is the Record Protocol. It
provides connection security by using symmetric cryptography for provides connection security by using symmetric cryptography for
confidentiality, data origin authentication, and integrity confidentiality, data origin authentication, and integrity
protection. The Record Protocol is used for encapsulation of various protection. The Record Protocol is used for encapsulation of various
higher-level protocols. One such encapsulated protocol, the higher-level protocols. The handshaking protocols consist of three
Handshake Protocol, allows the server and client to authenticate each sub-protocols, namely the handshake protocol, the change cipher spec
other and to negotiate an encryption algorithm and cryptographic keys protocol and the alert protocol. The handshake protocol allows the
before the application protocol transmits or receives data. server and client to authenticate each other and to negotiate an
encryption algorithm and cryptographic keys before the application
protocol transmits or receives data.
The design of DTLS [RFC6347] is intentionally very similar to TLS. The design of DTLS [RFC6347] is intentionally very similar to TLS.
Since DTLS operates on top of an unreliable datagram transport a few However, since DTLS operates on top of an unreliable datagram
enhancements to the TLS structure are, however necessary. RFC 6347 transport, it must explicitly cope with the reliable and ordered
explains these differences in great detail. As a short summary, for delivery assumptions made by TLS. RFC 6347 explains these
those not familiar with DTLS the differences are: differences in great detail. As a short summary, for those not
familiar with DTLS the differences are:
o An explicit sequence number and an epoch field is included in the o An explicit sequence number and an epoch field is included in the
Record Protocol. Section 4.1 of RFC 6347 explains the processing Record Protocol. Section 4.1 of RFC 6347 explains the processing
rules for these two new fields. The value used to compute the MAC rules for these two new fields. The value used to compute the MAC
is the 64-bit value formed by concatenating the epoch and the is the 64-bit value formed by concatenating the epoch and the
sequence number. sequence number.
o Stream ciphers must not be used with DTLS. The only stream cipher o Stream ciphers must not be used with DTLS. The only stream cipher
defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it
is not recommended anymore even for use with TLS is not recommended anymore even for use with TLS
[I-D.ietf-tls-prohibiting-rc4]. Note that the term 'stream [I-D.ietf-tls-prohibiting-rc4]. Note that the term 'stream
cipher' is a technical term in the TLS specification. Section 4.7 cipher' is a technical term in the TLS specification. Section 4.7
of RFC 5246 defines stream ciphers in TLS as follows. In stream of RFC 5246 defines stream ciphers in TLS as follows: in stream
cipher encryption, the plaintext is exclusive-ORed with an cipher encryption, the plaintext is exclusive-ORed with an
dentical amount of output generated from a cryptographically identical amount of output generated from a cryptographically
secure keyed pseudorandom number generator. secure keyed pseudorandom number generator.
o The TLS Handshake Protocol has been enhanced to include a o The TLS Handshake Protocol has been enhanced to include a
stateless cookie exchange for Denial of Service (DoS) resistance. stateless cookie exchange for Denial of Service (DoS) resistance.
For this purpose a new handshake message, the HelloVerifyRequest, For this purpose a new handshake message, the HelloVerifyRequest,
was added to DTLS. This handshake message is sent by the server was added to DTLS. This handshake message is sent by the server
and includes a stateless cookie, which is returned in a and includes a stateless cookie, which is returned in a
ClientHello message back to the server. Although the exchange is ClientHello message back to the server. Although the exchange is
optional for the server to execute, a client implementation has to optional for the server to execute, a client implementation has to
be prepared to respond to it. Furthermore, the handshake message be prepared to respond to it. Furthermore, the handshake message
format has been extended to deal with message loss, reordering, format has been extended to deal with message loss, reordering,
and fragmentation. Retransmission timers have been included to and fragmentation.
deal with message loss.
4. Communication Models 4. Communication Models
This document describes a profile of TLS/DTLS 1.2 and, to be useful, This document describes a profile of DTLS and, to be useful, it has
it has to make assumptions about the envisioned communication to make assumptions about the envisioned communication architecture.
architecture.
Two communication architectures (and consequently two profiles) are Two communication architectures (and consequently two profiles) are
described in this document. described in this document.
4.1. Constrained TLS/DTLS Clients 4.1. Constrained TLS/DTLS Clients
The communication architecture shown in Figure 1 assumes a unicast The communication architecture shown in Figure 1 assumes a unicast
communication interaction with an IoT device utilizing a constrained communication interaction with an IoT device utilizing a constrained
TLS/DTLS client interacting with one or multiple TLS/DTLS servers. TLS/DTLS client interacting with one or multiple TLS/DTLS servers.
Before a client can initiate the TLS/DTLS handshake it needs to know Before a client can initiate the TLS/DTLS handshake it needs to know
the IP address of that server and what credentials to use. the IP address of that server and what credentials to use.
Application layer protocols, such as CoAP, conveyed on top of DTLS Application layer protocols, such as CoAP, which is conveyed on top
may need additional information, such information about URLs of the of DTLS, may be configured with URIs of the endpoints to which CoAP
endpoints the CoAP needs to register and publish information to. needs to register and publish data. This configuration information
This configuration information (including credentials) may be (including credentials) may be conveyed to clients as part of a
conveyed to clients as part of a firmware/software package or via a firmware/software package or via a configuration protocol. The
configuration protocol. The following credential types are supported following credential types are supported by this profile:
by this profile:
o For PSK-based authentication (see Section 6.1), this includes the o For PSK-based authentication (see Section 6.1), this includes the
paired "PSK identity" and shared secret to be used with each paired "PSK identity" and shared secret to be used with each
server. server.
o For raw public key-based authentication (see Section 6.2), this o For raw public key-based authentication (see Section 6.2), this
includes either the server's public key or the hash of the includes either the server's public key or the hash of the
server's public key. server's public key.
o For certificate-based authentication (see Section 6.3), this o For certificate-based authentication (see Section 6.3), this
includes a pre-populated trust anchor store that allows the DTLS includes a pre-populated trust anchor store that allows the DTLS
stack to perform path validation for the certificate obtained stack to perform path validation for the certificate obtained
during the handshake with the server. during the handshake with the server.
Figure 1 shows example configuration information stored at the
constrained client for use with respective servers.
This document focuses on the description of the DTLS client-side This document focuses on the description of the DTLS client-side
functionality but, quite naturally, the equivalent server-side functionality but, quite naturally, the equivalent server-side
support has to be available. support has to be available.
+////////////////////////////////////+ +////////////////////////////////////+
| Configuration | | Configuration |
|////////////////////////////////////| |////////////////////////////////////|
| Server A --> PSK Identity, PSK | | Server A --> PSK Identity, PSK |
| |
| Server B --> Public Key (Server B),| | Server B --> Public Key (Server B),|
| Public Key (Client) | | Public/Private Key |
| Server C --> Public Key (Client), | | (for Client) |
| |
| Server C --> Public/Private Key |
| (for Client) |
| Trust Anchor Store | | Trust Anchor Store |
+------------------------------------+ +------------------------------------+
oo oo
oooooo oooooo
o o
+-----------+ +-----------+
|Constrained| |Constrained|
|TLS/DTLS | |TLS/DTLS |
|Client |- |Client |-
+-----------+ \ +-----------+ \
skipping to change at page 7, line 27 skipping to change at page 8, line 18
Figure 2 shows the network access architecture with the IoT device Figure 2 shows the network access architecture with the IoT device
initiating the communication to an access point in the network using initiating the communication to an access point in the network using
the procedures defined for a specific physical layer. Since the procedures defined for a specific physical layer. Since
credentials may be managed and stored centrally, in the credentials may be managed and stored centrally, in the
Authentication, Authorization, and Accounting (AAA) server, the Authentication, Authorization, and Accounting (AAA) server, the
security protocol exchange may need to be relayed via the security protocol exchange may need to be relayed via the
Authenticator, i.e., functionality running on the access point, to Authenticator, i.e., functionality running on the access point, to
the AAA server. The authentication and key exchange protocol itself the AAA server. The authentication and key exchange protocol itself
is encapsulated within a container, the Extensible Authentication is encapsulated within a container, the Extensible Authentication
Protocol (EAP), and messages are conveyed back and forth between the Protocol (EAP) [RFC3748], and messages are conveyed back and forth
EAP endpoints, namely the EAP peer located on the IoT device and the between the EAP endpoints, namely the EAP peer located on the IoT
EAP server located on the AAA server or the access point. To route device and the EAP server located on the AAA server or the access
EAP messages from the access point, acting as a AAA client, to the point. To route EAP messages from the access point, acting as a AAA
AAA server requires an adequate protocol mechanism, name RADIUS or client, to the AAA server requires an adequate protocol mechanism,
Diameter. namely RADIUS [RFC2865] or Diameter [RFC6733].
More details about the concepts and a description about the More details about the concepts and a description about the
terminology can be found in RFC 5247 [RFC5247]. terminology can be found in RFC 5247 [RFC5247].
+--------------+ +--------------+
|Authentication| |Authentication|
|Authorization | |Authorization |
|Accounting | |Accounting |
|Server | |Server |
|(EAP Server) | |(EAP Server) |
skipping to change at page 8, line 41 skipping to change at page 9, line 41
| |<--------------------------->| | | |<--------------------------->| |
| | | | | | | |
| | Physical Layer | | | | Physical Layer | |
| |<===========================>| | | |<===========================>| |
+-------------+ +---------------+ +-------------+ +---------------+
Legend: Legend:
<****>: Device-to-AAA Server Exchange <****>: Device-to-AAA Server Exchange
<---->: Device-to-Authenticator Exchange <---->: Device-to-Authenticator Exchange
<oooo>: AAA Client-to-AAA Server Exchange <oooo>: AAA Client-to-AAA Server Exchange
<====>: Phyiscal layer like IEEE 802.11/802.15.4 <====>: Physical layer like IEEE 802.11/802.15.4
Figure 2: Network Access Architecture.. Figure 2: Network Access Architecture.
One standardized EAP method is EAP-TLS, defined in RFC 5216 One standardized EAP method is EAP-TLS, defined in RFC 5216
[RFC5216], which re-uses the TLS-based protocol exchange and [RFC5216], which re-uses the TLS-based protocol exchange and
encapsulates it inside the EAP payload. In terms of re-use this encapsulates it inside the EAP payload. In terms of re-use this
allows many components of the TLS protocol to be shared between the allows many components of the TLS protocol to be shared between the
network access security functionality and the TLS functionality network access security functionality and the TLS functionality
needed for securing application layer traffic. The EAP-TLS exchange needed for securing application layer traffic. In the EAP-TLS
is shown in Figure 3 where it is worthwhile to point out that in EAP exchange shown in Figure 3 the IoT device as the EAP peer acts as a
the client / server roles are reversed but with the use of EAP-TLS TLS client.
the IoT device acts as a TLS client.
Authenticating Peer Authenticator Authenticating Peer Authenticator
------------------- ------------- ------------------- -------------
<- EAP-Request/ <- EAP-Request/
Identity Identity
EAP-Response/ EAP-Response/
Identity (MyID) -> Identity (MyID) ->
<- EAP-Request/ <- EAP-Request/
EAP-Type=EAP-TLS EAP-Type=EAP-TLS
(TLS Start) (TLS Start)
skipping to change at page 10, line 17 skipping to change at page 11, line 17
When a constrained client uploads sensor data to a server When a constrained client uploads sensor data to a server
infrastructure it may use CoAP by pushing the data via a POST message infrastructure it may use CoAP by pushing the data via a POST message
to a pre-configured endpoint on the server. In certain circumstances to a pre-configured endpoint on the server. In certain circumstances
this might be too limiting and additional functionality is needed, as this might be too limiting and additional functionality is needed, as
shown in Figure 4, where the IoT device itself runs a CoAP server shown in Figure 4, where the IoT device itself runs a CoAP server
hosting the resource that is made accessible to other entities. hosting the resource that is made accessible to other entities.
Despite running a CoaP server on the IoT device it is still the DTLS Despite running a CoaP server on the IoT device it is still the DTLS
client on the IoT device that initiates the interaction with the non- client on the IoT device that initiates the interaction with the non-
constrained resource server in our scenario. constrained resource server in our scenario.
Figure 4 shows a sensor starting with a DTLS exchange with a resource Figure 4 shows a sensor starting a DTLS exchange with a resource
directory to register available resources. directory to register available resources.
[I-D.ietf-core-resource-directory] defines the resource directory as [I-D.ietf-core-resource-directory] defines the resource directory
a web entity that stores information about web resources and (RD) as a web entity that stores information about web resources and
implements the REST interfaces defined in implements Representational State Transfer (REST) interfaces for
[I-D.ietf-core-resource-directory] for registration and lookup of registration and lookup of those resources. Note that the described
those resources. exchange is borrowed from the OMA Lightweight Machine-to-Machine
(LWM2M) specification [LWM2M] that uses RD but adds proxy
functionality.
The initial DTLS interaction between the sensor, acting as a DTLS The initial DTLS interaction between the sensor, acting as a DTLS
client, and the resource directory, acting as a DTLS server, will be client, and the resource directory, acting as a DTLS server, will be
a full DTLS handshake. Once this handshake is complete both parties a full DTLS handshake. Once this handshake is complete both parties
have established the DTLS record layer. Subsequently, the CoAP have established the DTLS record layer. Subsequently, the CoAP
client can securely register at the resource directory. Details client can securely register at the resource directory.
about the capabilities of the resource directory can be found in
[I-D.ietf-core-resource-directory].
After some time (assuming that the client regularly refreshes its After some time (assuming that the client regularly refreshes its
registration) the resource directory receives a request (not shown in registration) the resource directory receives a request from an
the figure) from an application to retrieve the temperature application to retrieve the temperature information from the sensor.
information from the sensor. This request is relayed by the resource This request is relayed by the resource directory to the sensor using
directory to the sensor using a GET message exchange. The already a GET message exchange. The already established DTLS record layer
established DTLS record layer can be used to secure the message can be used to secure the message exchange.
exchange.
Resource Resource
Sensor Directory Sensor Directory
------ --------- ------ ---------
+--- +---
| |
| ClientHello --------> | ClientHello -------->
| client_certificate_type | client_certificate_type
F| server_certificate_type F| server_certificate_type
skipping to change at page 12, line 4 skipping to change at page 12, line 51
\ Y \ Y
* \ E * \ E
* (time passes) \ R * (time passes) \ R
* \ * \
+--- \ P +--- \ P
C| \ R C| \ R
O| Req: GET coaps://sensor.example.com/temp \ O O| Req: GET coaps://sensor.example.com/temp \ O
A| <-------- \ T A| <-------- \ T
P| \ E P| \ E
| Res: 2.05 Content \ C | Res: 2.05 Content \ C
G| Payload: \ T G| Payload: \ T
E| 25.5 --------> \ E E| 25.5 --------> \ E
T| \ D T| \ D
+--- ///+ +--- ///+
Figure 4: DTLS/CoAP exchange using Resource Directory. Figure 4: DTLS/CoAP exchange using Resource Directory.
4.2. Constrained TLS/DTLS Servers 4.2. Constrained TLS/DTLS Servers
Section 4.1 illustrates a deployment model where the TLS/DTLS client Section 4.1 illustrates a deployment model where the TLS/DTLS client
is constrained and efforts need to be taken to improve memory is constrained and efforts need to be taken to improve memory
utilization, bandwidth consumption, reduce performance impacts, etc. utilization, bandwidth consumption, reduce performance impacts, etc.
In this section we look at cases where constrained devices run TLS/ In this section, we assume a scenario where constrained devices run
DTLS servers to secure access to application layer services running TLS/ DTLS servers to secure access to application layer services
on top of CoAP, HTTP or other protocols. Running server running on top of CoAP, HTTP or other protocols. Figure 5
functionality on a constrained node is typically more demanding since illustrates a possible deployment whereby a number of constrained
servers have to wait for incoming requests. Therefore, they will servers are waiting for regular clients to access their resources.
have fewer possibilities to enter sleep-cycles. Nevertheless, there The entire process is likely, but not necessarily, controlled by a
are legitimate reasons for deploying servers as constrained devices. third party, the authentication and authorisation server. This
Figure 5 illustrates a possible deployment whereby a number of
constrained servers are waiting for regular clients to access their
resources. The entire process is likely to be controlled by a third
party, the authentication and authorization server. This
authentication and authorization server is responsible for holding authentication and authorization server is responsible for holding
authorization policies (in the form of access control policies) that authorization policies that govern the access to resources and
govern the access to resources and distribution of keying material. distribution of keying material.
+////////////////////////////////////+ +////////////////////////////////////+
| Configuration | | Configuration |
|////////////////////////////////////| |////////////////////////////////////|
| Credentials | | Credentials |
| Client A -> Public Key | | Client A -> Public Key |
| Server S1 -> Symmetric Key ,| | Server S1 -> Symmetric Key |
| Server S2 -> Certificate | | Server S2 -> Certificate |
| Server S3 -> Public Key | | Server S3 -> Public Key |
| Trust Anchor Store | | Trust Anchor Store |
| Access Control Lists | | Access Control Lists |
| Resource X: Client A / GET | | Resource X: Client A / GET |
| Resource Y: Client A / PUT | | Resource Y: Client A / PUT |
+------------------------------------+ +------------------------------------+
oo oo
oooooo oooooo
o o
skipping to change at page 13, line 44 skipping to change at page 14, line 44
'---+---' | Server S2 | '---+---' | Server S2 |
| +-----------+ | +-----------+
| |
| +-----------+ | +-----------+
+-----------------> |Constrained| +-----------------> |Constrained|
| Server S3 | | Server S3 |
+-----------+ +-----------+
Figure 5: Constrained Server Profile. Figure 5: Constrained Server Profile.
Figure 6 shows an example interaction whereby a device, a thermostat
in our case, searches in the local network for discoverable resources
and accesses those. The thermostat starts the procedure using a
link-local discovery message using the "All CoAP Nodes" multicast
address by utilizing the RFC 6690 [RFC6690] link format. The IPv6
multicast address used for site-local discovery is FF02::FD. As a
result, a temperature sensor and a fan respond. These responses
allow the thermostat to subsequently read temperature information
from the temperature sensor with a CoAP GET request issued to the
previously learned endpoint. In this hypothetical example we assume
that this temperature sensor provides this information to every party
and no access control mechanism is enforced. However, when the
thermostat subsequently uses the obtained temperature reading to
control a fan, the fan requires authentication and authorization of
the entity requesting changes and TLS is used to authenticate both
endpointas and to secure the communication.
Temperature
Thermostat Sensor Fan
---------- --------- ---
Discovery
-------------------->
GET coap://[FF02::FD]/.well-known/core
CoAP 2.05 Content
<-------------------------------
</3303/0/5700>;rt="temperature";
if="sensor"
CoAP 2.05 Content
<--------------------------------------------------
</fan>;rt="fan";if="actuation"
Read Sensor Data (unauthenticated)
------------------------------->
GET /3303/0/5700
CoAP 2.05 Content
<-------------------------------
22.5 C
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
\ /
\ Protocol steps to obtain authorization token / client /
\ credentials for access to the fan-provided resources. /
\ /
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
Configure Actuator (with authorization credentials)
--------------------------------------------------
PUT /fan?on-off=true
CoAP 2.04 Changed
<-------------------------------------------------
Figure 6: Local Discovery and Resouce Access.
A deployment with constrained servers has to overcome several A deployment with constrained servers has to overcome several
challenges. Below we explain how these challenges have been solved challenges. Below we explain how these challenges have be solved
with CoAP, as an example. Other protocols may offer similar with CoAP, as an example. Other protocols may offer similar
capabilities. While the requirements for the TLS/DTLS protocol capabilities. While the requirements for the TLS/DTLS protocol
profile change only slightly when run on a constrained server (in profile change only slightly when run on a constrained server (in
comparison to running it on a constrained client) several other eco- comparison to running it on a constrained client) several other eco-
system factor will impact deployment. system factor will impact deployment.
The challenges are: There are several challenges that need to be addressed:
Discovery and Reachability: Discovery and Reachability:
Before initiating a connection to a constrained server a client A client must first and foremost discover the server before
first needs to discover that server and, once discovered, it needs initiating a connection to it. Once it as been discovered,
to maintain reachability with that device. reachability to the device needs to be maintained.
In CoAP the discovery of resources offered by servers is In CoAP the discovery of resources offered by servers is
accomplished by sending a unicast or multicast CoAP GET to a well- accomplished by sending a unicast or multicast CoAP GET to a well-
known URI. The CORE Link format specification [RFC6690] describes known URI. The CORE Link format specification [RFC6690] describes
the use case (see Section 1.2.1), and reserves the URI (see the use case (see Section 1.2.1), and reserves the URI (see
Section 7.1). Section 7 of the CoAP specification [RFC7252] Section 7.1). Section 7 of the CoAP specification [RFC7252]
describes the discovery procedure. RFC 7390 [RFC7390] describes describes the discovery procedure. [RFC7390] describes use case
use case for discovering CoAP servers using multicast (see for discovering CoAP servers using multicast (see Section 3.3),
Section 3.3), and specifies the protocol processing rules for CoAP and specifies the protocol processing rules for CoAP group
group communications (see Section 2.7). communications (see Section 2.7).
The use of Resource Directory (RD)
[I-D.ietf-core-resource-directory] is yet another possibility for
discovering registered servers and their resources. Since RD is
usually not a proxy, clients can discover links registered with
the RD and then access them directly.
Authentication: Authentication:
The next challenge concerns the provisioning of authentication The next challenge concerns the provisioning of authentication
credentials to the clients as well as servers. In Section 4.1 we credentials to the clients as well as servers. In Section 4.1 we
assumed that credentials (and other configuration information) are assumed that credentials (and other configuration information) are
provisioned to the device and that those can be used with the provisioned to the device and that those can be used with the
authorization servers. Of course, this leads to a very static authorization servers. Of course, this leads to a very static
relationship between the clients and their server-side relationship between the clients and their server-side
infrastructure but poses fewer challenges from a deployment point infrastructure but poses fewer challenges from a deployment point
skipping to change at page 16, line 47 skipping to change at page 16, line 34
Authorization Authorization
The last challenge is the ability for the constrained server to The last challenge is the ability for the constrained server to
make an authorization decision when clients access protected make an authorization decision when clients access protected
resources. Pre-provisioning access control information to resources. Pre-provisioning access control information to
constrained servers may be one option but works only in a small constrained servers may be one option but works only in a small
scale, less dynamic environment. For a more fine-grained and scale, less dynamic environment. For a more fine-grained and
dynamic access control the reader is referred to the ongoing work dynamic access control the reader is referred to the ongoing work
in the ACE working group. in the ACE working group.
5. The TLS/DTLS Ciphersuite Concept Figure 6 shows an example interaction whereby a device, a thermostat
in our case, searches in the local network for discoverable resources
and accesses those. The thermostat starts the procedure using a
link-local discovery message using the "All CoAP Nodes" multicast
address by utilizing the RFC 6690 [RFC6690] link format. The IPv6
multicast address used for site-local discovery is FF02::FD. As a
result, a temperature sensor and a fan respond. These responses
allow the thermostat to subsequently read temperature information
from the temperature sensor with a CoAP GET request issued to the
previously learned endpoint. In this example we assume that
accessing the temperature sensor readings and controlling the fan
requires authentication and authorization of the thermostat and TLS
is used to authenticate both endpoint and to secure the
communication.
Temperature
Thermostat Sensor Fan
---------- --------- ---
Discovery
-------------------->
GET coap://[FF02::FD]/.well-known/core
CoAP 2.05 Content
<-------------------------------
</3303/0/5700>;rt="temperature";
if="sensor"
CoAP 2.05 Content
<--------------------------------------------------
</fan>;rt="fan";if="actuation"
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
\ /
\ Protocol steps to obtain access token or keying /
\ material for access to the temperature sensor and fan. /
\ /
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
Read Sensor Data
(authenticated/authorized)
------------------------------->
GET /3303/0/5700
CoAP 2.05 Content
<-------------------------------
22.5 C
Configure Actuator
(authenticated/authorized)
------------------------------------------------->
PUT /fan?on-off=true
CoAP 2.04 Changed
<-------------------------------------------------
Figure 6: Local Discovery and Resouce Access.
5. The Ciphersuite Concept
TLS (and consequently DTLS) has the concept of ciphersuites and an TLS (and consequently DTLS) has the concept of ciphersuites and an
IANA registry [IANA-TLS] was created to register the suites. A IANA registry [IANA-TLS] was created to register the suites. A
ciphersuite (and the specification that defines it) contains the ciphersuite (and the specification that defines it) contains the
following information: following information:
o Authentication and key exchange algorithm (e.g., PSK) o Authentication and key exchange algorithm (e.g., PSK)
o Cipher and key length (e.g., Advanced Encryption Standard (AES) o Cipher and key length (e.g., Advanced Encryption Standard (AES)
with 128 bit keys [AES]) with 128 bit keys [AES])
o Mode of operation (e.g., Counter with Cipher Block Chaining - o Mode of operation (e.g., Counter with Cipher Block Chaining -
Message Authentication Code (CBC-MAC) Mode (CCM) for AES) Message Authentication Code (CBC-MAC) Mode (CCM) for AES)
[RFC3610] [RFC3610]
o Hash algorithm for integrity protection, such as the Secure Hash o Hash algorithm for integrity protection, such as the Secure Hash
Algorithm (SHA) in combination with Keyed-Hashing for Message Algorithm (SHA) in combination with Keyed-Hashing for Message
Authentication (HMAC) (see [RFC2104] and [RFC4634]) Authentication (HMAC) (see [RFC2104] and [RFC4634])
o Hash algorithm for use with the pseudorandom function (e.g., HMAC o Hash algorithm for use with pseudorandom functions (e.g., HMAC
with the SHA-256) with the SHA-256)
o Misc information (e.g., length of authentication tags) o Misc information (e.g., length of authentication tags)
o Information whether the ciphersuite is suitable for DTLS or only o Information whether the ciphersuite is suitable for DTLS or only
for TLS for TLS
The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a
pre-shared authentication and key exchange algorithm. RFC 6655 pre-shared authentication and key exchange algorithm. [RFC6655]
[RFC6655] defines this ciphersuite. It uses the Advanced Encryption defines this ciphersuite. It uses the Advanced Encryption Standard
Standard (AES) encryption algorithm, which is a block cipher. Since (AES) encryption algorithm, which is a block cipher. Since the AES
the AES algorithm supports different key lengths (such as 128, 192 algorithm supports different key lengths (such as 128, 192 and 256
and 256 bits) this information has to be specified as well and the bits) this information has to be specified as well and the selected
selected ciphersuite supports 128 bit keys. A block cipher encrypts ciphersuite supports 128 bit keys. A block cipher encrypts plaintext
plaintext in fixed-size blocks and AES operates on fixed block size in fixed-size blocks and AES operates on fixed block size of 128
of 128 bits. For messages exceeding 128 bits, the message is bits. For messages exceeding 128 bits, the message is partitioned
partitioned into 128-bit blocks and the AES cipher is applied to into 128-bit blocks and the AES cipher is applied to these input
these input blocks with appropriate chaining, which is called mode of blocks with appropriate chaining, which is called mode of operation.
operation.
TLS 1.2 introduced Authenticated Encryption with Associated Data TLS 1.2 introduced Authenticated Encryption with Associated Data
(AEAD) ciphersuites (see [RFC5116] and [RFC6655]). AEAD is a class (AEAD) ciphersuites (see [RFC5116] and [RFC6655]). AEAD is a class
of block cipher modes which encrypt (parts of) the message and of block cipher modes which encrypt (parts of) the message and
authenticate the message simultaneously. Examples of such modes authenticate the message simultaneously. Examples of such modes
include the Counter with Cipher Block Chaining - Message include the Counter with Cipher Block Chaining - Message
Authentication Code (CBC-MAC) Mode (CCM) mode, and the Galois/Counter Authentication Code (CBC-MAC) Mode (CCM) mode, and the Galois/Counter
Mode (GCM) (see [RFC5288] and [RFC7251]). Mode (GCM) (see [RFC5288] and [RFC7251]).
Some AEAD ciphersuites have shorter authentication tags and are Some AEAD ciphersuites have shorter authentication tags (i.e.,
therefore more suitable for networks with low bandwidth where small message authentication codes) and are therefore more suitable for
message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite networks with low bandwidth where small message size matters. The
that ends in "_8" has an 8-octet authentication tag, while the TLS_PSK_WITH_AES_128_CCM_8 ciphersuite that ends in "_8" has an
regular CCM ciphersuites have, at the time of writing, 16-octet 8-octet authentication tag, while the regular CCM ciphersuites have,
authentication tags. at the time of writing, 16-octet authentication tags. The design of
CCM and the security properties are described in [CCM].
TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in
the TLS pseudo random function (PRF) used in earlier versions of TLS the TLS pseudo random function (PRF) used in earlier versions of TLS
with cipher-suite-specified PRFs. For this reason authors of more with cipher-suite-specified PRFs. For this reason authors of more
recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC
algorithm and the hash functions used with the TLS PRF. algorithm and the hash functions used with the TLS PRF.
6. Credential Types 6. Credential Types
The mandatory-to-implement functionality will depend on the
credential type used with IoT devices. The sub-sections below
describe the implications of three different credential types, namely
pre-shared secrets, raw public keys, and certificates. When using
pre-shared key, a critical consideration is how to assure the
randomness of these secrets. The best practice is to ensure that any
pre-shared key contains as much randomness as possible. Deriving a
shared secret from a password, name, or other low-entropy source is
not secure. A low-entropy secret, or password, is subject to
dictionary attacks.
6.1. Pre-Shared Secret 6.1. Pre-Shared Secret
The use of pre-shared secret credentials is one of the most basic The use of pre-shared secrets is one of the most basic techniques for
techniques for TLS/DTLS since it is both computational efficient and TLS/DTLS since it is both computational efficient and bandwidth
bandwidth conserving. Pre-shared secret based authentication was conserving. Pre-shared secret based authentication was introduced to
introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in TLS with RFC 4279 [RFC4279]. The exchange shown in Figure 7
Figure 7 illustrates the DTLS exchange including the cookie exchange. illustrates the DTLS exchange including the cookie exchange. While
While the server is not required to initiate a cookie exchange with the server is not required to initiate a cookie exchange with every
every handshake, the client is required to implement and to react on handshake, the client is required to implement and to react on it
it when challenged. The cookie exchange allows the server to react when challenged. The cookie exchange allows the server to react to
to flooding attacks. flooding attacks.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
<-------- HelloVerifyRequest <-------- HelloVerifyRequest
(contains cookie) (contains cookie)
ClientHello --------> ClientHello -------->
(with cookie) (with cookie)
skipping to change at page 19, line 36 skipping to change at page 20, line 36
* indicates an optional message payload * indicates an optional message payload
Figure 7: DTLS PSK Authentication including the Cookie Exchange. Figure 7: DTLS PSK Authentication including the Cookie Exchange.
[RFC4279] does not mandate the use of any particular type of client [RFC4279] does not mandate the use of any particular type of client
identity and the client and server have to agree on the identities identity and the client and server have to agree on the identities
and keys to be used. The mandated encoding of identities in and keys to be used. The mandated encoding of identities in
Section 5.1 of RFC 4279 aims to improve interoperability for those Section 5.1 of RFC 4279 aims to improve interoperability for those
cases where the identity is configured by a person using some cases where the identity is configured by a person using some
management interface. Many IoT devices do, however, not have a user management interface. However, many IoT devices do not have a user
interface and most of their credentials are bound to the device interface and most of their credentials are bound to the device
rather than the user. Furthermore, credentials are often provisioned rather than the user. Furthermore, credentials are often provisioned
into trusted hardware modules or in the firmware by developers. As into trusted hardware modules or in the firmware by developers. As
such, the encoding considerations are not applicable to this usage such, the encoding considerations are not applicable to this usage
environment. For use with this profile the PSK identities SHOULD NOT environment. For use with this profile the PSK identities SHOULD NOT
assume a structured format (as domain names, Distinguished Names, or assume a structured format (as domain names, Distinguished Names, or
IP addresses have) and a bit-by-bit comparison operation can then be IP addresses have) and a bit-by-bit comparison operation can then be
used by the server-side infrastructure. used by the server-side infrastructure.
The client indicates which key it uses by including a "PSK identity" The client indicates which key it uses by including a "PSK identity"
in the ClientKeyExchange message. As described in Section 4 clients in the ClientKeyExchange message. As described in Section 4 clients
may have multiple pre-shared keys with a single server and to help may have multiple pre-shared keys with a single server, for example
the client in selecting which PSK identity / PSK pair to use, the in a hosting context. The TLS Server Name Indication (SNI) extension
server can provide a "PSK identity hint" in the ServerKeyExchange allows the client to convey the name of the server it is contacting,
message. If the hint for PSK key selection is based on the domain which is relevant for hosting environments. A server implementation
name of the server then servers SHOULD NOT send the "PSK identity needs to guide the selection based on a received SNI value from the
hint" in the ServerKeyExchange message. In general, servers SHOULD client.
NOT send the "PSK identity hint" in the ServerKeyExchange message and
client MUST ignore the message. This approach is inline with RFC
4279 [RFC4279]. Note: The TLS Server Name Indication (SNI) extension
allows the client to tell a server the name of the server it is
contacting, which is relevant for hosting environments. A server
using the identity hint needs to guide the selection based on a
received SNI value from the client.
RFC 4279 requires TLS implementations supporting PSK ciphersuites to RFC 4279 requires TLS implementations supporting PSK ciphersuites to
support arbitrary PSK identities up to 128 octets in length, and support arbitrary PSK identities up to 128 octets in length, and
arbitrary PSKs up to 64 octets in length. This is a useful arbitrary PSKs up to 64 octets in length. This is a useful
assumption for TLS stacks used in the desktop and mobile environments assumption for TLS stacks used in the desktop and mobile environments
where management interfaces are used to provision identities and where management interfaces are used to provision identities and
keys. For the IoT environment, keys are distributed as part of keys. For the IoT environment, keys are distributed as part of
hardware modules or are embedded into the firmware. Implementations hardware modules or are embedded into the firmware. Implementations
in compliance with this profile MAY use PSK identities up to 128 in compliance with this profile MAY use PSK identities up to 128
octets in length, and arbitrary PSKs up to 64 octets in length. The octets in length, and arbitrary PSKs up to 64 octets in length. The
use of shorter PSK identities and shorter PSKs is RECOMMENDED. use of shorter PSK identities is RECOMMENDED.
Constrained Application Protocol (CoAP) [RFC7252] currently specifies Constrained Application Protocol (CoAP) [RFC7252] currently specifies
TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite
for use with shared secrets. This ciphersuite uses the AES algorithm for use with shared secrets. This ciphersuite uses the AES algorithm
with 128 bit keys and CCM as the mode of operation. The label "_8" with 128 bit keys and CCM as the mode of operation. The label "_8"
indicates that an 8-octet authentication tag is used. This indicates that an 8-octet authentication tag is used. This
ciphersuite makes use of the default TLS 1.2 Pseudorandom Function ciphersuite makes use of the default TLS 1.2 Pseudorandom Function
(PRF), which uses an HMAC with the SHA-256 hash function. (Note that (PRF), which uses an HMAC with the SHA-256 hash function. Note:
all IoT implementations will need a SHA-256 implementation due to the Starting with TLS 1.2 (and consequently DTLS 1.2) ciphersuites have
construction of the pseudo-random number function in DTLS/TLS 1.2.) to specify the pseudorandom function. RFC 5246 states that 'New
cipher suites MUST explicitly specify a PRF and, in general, SHOULD
use the TLS PRF with SHA-256 or a stronger standard hash function.'.
The ciphersuites recommended in this document use the SHA-256
construct defined in Section 5 of RFC 5246.
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section.
6.2. Raw Public Key 6.2. Raw Public Key
The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is
the first entry point into public key cryptography without having to the first entry point into public key cryptography without having to
pay the price of certificates and a public key infrastructure (PKI). pay the price of certificates and a public key infrastructure (PKI).
The specification re-uses the existing Certificate message to convey The specification re-uses the existing Certificate message to convey
the raw public key encoded in the SubjectPublicKeyInfo structure. To the raw public key encoded in the SubjectPublicKeyInfo structure. To
indicate support two new extensions had been defined, as shown in indicate support two new extensions had been defined, as shown in
Figure 8, namely the server_certificate_type*' and the Figure 8, namely the server_certificate_type*' and the
client_certificate_type. To operate this mechanism securely it is client_certificate_type. To operate this mechanism securely it is
necessary to authenticate and authorize the public keys out-of-band. necessary to authenticate and authorize the public keys out-of-band.
This document therefore assumes that a client implementation comes This key distribution step may, for example, be provided by a
with one or multiple raw public keys of servers, it has to dedicated protocol, such as the OMA LWM2M [LWM2M]. This document
communicate with, pre-provisioned. Additionally, a device will have therefore assumes that a client implementation comes with one or
its own raw public key. To replace, delete, or add raw public key to multiple raw public keys of servers, it has to communicate with, pre-
this list requires a software update, for example using a firmware provisioned. To replace, delete, or add raw public keys to this list
update mechanism. requires a software update, for example using a firmware update
mechanism. Additionally, a device will have its own raw public key
and the corresponding private key. This key pair may, for example,
be configured during the manufacturing process of the device.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
*client_certificate_type* #client_certificate_type#
*server_certificate_type* #server_certificate_type#
ServerHello ServerHello
*client_certificate_type* #client_certificate_type#
*server_certificate_type* #server_certificate_type#
Certificate Certificate
ServerKeyExchange ServerKeyExchange
CertificateRequest CertificateRequest
<-------- ServerHelloDone <-------- ServerHelloDone
Certificate Certificate
ClientKeyExchange ClientKeyExchange
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Note: Extensions marked with '*' were introduced with Note: Extensions marked with '#' were introduced with
RFC 7250. RFC 7250.
Figure 8: DTLS Raw Public Key Exchange including the Cookie Exchange. Figure 8: DTLS Raw Public Key Exchange.
The CoAP recommended ciphersuite for use with this credential type is The CoAP recommended ciphersuite for use with this credential type is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve
cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral
Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment
mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA)
for authentication. Due to the use of Ephemeral Elliptic Curve for authentication. Due to the use of Ephemeral Elliptic Curve
Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman
groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this
profile. This ciphersuite make use of the AEAD capability in DTLS profile. This ciphersuite makes use of the AEAD capability in DTLS
1.2 and utilizes an eight-octet authentication tag. The use of a 1.2 and utilizes an eight-octet authentication tag. The use of a
Diffie-Hellman key exchange provides perfect forward secrecy (PFS). Diffie-Hellman key exchange provides perfect forward secrecy (PFS).
More details about PFS can be found in Section 11. More details about PFS can be found in Section 11.
RFC 6090 [RFC6090] provides valuable information for implementing [RFC6090] provides valuable information for implementing Elliptic
Elliptic Curve Cryptography algorithms, particularly for choosing Curve Cryptography algorithms, particularly for choosing methods that
methods that have been available in the literature for a long time have been available in the literature for a long time (i.e., 20 years
(i.e., 20 years and more). and more).
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
6.3. Certificates 6.3. Certificates
The use of mutual certificate-based authentication is shown in The use of mutual certificate-based authentication is shown in
Figure 9, which makes use of the cached info extension Figure 9, which makes use of the cached info extension
[I-D.ietf-tls-cached-info]. Support of the cached info extension is [I-D.ietf-tls-cached-info]. Support of the cached info extension is
skipping to change at page 23, line 33 skipping to change at page 24, line 33
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Note: Extensions marked with '*' were introduced with Note: Extensions marked with '*' were introduced with
[I-D.ietf-tls-cached-info]. [I-D.ietf-tls-cached-info].
Figure 9: DTLS Mutual Certificate-based Authentication. Figure 9: DTLS Mutual Certificate-based Authentication.
Server certificates MUST contain the fully qualified DNS domain name Server certificates MUST contain the fully qualified DNS domain name
or "FQDN" as dNSName. For CoAP, the coaps URI scheme is described in or "FQDN" as dNSName [RFC5280]. For CoAP, the coaps URI scheme is
Section 6.2 of [RFC7252]. This FQDN is stored in the SubjectAltName described in Section 6.2 of [RFC7252]. This FQDN is stored in the
or in the leftmost CN component of subject name, as explained in SubjectAltName or in the leftmost CN component of subject name, as
Section 9.1.3.3 of [RFC7252], and used by the client to match it explained in Section 9.1.3.3 of [RFC7252], and used by the client to
against the FQDN used during the look-up process, as described in RFC match it against the FQDN used during the look-up process, as
6125 [RFC6125]. For other protocols, the appropriate URI scheme described in [RFC6125]. For other protocols, the appropriate URI
specification has to be consulted. scheme specification has to be consulted.
When constrained servers are used, for example in context of locally When constrained servers are used, for example in context of locally
discoverable services as shown in Figure 6, then the rules of client discoverable services as shown in Figure 6, then the rules of client
certificates are applicable since these constrained servers are less certificates are applicable since these constrained servers are less
likely to have an FQDN configured. Note that the Service Name likely to have an FQDN configured. Note that the Service Name
Indication (SNI) extension cannot be used in this case since SNI does Indication (SNI) extension cannot be used in this case since SNI does
not offer the ability to convey EUI-64 identifiers. not offer the ability to convey EUI-64 [EUI64] identifiers.
For client certificates the identifier used in the SubjectAltName or For client certificates the identifier used in the SubjectAltName or
in the leftmost CN component of subject name MUST be an EUI-64 in the leftmost CN component of subject name MUST be an EUI-64, as
[EUI64], as mandated in Section 9.1.3.3 of [RFC7252]. mandated in Section 9.1.3.3 of [RFC7252].
For certificate revocation neither the Online Certificate Status For certificate revocation neither the Online Certificate Status
Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
Instead, this profile relies on a software update mechanism. While Instead, this profile relies on a software update mechanism to
multiple OCSP stapling [RFC6961] has recently been introduced as a provision information about revoked certificates. While multiple
mechanism to piggyback OCSP request/responses inside the DTLS/TLS OCSP stapling [RFC6961] has recently been introduced as a mechanism
handshake to avoid the cost of a separate protocol handshake further to piggyback OCSP request/responses inside the DTLS/TLS handshake (to
avoid the cost of a separate protocol handshake), further
investigations are needed to determine its suitability for the IoT investigations are needed to determine its suitability for the IoT
environment. environment.
Regarding the ciphersuite choice the discussion in Section 6.2 Regarding the ciphersuite choice the discussion in Section 6.2
applies. Further details about X.509 certificates can be found in applies. Further details about X.509 certificates can be found in
Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8
ciphersuite description in Section 6.2 is also applicable to this ciphersuite description in Section 6.2 is also applicable to this
section. section.
When using certificates, IoT devices MUST provide support for a When using certificates, IoT devices MUST provide support for a
server certificate chain of at least 3 not including the trust anchor server certificate chain of at least 3 not including the trust anchor
and MAY reject connections from servers offering chains longer than and MAY reject connections from servers offering chains longer than
3. IoT devices MAY have client certificate chains of any length. 3. IoT devices MAY have client certificate chains of any length.
Obviously, longer chains require more digital signature verification Obviously, longer chains require more digital signature verification
operations to perform and lead to larger certificate messages in the operations to perform and lead to larger certificate messages in the
TLS handshake. TLS handshake.
Table 1 provides a summary of the elements in a certificate for use Table 1 provides a summary of the elements in a certificate for use
with this profile. with this profile.
+---------------+---------------------------------------------------+ +----------------------+--------------------------------------------+
| Element | Notes | | Element | Notes |
+---------------+---------------------------------------------------+ +----------------------+--------------------------------------------+
| Version | This profile uses the X.509 v3 certificate | | version | This profile uses X.509 v3 certificates |
| | [RFC5280]. | | | [RFC5280]. |
| | | | | |
| Serial Number | Positive integer unique per certificate. | | serialNumber | Positive integer unique per certificate. |
| | | | | |
| Issuer | This profile uses ecdsa-with-SHA256 or stronger | | signature | This field contains the signature |
| Signature | [RFC5758]. | | | algorithm and this profile uses ecdsa- |
| Algorithms | | | | with-SHA256 or stronger [RFC5758]. |
| | | | | |
| Issuer | Contains the DN of the issuing CA. | | issuer | Contains the DN of the issuing CA. |
| Distinguished | | | | |
| Name | | | validity | Values expressed as UTC time in notBefore |
| | | | | and notAfter fields. No validity period |
| Validity | Values expressed as UTC time. No validity period | | | mandated. |
| Period | mandated. | | | |
| | | | subject | See rules outlined in this section. |
| Subject | See rules outlined in this section. | | | |
| Distinguished | | | subjectPublicKeyInfo | The SubjectPublicKeyInfo structure |
| Name | | | | indicates the algorithm and any associated |
| | | | | parameters for the ECC public key.This |
| Subject | This element contains the ECDSA signature | | | profile uses the id-ecPublicKey algorithm |
| Public Key | certificate. The algorithm field in the | | | identifier for ECDSA signature keys, as |
| Information | SubjectPublicKeyInfo structure indicates the | | | defined in specified in [RFC5480]. |
| | algorithm and any associated parameters for the | | | |
| | ECC public key. This profile uses the id- | | signatureAlgorithm | The ECDSA signature algorithm with ecdsa- |
| | ecPublicKey algorithm identifier. | | | with-SHA256 or stronger. |
| | | | | |
| Issuer's | Includes the ECDSA signature with ecdsa-with- | | signatureValue | Bit string containing the digital |
| Signature | SHA256 or stronger. | | | signature. |
| | | | | |
| Extension: | See rules outlined in this section. | | Extension: | See rules outlined in this section. |
| Subject | | | subjectAltName | |
| Alternative | | | | |
| Name | | | Extension: | Indicates whether the subject of the |
| | | | BasicConstraints | certificate is a CA and the maximum depth |
| Extension: | Indicates whether the subject of the certificate | | | of valid certification paths that include |
| Basic | is a CA. This extension is used for CA certs only | | | this certificate. This extension is used |
| Constraints | and then the value is set to TRUE. The default is | | | for CA certs only and then the value of |
| | FALSE. | | | the 'cA' field is set to TRUE. The default |
| | | | | is FALSE. |
| Extension: | digitalSignature or keyAgreement, keyCertSign for | | | |
| Key Usage | verifying signatures on public key certificates. | | Extension: Key Usage | The KeyUsage field MAY have the following |
| | | | | values in the context of this profile: |
| Extension: | id-kp-serverAuth for server authentication, id- | | | digitalSignature or keyAgreement, |
| Extended Key | kp-clientAuth for client authentication, id-kp- | | | keyCertSign for verifying signatures on |
| Usage | codeSigning for code signing (for software update | | | public key certificates. |
| | mechanism), id-kp-OCSPSigning for future OCSP | | | |
| | usage in TLS. | | Extension: Extended | The ExtKeyUsageSyntax field MAY have the |
+---------------+---------------------------------------------------+ | Key Usage | following values in context of this |
| | profile: id-kp-serverAuth for server |
| | authentication, id-kp-clientAuth for |
| | client authentication, id-kp-codeSigning |
| | for code signing (for software update |
| | mechanism), id-kp-OCSPSigning for future |
| | OCSP usage in TLS. |
+----------------------+--------------------------------------------+
Table 1: Certificate Content. Table 1: Certificate Content.
All certificate elements listed in Table 1 are mandatory-to- All certificate elements listed in Table 1 are mandatory-to-
implement. No other certificate elements are used by this implement. No other certificate elements are used by this
specification. specification.
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
skipping to change at page 26, line 20 skipping to change at page 27, line 27
it does not even support. The use of this extension also increases it does not even support. The use of this extension also increases
the risk of a denial of service attack against the constrained server the risk of a denial of service attack against the constrained server
due to the additional workload. due to the additional workload.
6.3.2. Trusted CA Indication 6.3.2. Trusted CA Indication
RFC 6066 [RFC6066] allows clients to indicate what trust anchor they RFC 6066 [RFC6066] allows clients to indicate what trust anchor they
support. With certificate-based authentication a DTLS server conveys support. With certificate-based authentication a DTLS server conveys
its end entity certificate to the client during the DTLS exchange its end entity certificate to the client during the DTLS exchange
provides. Since the server does not necessarily know what trust provides. Since the server does not necessarily know what trust
anchors the client has stored it includes intermediate CA certs in anchors the client has stored and to facilitate certification path
the certificate payload as well to facilitate with certification path construction as well as path validation, it includes intermediate CA
construction and path validation. certs in the certificate payload.
Today, in most IoT deployments there is a fairly static relationship Today, in most IoT deployments there is a fairly static relationship
between the IoT device (and the software running on them) and the between the IoT device (and the software running on them) and the
server-side infrastructure. For these deployments where IoT devices server-side infrastructure. For these deployments where IoT devices
interact with a fixed, pre-configured set of servers this extension interact with a fixed, pre-configured set of servers this extension
is NOT RECOMMENDED. is NOT RECOMMENDED.
In cases where client interact with dynamically discovered TLS/DTLS In cases where client interact with dynamically discovered TLS/DTLS
servers, for example in the use cases described in Section 4.2, the servers, for example in the use cases described in Section 4.2, the
use of this extension is RECOMMENDED. use of this extension is RECOMMENDED.
skipping to change at page 26, line 48 skipping to change at page 28, line 7
signature/hash algorithm pairs may be used in digital signatures. signature/hash algorithm pairs may be used in digital signatures.
The client MUST send this extension to select the use of SHA-256 The client MUST send this extension to select the use of SHA-256
since otherwise absent this extension RFC 5246 defaults to SHA-1 / since otherwise absent this extension RFC 5246 defaults to SHA-1 /
ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms. ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms.
The "signature_algorithms" extension is not applicable to the PSK- The "signature_algorithms" extension is not applicable to the PSK-
based ciphersuite described in Section 6.1. based ciphersuite described in Section 6.1.
8. Error Handling 8. Error Handling
TLS/DTLS uses the Alert protocol to convey error messages and TLS/DTLS uses the Alert protocol to convey errors and specifies a
specifies a longer list of errors. However, not all error messages long list of error types. However, not all error messages defined in
defined in the TLS/DTLS specification are applicable to this profile. the TLS/DTLS specification are applicable to this profile. In
In general, there are two categories of errors (as defined in general, there are two categories of errors (as defined in
Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert
messages with a level of fatal result in the immediate termination of messages with a level of fatal result in the immediate termination of
the connection. If possible, developers should try to develop the connection. If possible, developers should try to develop
strategies to react to those fatal errors, such as re-starting the strategies to react to those fatal errors, such as re-starting the
handshake or informing the user using the (often limited) user handshake or informing the user using the (often limited) user
interface. Warnings may be ignored by the application since many IoT interface. Warnings may be ignored by the application since many IoT
devices will either have limited ways to log errors or no ability at devices will either have limited ways to log errors or no ability at
all. In any case, implementers have to carefully evaluate the impact all. In any case, implementers have to carefully evaluate the impact
of errors and ways to remedy the situation since a commonly used of errors and ways to remedy the situation since a commonly used
approach for delegating decision making to users is difficult (or approach for delegating decision making to users is difficult (or
impossible) to accomplish in a timely fashion. impossible) to accomplish in a timely fashion.
All error messages marked as RESERVED are only supported for All error messages marked as RESERVED are only supported for
backwards compatibility with SSL and are therefore not applicable to backwards compatibility with SSL MUST NOT be used with this profile.
this profile. Those include decryption_failed_RESERVED, Those include decryption_failed_RESERVED, no_certificate_RESERVED,
no_certificate_RESERVE, and export_restriction_RESERVED. and export_restriction_RESERVED.
A number of the error messages are applicable only for certificate- A number of the error messages MUST only be used for certificate-
based authentication ciphersuites. Hence, for PSK and raw public key based ciphersuites. Hence, the following error messages MUST NOT be
use the following error messages are not applicable: used with with PSK and raw public key authentication:
o bad_certificate, o bad_certificate,
o unsupported_certificate, o unsupported_certificate,
o certificate_revoked, o certificate_revoked,
o certificate_expired, o certificate_expired,
o certificate_unknown, o certificate_unknown,
o unknown_ca, and o unknown_ca, and
o access_denied. o access_denied.
Since this profile does not make use of compression at the TLS layer Since this profile does not make use of compression at the TLS layer
the decompression_failure error message is not applicable either. the decompression_failure error message MUST NOT be used either.
RFC 4279 introduced a new alert message unknown_psk_identity for PSK RFC 4279 introduced a new alert message unknown_psk_identity for PSK
ciphersuites. As stated in Section 2 of RFC 4279 the ciphersuites. As stated in Section 2 of RFC 4279 the
decryption_error error message may also be used instead. For this decryption_error error message may also be used instead. For this
profile the TLS server MUST return the decryption_error error message profile the TLS server MUST return the decryption_error error message
instead of the unknown_psk_identity since the two mechanisms exist instead of the unknown_psk_identity since the two mechanisms exist
and provide the same functionality. and provide the same functionality.
Furthermore, the following errors should not occur with devices and Furthermore, the following errors should not occur with devices and
servers supporting this specification but implementations MUST be servers supporting this specification but implementations MUST be
skipping to change at page 29, line 7 skipping to change at page 30, line 15
session resumption requires less bandwidth. session resumption requires less bandwidth.
For cases where the server is constrained (but not the client) the For cases where the server is constrained (but not the client) the
client MUST implement RFC 5077 [RFC5077]. RFC 5077 specifies a client MUST implement RFC 5077 [RFC5077]. RFC 5077 specifies a
version of TLS/DTLS session resumption that does not require per- version of TLS/DTLS session resumption that does not require per-
session state information to be maintained by the constrained server. session state information to be maintained by the constrained server.
This is accomplished by using a ticket-based approach. This is accomplished by using a ticket-based approach.
If both the client and the server are constrained devices both If both the client and the server are constrained devices both
devices SHOULD implement RFC 5077 and MUST implement basic session devices SHOULD implement RFC 5077 and MUST implement basic session
resumption. resumption. Clients that do not want to use session resumption are
always able to send a ClientHello message with an empty session_id to
revert to a full handshake.
10. Compression 10. Compression
Section 3.3 of [I-D.ietf-uta-tls-bcp] recommends to disable TLS/DTLS- Section 3.3 of [I-D.ietf-uta-tls-bcp] recommends to disable TLS/DTLS-
level compression due to attacks, such as CRIME. For IoT level compression due to attacks, such as CRIME. For IoT
applications compression at the TLS/DTLS layer is not needed since applications compression at the TLS/DTLS layer is not needed since
application layer protocols are highly optimized and the compression application layer protocols are highly optimized and the compression
algorithms at the DTLS layer increases code size and complexity. algorithms at the DTLS layer increases code size and complexity.
This TLS/DTLS profile MUST NOT implement TLS/DTLS layer compression. This TLS/DTLS profile MUST NOT implement TLS/DTLS layer compression.
skipping to change at page 29, line 42 skipping to change at page 31, line 4
at the expense of not using any public cryptography. For deployments at the expense of not using any public cryptography. For deployments
where public key cryptography is acceptable the raw public might where public key cryptography is acceptable the raw public might
offer an acceptable middleground between the PSK ciphersuite in terms offer an acceptable middleground between the PSK ciphersuite in terms
of out-of-band validation and the functionality offered by asymmetric of out-of-band validation and the functionality offered by asymmetric
cryptography. cryptography.
The use of PFS is a trade-off decision since on one hand the The use of PFS is a trade-off decision since on one hand the
compromise of long-term secrets of embedded devices is more likely compromise of long-term secrets of embedded devices is more likely
than with many other Internet hosts but on the other hand a Diffie- than with many other Internet hosts but on the other hand a Diffie-
Hellman exchange requires ephemeral key pairs to be generated, which Hellman exchange requires ephemeral key pairs to be generated, which
is demanding from a performance point of view. For performance is demanding from a performance point of view. For obvious
reasons some implementations re-use key pairs over multiple exchanges performance improvement, some implementations re-use key pairs over
(rather than generating new keys for each exchange) for the obvious multiple exchanges (rather than generating new keys for each
performance improvement. Note, however, that such key re-use over exchange). However, note that such key re-use over long periods
long periods voids the benefits of forward secrecy when an attack voids the benefits of forward secrecy when an attack gains access to
gains access to this DH key pair. this DH key pair.
The impact of the disclosure of past conversations and the desire to The impact of the disclosure of past conversations and the desire to
increase the cost for pervasive monitoring (as demanded by [RFC7258]) increase the cost for pervasive monitoring (as demanded by [RFC7258])
has to be taken into account when making a deployment decision. has to be taken into account when making a deployment decision.
Client implementations claiming support of this profile MUST Client implementations claiming support of this profile MUST
implement the ciphersuites listed in Section 6 according to the implement the ciphersuites listed in Section 6 according to the
selected credential type. selected credential type.
12. Keep-Alive 12. Keep-Alive
Application layer communication may create state at the endpoints and
this state my expire at some time. For this reason, applications
define ways to refresh state, if necessary. While the application
layer exchanges are largely outside the scope of the underlying TLS/
DTLS exchange similar state considerations also play a role at the
level of TLS/DTLS. While TLS/DTLS also creates state in form of a
security context (see the security parameter described in Appendix A6
in RFC 5246) at the client and the server this state information does
not expire. However, network intermediaries may also allocate state
and require this state to be kept alive. Failure to keep state alive
at a stateful packet filtering firewall or at a NAT may result in the
inability for one node to reach the other since packets will get
blocked by these middleboxes. Periodic keep-alive messages exchanged
between the TLS/DTLS client and server keep state at these
middleboxes alive. According to measurements described in
[HomeGateway] there is some variance in state management practices
used in residential gateways but the timeouts are heavily impacted by
the choice of the transport layer protocol: timeouts for UDP are
typically much shorter than those for TCP.
RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the
other peer is still alive. The same mechanism can also be used to other peer is still alive. As an additional feature, the same
perform Path Maximum Transmission Unit (MTU) Discovery. mechanism can also be used to perform Path Maximum Transmission Unit
(MTU) Discovery.
A recommendation about the use of RFC 6520 depends on the type of A recommendation about the use of RFC 6520 depends on the type of
message exchange an IoT device performs. There are three types of message exchange an IoT device performs and the number of messages
exchanges that need to be analysed: the application needs to exchange as part of their application
functionality. There are three types of exchanges that need to be
analysed:
Client-Initiated, One-Shot Messages Client-Initiated, One-Shot Messages
This is a common communication pattern where IoT devices upload This is a common communication pattern where IoT devices upload
data to a server on the Internet on an irregular basis. The data to a server on the Internet on an irregular basis. The
communication may be triggered by specific events, such as opening communication may be triggered by specific events, such as opening
a door. a door.
Since the upload happens on an irregular and unpredictable basis Since the upload happens on an irregular and unpredictable basis
and due to renumbering and Network Address Translation (NAT) the and due to renumbering and Network Address Translation (NAT) the
skipping to change at page 30, line 51 skipping to change at page 32, line 37
changes, it is necessary to re-create the record layer using changes, it is necessary to re-create the record layer using
session resumption. session resumption.
In this scenario there is no use for a keep-alive extension. It In this scenario there is no use for a keep-alive extension. It
is also very likely that the device will enter a sleep cycle in is also very likely that the device will enter a sleep cycle in
between data transmissions to keep power consumption low. between data transmissions to keep power consumption low.
Server-Initiated Messages Server-Initiated Messages
In the two previous scenarios the client initiated the protocol In the two previous scenarios the client initiated the protocol
interaction but in this case we consider server-initiated interaction and maintains it. Since messages to the client may
messages. Since messages to the client may get blocked by get blocked by middleboxes the initial connection setup is
intermediaries, such as NATs (including IPv4/IPv6 protocol triggered by the client and then kept alive by the server.
translators) and stateful packet filtering firewalls, the initial
connection setup is triggered by the client and then kept alive.
Since state at middleboxes expires fairly quickly (according to
measurements described in [HomeGateway]), regular heartbeats are
necessary whereby these keep-alive messages may be exchanged at
the application layer or within DTLS itself.
For this message exchange pattern the use of DTLS heartbeat For this message exchange pattern the use of DTLS heartbeat
messages is quite useful but may interfere with registrations kept messages is quite useful but may have to be coordinated with
at the application layer (for example when the CoAP resource application exchanges (for example when the CoAP resource
directory is used). The MTU discovery mechanism, which is also directory is used) to avoid redundant keep-alive message
part of [RFC6520], is less likely to be relevant since for many exchanges. The MTU discovery mechanism, which is also part of
IoT deployments the most constrained link is the wireless [RFC6520], is less likely to be relevant since for many IoT
interface between the IoT device and the network itself (rather deployments the most constrained link is the wireless interface
than some links along the end-to-end path). Only in more complex between the IoT device and the network itself (rather than some
network topologies, such as multi-hop mesh networks, path MTU links along the end-to-end path). Only in more complex network
discovery might be appropriate. It also has to be noted that DTLS topologies, such as multi-hop mesh networks, path MTU discovery
itself already provides a basic path discovery mechanism (see might be appropriate. It also has to be noted that DTLS itself
already provides a basic path discovery mechanism (see
Section 4.1.1.1 of RFC 6347 by using the fragmentation capability Section 4.1.1.1 of RFC 6347 by using the fragmentation capability
of the handshake protocol). of the handshake protocol).
For server-initiated messages the heartbeat extension is RECOMMENDED. For server-initiated messages the heartbeat extension is RECOMMENDED.
13. Timeouts 13. Timeouts
To connect to the Internet a variety of wired and wireless To connect to the Internet a variety of wired and wireless
technologies are available. Many of the low power radio technologies are available. Many of the low power radio
technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support
skipping to change at page 32, line 4 skipping to change at page 33, line 33
fit within a single transport layer datagram, as described in fit within a single transport layer datagram, as described in
Section 4.2.3 of [RFC6347]. Since handshake messages are potentially Section 4.2.3 of [RFC6347]. Since handshake messages are potentially
bigger than the maximum record size, the mechanism fragments a bigger than the maximum record size, the mechanism fragments a
handshake message over a number of DTLS records, each of which can be handshake message over a number of DTLS records, each of which can be
transmitted separately. transmitted separately.
To deal with the unreliable message delivery provided by UDP, DTLS To deal with the unreliable message delivery provided by UDP, DTLS
adds timeouts and re-transmissions, as described in Section 4.2.4 of adds timeouts and re-transmissions, as described in Section 4.2.4 of
[RFC6347]. Although the timeout values are implementation specific, [RFC6347]. Although the timeout values are implementation specific,
recommendations are provided in Section 4.2.4.1 of [RFC6347], with an recommendations are provided in Section 4.2.4.1 of [RFC6347], with an
initial timer value of 1 second and twice the value at each initial timer value of 1 second and doubled with at each
retransmission up to no less than 60 seconds. Due to the nature of retransmission up to no less than 60 seconds. Due to the nature of
some radio technologies, these values are too aggressive and lead to some radio technologies, these values are too aggressive and lead to
spurious failures when messages in flight need longer. spurious failures when messages in flight need longer.
Note: If a round-trip time estimator (such as proposed in Note: If a round-trip time estimator (such as proposed in
[I-D.bormann-core-cocoa]) is available in the protocol stack of the [I-D.bormann-core-cocoa]) is available in the protocol stack of the
device, it could be used to dynamically update the setting of the device, it could be used to dynamically update the setting of the
retransmit timeout. retransmit timeout.
Choosing appropriate timeout values is difficult with infrequent data Choosing appropriate timeout values is difficult with changing
transmissions, changing network conditions, and large variance in network conditions, and large variance in latency. This
latency. This specification therefore RECOMMENDS an initial timer specification therefore RECOMMENDS an initial timer value of 10
value of 10 seconds with exponential back off up to no less then 60 seconds with exponential back off up to no less then 60 seconds.
seconds. Appendix A provides additional normative text for carrying Appendix A provides additional normative text for carrying DTLS over
DTLS over SMS. SMS.
14. Random Number Generation 14. Random Number Generation
The TLS/DTLS protocol requires random numbers to be available during The TLS/DTLS protocol requires random numbers to be available during
the protocol run. For example, during the ClientHello and the the protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie-Hellman exchange requires numbers. Also, the use of the Diffie-Hellman exchange requires
random numbers during the key pair generation. Special care has to random numbers during the key pair generation. Special care has to
be paid when generating random numbers in embedded systems as many be taken when generating random numbers in embedded systems as many
entropy sources available on desktop operating systems or mobile entropy sources available on desktop operating systems or mobile
devices might be missing, as described in [Heninger]. Consequently, devices might be missing, as described in [Heninger]. Consequently,
if not enough time is given during system start time to fill the if not enough time is given during system start time to fill the
entropy pool then the output might be predictable and repeatable, for entropy pool then the output might be predictable and repeatable, for
example leading to the same keys generated again and again. example leading to the same keys generated again and again.
It is important to note that sources contributing to the randomness It is important to note that sources contributing to the randomness
pool on laptops, or desktop PCs are not available on many IoT device, pool on laptops, or desktop PCs are not available on many IoT device,
such as mouse movement, timing of keystrokes, air turbulence on the such as mouse movement, timing of keystrokes, air turbulence on the
movement of hard drive heads, etc. Other sources have to be found or movement of hard drive heads, etc. Other sources have to be found or
dedicated hardware has to be added. dedicated hardware has to be added.
The ClientHello and the ServerHello messages contains the 'Random' The ClientHello and the ServerHello messages contains the 'Random'
structure, which has two components: gmt_unix_time and a random structure, which has two components: gmt_unix_time and a sequence of
sequence of 28 random bytes. gmt_unix_time holds the current time and 28 random bytes. gmt_unix_time holds the current time and date in
date in standard UNIX 32-bit format (seconds since the midnight standard UNIX 32-bit format (seconds since the midnight starting Jan
starting Jan 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues that the entire
that the entire ClientHello.Random value (including gmt_unix_time) ClientHello.Random value (including gmt_unix_time) should be a
should be set to a cryptographically random sequence because of sequence of random bits because of device fingerprinting privacy
privacy concerns regarding device fingerprinting. Since many IoT concerns. Since many IoT devices do not have access to an accurate
devices do not have access to a real-time clock this recommendation clock, it is RECOMMENDED to follow the guidance outlined in
it is RECOMMENDED to follow the guidance outlined in
[I-D.mathewson-no-gmtunixtime] regarding the content of the [I-D.mathewson-no-gmtunixtime] regarding the content of the
ClientHello.Random field. However, for the ServerHello.Random ClientHello.Random field. However, for the ServerHello.Random
structure it is RECOMMENDED to maintain the existing structure with structure it is RECOMMENDED to maintain the existing structure with
gmt_unix_time followed by a random sequence of 28 random bytes since gmt_unix_time followed by a sequence of 28 random bytes since the
the client can use the received time information to securely obtain client can use the received time information to securely obtain time
time information. For constrained servers it cannot be assumed that information. For constrained servers it cannot be assumed that they
they maintain accurate time information; these devices MUST include maintain accurate time information; these devices MUST include time
time information in the Server.Random structure when they actually information in the Server.Random structure when they actually obtain
obtain accurate time information that can be utilized by clients. accurate time information that can be utilized by clients. Clients
Clients MUST only use time information obtained from servers they MUST only use time information obtained from servers they trust and
trust. the use of this approach has to be agreed out-of-band.
IoT devices using TLS/DTLS MUST offer ways to generate quality random IoT devices using TLS/DTLS MUST offer ways to generate quality random
numbers. Note that these hardware-based random number generators do numbers using hardware-based random number generators. Note that
not necessarily need to be implemented inside the microcontroller these hardware-based random number generators do not necessarily need
itself but could be made available in dedicated crypto-chips as well. to be implemented inside the microcontroller itself but could be made
Guidelines and requirements for random number generation can be found available in dedicated crypto-chips as well. Guidelines and
in RFC 4086 [RFC4086] and in the NIST Special Publication 800-90a requirements for random number generation can be found in RFC 4086
[SP800-90A]. [RFC4086] and in the NIST Special Publication 800-90a [SP800-90A].
Chip manufacturers are highly encouraged to provide sufficient Chip manufacturers are highly encouraged to provide sufficient
documentation of their design for random number generators so that documentation of their design for random number generators so that
customers can have confidence about the quality of the generated customers can have confidence about the quality of the generated
random numbers. The confidence can be increased by providing random numbers. The confidence can be increased by providing
information about the procedures that have been used to verify the information about the procedures that have been used to verify the
randomness of numbers generated by the hardware modules. For randomness of numbers generated by the hardware modules. For
example, NIST Special Publication 800-22b [SP800-22b] describes example, NIST Special Publication 800-22b [SP800-22b] describes
statistical tests that can be used to verify random random number statistical tests that can be used to verify random random number
generators. generators.
skipping to change at page 34, line 6 skipping to change at page 35, line 35
namely the CBC-MAC mode (CCM) with eight-octet authentication tags, namely the CBC-MAC mode (CCM) with eight-octet authentication tags,
and are therefore not appliable to the truncated MAC extension. and are therefore not appliable to the truncated MAC extension.
RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead
of the previously used MAC-then-encrypt) since the MAC-then-encrypt of the previously used MAC-then-encrypt) since the MAC-then-encrypt
mechanism has been the subject of a number of security mechanism has been the subject of a number of security
vulnerabilities. RFC 7366 is, however, also not applicable to the vulnerabilities. RFC 7366 is, however, also not applicable to the
AEAD ciphers recommended in this document. AEAD ciphers recommended in this document.
Implementations conformant to this specification MUST use AEAD Implementations conformant to this specification MUST use AEAD
ciphers and RFC 7366 and RFC 6066 MUST NOT be implemented. ciphers. Hence, RFC 7366 and RFC 6066 are not applicable to this
specifciation and MUST NOT be implemented.
16. Server Name Indication (SNI) 16. Server Name Indication (SNI)
The Server Name Indication extension defined in [RFC6066] defines a The Server Name Indication extension defined in [RFC6066] defines a
mechanism for a client to tell a TLS/DTLS server the name of the mechanism for a client to tell a TLS/DTLS server the name of the
server it wants to contact. This is a useful extension for many server it wants to contact. This is a useful extension for many
hosting environments where multiple virtual servers are run on single hosting environments where multiple virtual servers are run on single
IP address. IP address.
This specification RECOMMENDs the implementation of RFC 6066 unless This specification RECOMMENDs the implementation of the Server Name
it is known that a TLS/DTLS client does not interact with a server in Indication extension unless it is known that a TLS/DTLS client does
a hosting environment. not interact with a server in a hosting environment.
17. Maximum Fragment Length Negotiation 17. Maximum Fragment Length Negotiation
This RFC 6066 extension lowers the maximum fragment length support This RFC 6066 extension lowers the maximum fragment length support
needed for the Record Layer from 2^14 bytes to 2^9 bytes. needed for the Record Layer from 2^14 bytes to 2^9 bytes.
This is a very useful extension that allows the client to indicate to This is a very useful extension that allows the client to indicate to
the server how much maximum memory buffers it uses for incoming the server how much maximum memory buffers it uses for incoming
messages. Ultimately, the main benefit of this extension is it to messages. Ultimately, the main benefit of this extension is to allow
allows client implementations to lower their RAM requirements since client implementations to lower their RAM requirements since the
the client does not need to accept packets of large size (such as 16k client does not need to accept packets of large size (such as 16k
packets as required by plain TLS/DTLS). packets as required by plain TLS/DTLS).
Client implementations MUST support this extension. Client implementations MUST support this extension.
18. Session Hash 18. Session Hash
In order to begin connection protection, the Record Protocol requires In order to begin connection protection, the Record Protocol requires
specification of a suite of algorithms, a master secret, and the specification of a suite of algorithms, a master secret, and the
client and server random values. The algorithm for computing the client and server random values. The algorithm for computing the
master secret is defined in Section 8.1 of RFC 5246 but only includes master secret is defined in Section 8.1 of RFC 5246 but only includes
a small number of parameters exchanged during the handshake and does a small number of parameters exchanged during the handshake and does
not include parameters like the client and server identities. This not include parameters like the client and server identities. This
can be utilized by an attacker to mount a man-in-the-middle attack can be utilized by an attacker to mount a man-in-the-middle attack
since the master secret is not guaranteed to be unique across since the master secret is not guaranteed to be unique across
sessions, as discovered in the 'Triple Handshake' attack sessions, as discovered in the 'Triple Handshake' attack [Triple-HS].
[Tripple-HS].
[I-D.ietf-tls-session-hash] defines a TLS extension that binds the [I-D.ietf-tls-session-hash] defines a TLS extension that binds the
master secret to a log of the full handshake that computes it, thus master secret to a log of the full handshake that computes it, thus
preventing such attacks. preventing such attacks.
Client implementations SHOULD implement this extension even though Client implementations SHOULD implement this extension even though
the ciphersuites recommended by this profile are not vulnerable to the ciphersuites recommended by this profile are not vulnerable to
this attack. For Diffie-Hellman-based ciphersuites the keying this attack. For Diffie-Hellman-based ciphersuites the keying
material is contributed by both parties and in case of the pre-shared material is contributed by both parties and in case of the pre-shared
secret key ciphersuite both parties need to be in possession of the secret key ciphersuite, both parties need to be in possession of the
shared secret to ensure that the handshake completes successfully. shared secret to ensure that the handshake completes successfully.
It is, however, possible that some application layer protocols will It is, however, possible that some application layer protocols will
tunnel other authentication protocols on top of DTLS making this tunnel other authentication protocols on top of DTLS making this
attack relevant again. attack relevant again.
19. Re-Negotiation Attacks 19. Re-Negotiation Attacks
TLS/DTLS allows a client and a server who already have a TLS/DTLS TLS/DTLS allows a client and a server who already have a TLS/DTLS
connection to negotiate new parameters, generate new keys, etc by connection to negotiate new parameters, generate new keys, etc by
using the re-negotiation feature. Renegotiation happens in the using the re-negotiation feature. Renegotiation happens in the
skipping to change at page 36, line 17 skipping to change at page 37, line 49
o Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in o Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in
the ClientHello. the ClientHello.
o Clients MUST NOT retry a failed negotiation offering a TLS/DTLS o Clients MUST NOT retry a failed negotiation offering a TLS/DTLS
version lower than 1.2. version lower than 1.2.
o Servers MUST fail the handshake by sending a protocol_version o Servers MUST fail the handshake by sending a protocol_version
fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated. fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated.
Note that the aborted connection is non-resumable. Note that the aborted connection is non-resumable.
If at some time in the future the TLS/DTLS 1.2 profile reaches the If at some time in the future this profile reaches the quality of SSL
quality of SSL 3.0 a software update mechanism is needed since 3.0 a software update is needed since constrained devices are
constrained devices are unlikely to run multiple TLS/DTLS versions unlikely to run multiple TLS/DTLS versions due to memory size
due to memory size restrictions. restrictions.
21. Crypto Agility 21. Crypto Agility
This document recommends software and chip manufacturers to implement This document recommends software and chip manufacturers to implement
AES and the CCM mode of operation. This document references the CoAP AES and the CCM mode of operation. This document references the CoAP
recommended ciphersuite choices, which have been selected based on recommended ciphersuite choices, which have been selected based on
implementation and deployment experience from the IoT community. implementation and deployment experience from the IoT community.
Over time the preference for algorithms will, however, change. Not Over time the preference for algorithms will, however, change. Not
all components of a ciphersuite are likely to change at the same all components of a ciphersuite are likely to change at the same
speed. Changes are more likely expected for ciphers, the mode of speed. Changes are more likely expected for ciphers, the mode of
operation, and the hash algorithms. The recommended key lengths have operation, and the hash algorithms. The recommended key lengths have
to be adjusted over time. Some deployment environments will also be to be adjusted over time. Some deployment environments will also be
impacted by local regulation, which might dictate a certain cipher impacted by local regulation, which might dictate a certain cipher
and key size. Ongoing discussions regarding the choice of specific and key size. Ongoing discussions regarding the choice of specific
ECC curves will also likely to impact implementations. ECC curves will also likely impact implementations. Note that this
document does not recommend or mandate a specific ECC curve.
The following recommendations can be made to chip manufacturers: The following recommendations can be made to chip manufacturers:
o Make any AES hardware-based crypto implementation accessible to o Make any AES hardware-based crypto implementation accessible to
developers working on security implementations at higher layers. developers working on security implementations at higher layers.
Sometimes hardware implementatios are added to microcontrollers to Sometimes hardware implementatios are added to microcontrollers to
offer support for functionality needed at the link layer and are offer support for functionality needed at the link layer and are
only available to the on-chip link layer protocol implementation. only available to the on-chip link layer protocol implementation.
o Provide flexibility for the use of the crypto function with future o Provide flexibility for the use of the crypto function with future
skipping to change at page 37, line 9 skipping to change at page 38, line 41
implementation available to developers is a first step but such an implementation available to developers is a first step but such an
implementation may not be usable due to parameter differences implementation may not be usable due to parameter differences
between an AES-CCM implementations. AES-CCM in IEEE 802.15.4 and between an AES-CCM implementations. AES-CCM in IEEE 802.15.4 and
Bluetooth Smart uses a nonce length of 13-octets while DTLS uses a Bluetooth Smart uses a nonce length of 13-octets while DTLS uses a
nonce length of 12-octets. Hardware implementations of AES-CCM nonce length of 12-octets. Hardware implementations of AES-CCM
for IEEE 802.15.4 and Bluetooth Smart are therefore not re-usable for IEEE 802.15.4 and Bluetooth Smart are therefore not re-usable
by a DTLS stack. by a DTLS stack.
o Offer access to building blocks in addition (or as an alternative) o Offer access to building blocks in addition (or as an alternative)
to the complete functionality. For example, a chip manufacturer to the complete functionality. For example, a chip manufacturer
who gives developers access to an the AES crypto function can use who gives developers access to the AES crypto function can use it
it in functions to build an efficient AES-GCM implementations. to build an efficient AES-GCM implementations. Another example is
Another example is to make a special instruction available that to make a special instruction available that increases the speed
increases the speed of speed-up carryless multiplications. of speed-up carryless multiplications.
As a recommendation for developers and product architects we As a recommendation for developers and product architects we
recommend that sufficient headroom is provided to allow an upgrade to recommend that sufficient headroom is provided to allow an upgrade to
a newer cryptographic algorithms over the lifetime of the product. a newer cryptographic algorithms over the lifetime of the product.
As an example, while AES-CCM is recommended thoughout this As an example, while AES-CCM is recommended thoughout this
specification future products might use the ChaCha20 cipher in specification future products might use the ChaCha20 cipher in
combination with the Poly1305 authenticator combination with the Poly1305 authenticator
[I-D.irtf-cfrg-chacha20-poly1305]. The assumption is made that a [I-D.irtf-cfrg-chacha20-poly1305]. The assumption is made that a
robust software update mechanism is offered. robust software update mechanism is offered.
22. Key Length Recommendations 22. Key Length Recommendations
RFC 4492 [RFC4492] gives approximate comparable key sizes for RFC 4492 [RFC4492] gives approximate comparable key sizes for
symmetric- and asymmetric-key cryptosystems based on the best-known symmetric- and asymmetric-key cryptosystems based on the best-known
algorithms for attacking them. While other publications suggest algorithms for attacking them. While other publications suggest
slightly different numbers, such as [Keylength], the approximate slightly different numbers, such as [Keylength], the approximate
relationship still holds true. Figure 11 illustrates the comparable relationship still holds true. Figure 11 illustrates the comparable
key sizes in bits. key sizes in bits.
At the time of writing the key size recommendations for use with TLS- At the time of writing the key size recommendations for use with TLS-
based ciphers found in [I-D.ietf-uta-tls-bcp] recommend DH key based ciphers found in [I-D.ietf-uta-tls-bcp] recommend DH key
lengths of at least 2048 bit, which corresponds to a 112-bit lengths of at least 2048 bit, which corresponds to a 112-bit
symmetric key and a 233 bit ECC keys. These recommendations are symmetric key and a 233 bit ECC key. These recommendations are
inline with those from other organizations, such as National inline with those from other organizations, such as National
Institute of Standards and Technology (NIST) or European Network and Institute of Standards and Technology (NIST) or European Network and
Information Security Agency (ENISA). The authors of Information Security Agency (ENISA). The authors of
[ENISA-Report2013] add that a symmetric 80-bit security level is [ENISA-Report2013] add that a 80-bit symmetric key is sufficient for
sufficient for legacy applications for the coming years, but a legacy applications for the coming years, but a 128-bit symmetric key
128-bit security level is the minimum requirement for new systems is the minimum requirement for new systems being deployed. The
being deployed. The authors further note that one needs to also take authors further note that one needs to also take into account the
into account the length of time data needs to be kept secure for. length of time data needs to be kept secure for. The use of 80-bit
The use 80-bit encryption for transactional data may be acceptable symmetric keys for transactional data may be acceptable for the near
for the near future while one has to insist on 128-bit encryption for future while one has to insist on 128-bit symmetric keys for long
long lived data. lived data.
Symmetric | ECC | DH/DSA/RSA Symmetric | ECC | DH/DSA/RSA
------------+---------+------------- ------------+---------+-------------
80 | 163 | 1024 80 | 163 | 1024
112 | 233 | 2048 112 | 233 | 2048
128 | 283 | 3072 128 | 283 | 3072
192 | 409 | 7680 192 | 409 | 7680
256 | 571 | 15360 256 | 571 | 15360
Figure 11: Comparable Key Sizes (in bits). Figure 11: Comparable Key Sizes (in bits).
skipping to change at page 39, line 19 skipping to change at page 40, line 51
User participation with many IoT deployments poses a challenge since User participation with many IoT deployments poses a challenge since
many of the IoT devices operate unattended, even though they will many of the IoT devices operate unattended, even though they will
initially be provisioned by a human. The ability to control data initially be provisioned by a human. The ability to control data
sharing and to configure preference will have to be provided at a sharing and to configure preference will have to be provided at a
system level rather than at the level of the DTLS exchange itself, system level rather than at the level of the DTLS exchange itself,
which is the scope of this document. Quite naturally, the use of which is the scope of this document. Quite naturally, the use of
DTLS with mutual authentication will allow a TLS server to collect DTLS with mutual authentication will allow a TLS server to collect
authentication information about the IoT device (likely over a long authentication information about the IoT device (likely over a long
period of time). While this strong form of authentication will period of time). While this strong form of authentication will
prevent mis-attribution it also allows strong identification. prevent mis-attribution, it also allows strong identification.
Device-related data collection (e.g., sensor recordings) will be Device-related data collection (e.g., sensor recordings) associated
associated with other data to be truly useful and this extra data with other data type will prove to be truly useful but this extra
might include personal data about the owner of the device or data data might include personal information about the owner of the device
about the environment it senses. Consequently, the data stored on or data about the environment it senses. Consequently, the data
the server-side will be vulnerable to stored data compromise. For stored on the server-side will be vulnerable to stored data
the communication between the client and the server this compromise. For the communication between the client and the server
specification prevents eavesdroppers to gain access to the this specification prevents eavesdroppers to gain access to the
communication content. While the PSK-based ciphersuite does not communication content. While the PSK-based ciphersuite does not
provide PFS the asymmetric versions do. This prevents an adversary provide PFS the asymmetric versions do. This prevents an adversary
from obtaining past communication content when access to a long-term from obtaining past communication content when access to a long-term
secret has been gained. Note that no extra effort to make traffic secret has been gained. Note that no extra effort to make traffic
analysis more difficult is provided by the recommendations made in analysis more difficult is provided by the recommendations made in
this document. this document.
25. Security Considerations 25. Security Considerations
This entire document is about security. This entire document is about security.
skipping to change at page 40, line 7 skipping to change at page 41, line 36
keying related information. Such a suitable software update keying related information. Such a suitable software update
mechanism is available with the Lightweight Machine-to-Machine mechanism is available with the Lightweight Machine-to-Machine
(LWM2M) protocol published by the Open Mobile Alliance (OMA) [LWM2M]. (LWM2M) protocol published by the Open Mobile Alliance (OMA) [LWM2M].
26. IANA Considerations 26. IANA Considerations
This document includes no request to IANA. This document includes no request to IANA.
27. Acknowledgements 27. Acknowledgements
Thanks to Paul Bakker, Robert Cragie, Russ Housley, Rene Hummen, Thanks to Olaf Bergmann, Paul Bakker, Robert Cragie, Russ Housley,
Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh, Alexey Melnikov, Rene Hummen, Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh, Simon
Manuel Pegourie-Gonnard, Akbar Rahman, Eric Rescorla, Michael Lemay, Alexey Melnikov, Manuel Pegourie-Gonnard, Akbar Rahman, Eric
Richardson, Zach Shelby, Michael StJohns, Rene Struik, and Sean Rescorla, Michael Richardson, Ludwig Seitz, Zach Shelby, Michael
Turner for their helpful comments and discussions that have shaped StJohns, Rene Struik, and Sean Turner for their helpful comments and
the document. discussions that have shaped the document.
Big thanks also to Klaus Hartke, who wrote the initial version of Big thanks also to Klaus Hartke, who wrote the initial version of
this document. this document.
Finally, we would like to thank our area director (Stephen Farrell) Finally, we would like to thank our area director (Stephen Farrell)
and our working group chairs (Zach Shelby and Dorothy Gellert) for and our working group chairs (Zach Shelby and Dorothy Gellert) for
their support. their support.
28. References 28. References
skipping to change at page 41, line 46 skipping to change at page 43, line 30
[WAP-WDP] Wireless Application Protocol Forum, "Wireless Datagram [WAP-WDP] Wireless Application Protocol Forum, "Wireless Datagram
Protocol", June 2001. Protocol", June 2001.
28.2. Informative References 28.2. Informative References
[ACE-WG] IETF, "Authentication and Authorization for Constrained [ACE-WG] IETF, "Authentication and Authorization for Constrained
Environments (ace) Working Group", URL: Environments (ace) Working Group", URL:
https://datatracker.ietf.org/wg/ace/charter/, Jan 2015. https://datatracker.ietf.org/wg/ace/charter/, Jan 2015.
[AES] NIST, "FIPS PUB 197, Advanced Encryption Standard (AES)", [AES] National Institute of Standards and Technology, "FIPS PUB
197, Advanced Encryption Standard (AES)",
http://www.iana.org/assignments/tls-parameters/ http://www.iana.org/assignments/tls-parameters/
tls-parameters.xhtml#tls-parameters-4, November 2001. tls-parameters.xhtml#tls-parameters-4, November 2001.
[CCM] National Institute of Standards and Technology, "Special
Publication 800-38C, Recommendation for Block Cipher Modes
of Operation: The CCM Mode for Authentication and
Confidentiality", http://csrc.nist.gov/publications/
nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf, May
2004.
[ENISA-Report2013] [ENISA-Report2013]
ENISA, "Algorithms, Key Sizes and Parameters Report - ENISA, "Algorithms, Key Sizes and Parameters Report -
2013", http://www.enisa.europa.eu/activities/identity-and- 2013", http://www.enisa.europa.eu/activities/identity-and-
trust/library/deliverables/ trust/library/deliverables/
algorithms-key-sizes-and-parameters-report, October 2013. algorithms-key-sizes-and-parameters-report, October 2013.
[Heninger] [Heninger]
Heninger, N., Durumeric, Z., Wustrow, E., and A. Heninger, N., Durumeric, Z., Wustrow, E., and A.
Halderman, "Mining Your Ps and Qs: Detection of Widespread Halderman, "Mining Your Ps and Qs: Detection of Widespread
Weak Keys in Network Devices", 21st USENIX Security Weak Keys in Network Devices", 21st USENIX Security
skipping to change at page 43, line 8 skipping to change at page 44, line 48
[I-D.ietf-lwig-tls-minimal] [I-D.ietf-lwig-tls-minimal]
Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's
Guide to the (Datagram) Transport Layer Security Protocol Guide to the (Datagram) Transport Layer Security Protocol
for Smart Objects and Constrained Node Networks", draft- for Smart Objects and Constrained Node Networks", draft-
ietf-lwig-tls-minimal-01 (work in progress), March 2014. ietf-lwig-tls-minimal-01 (work in progress), March 2014.
[I-D.ietf-tls-downgrade-scsv] [I-D.ietf-tls-downgrade-scsv]
Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher
Suite Value (SCSV) for Preventing Protocol Downgrade Suite Value (SCSV) for Preventing Protocol Downgrade
Attacks", draft-ietf-tls-downgrade-scsv-03 (work in Attacks", draft-ietf-tls-downgrade-scsv-05 (work in
progress), December 2014. progress), February 2015.
[I-D.ietf-tls-negotiated-dl-dhe] [I-D.ietf-tls-negotiated-dl-dhe]
Gillmor, D., "Negotiated Discrete Log Diffie-Hellman Gillmor, D., "Negotiated Discrete Log Diffie-Hellman
Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- Ephemeral Parameters for TLS", draft-ietf-tls-negotiated-
dl-dhe-00 (work in progress), July 2014. dl-dhe-00 (work in progress), July 2014.
[I-D.ietf-tls-prohibiting-rc4] [I-D.ietf-tls-prohibiting-rc4]
Popov, A., "Prohibiting RC4 Cipher Suites", draft-ietf- Popov, A., "Prohibiting RC4 Cipher Suites", draft-ietf-
tls-prohibiting-rc4-01 (work in progress), October 2014. tls-prohibiting-rc4-01 (work in progress), October 2014.
[I-D.ietf-tls-sslv3-diediedie] [I-D.ietf-tls-sslv3-diediedie]
Barnes, R., Thomson, M., Pironti, A., and A. Langley, Barnes, R., Thomson, M., Pironti, A., and A. Langley,
"Deprecating Secure Sockets Layer Version 3.0", draft- "Deprecating Secure Sockets Layer Version 3.0", draft-
ietf-tls-sslv3-diediedie-00 (work in progress), December ietf-tls-sslv3-diediedie-02 (work in progress), March
2014. 2015.
[I-D.ietf-uta-tls-bcp] [I-D.ietf-uta-tls-bcp]
Sheffer, Y., Holz, R., and P. Saint-Andre, Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of TLS and DTLS", draft- "Recommendations for Secure Use of TLS and DTLS", draft-
ietf-uta-tls-bcp-08 (work in progress), December 2014. ietf-uta-tls-bcp-11 (work in progress), February 2015.
[I-D.irtf-cfrg-chacha20-poly1305] [I-D.irtf-cfrg-chacha20-poly1305]
Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF
protocols", draft-irtf-cfrg-chacha20-poly1305-07 (work in protocols", draft-irtf-cfrg-chacha20-poly1305-10 (work in
progress), January 2015. progress), February 2015.
[I-D.mathewson-no-gmtunixtime] [I-D.mathewson-no-gmtunixtime]
Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in
TLS", draft-mathewson-no-gmtunixtime-00 (work in TLS", draft-mathewson-no-gmtunixtime-00 (work in
progress), December 2013. progress), December 2013.
[I-D.schmertmann-dice-ccm-psk-pfs] [I-D.schmertmann-dice-ccm-psk-pfs]
Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher
Suites with Forward Secrecy for Transport Layer Security Suites with Forward Secrecy for Transport Layer Security
(TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in (TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in
skipping to change at page 44, line 29 skipping to change at page 46, line 23
[RFC1191] Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191, [RFC1191] Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191,
November 1990. November 1990.
[RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery [RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery
for IP version 6", RFC 1981, August 1996. for IP version 6", RFC 1981, August 1996.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, February Hashing for Message Authentication", RFC 2104, February
1997. 1997.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)", RFC
2865, June 2000.
[RFC3610] Whiting, D., Housley, R., and N. Ferguson, "Counter with [RFC3610] Whiting, D., Housley, R., and N. Ferguson, "Counter with
CBC-MAC (CCM)", RFC 3610, September 2003. CBC-MAC (CCM)", RFC 3610, September 2003.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, "Extensible Authentication Protocol (EAP)", RFC
3748, June 2004.
[RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness [RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness
Requirements for Security", BCP 106, RFC 4086, June 2005. Requirements for Security", BCP 106, RFC 4086, June 2005.
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites
for Transport Layer Security (TLS)", RFC 4492, May 2006. for Transport Layer Security (TLS)", RFC 4492, May 2006.
[RFC4634] Eastlake, D. and T. Hansen, "US Secure Hash Algorithms [RFC4634] Eastlake, D. and T. Hansen, "US Secure Hash Algorithms
(SHA and HMAC-SHA)", RFC 4634, July 2006. (SHA and HMAC-SHA)", RFC 4634, July 2006.
skipping to change at page 45, line 21 skipping to change at page 47, line 24
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, May 2008. (CRL) Profile", RFC 5280, May 2008.
[RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois [RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois
Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, Counter Mode (GCM) Cipher Suites for TLS", RFC 5288,
August 2008. August 2008.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk,
"Elliptic Curve Cryptography Subject Public Key
Information", RFC 5480, March 2009.
[RFC5758] Dang, Q., Santesson, S., Moriarty, K., Brown, D., and T. [RFC5758] Dang, Q., Santesson, S., Moriarty, K., Brown, D., and T.
Polk, "Internet X.509 Public Key Infrastructure: Polk, "Internet X.509 Public Key Infrastructure:
Additional Algorithms and Identifiers for DSA and ECDSA", Additional Algorithms and Identifiers for DSA and ECDSA",
RFC 5758, January 2010. RFC 5758, January 2010.
[RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor
Management Protocol (TAMP)", RFC 5934, August 2010. Management Protocol (TAMP)", RFC 5934, August 2010.
[RFC6024] Reddy, R. and C. Wallace, "Trust Anchor Management
Requirements", RFC 6024, October 2010.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic
Curve Cryptography Algorithms", RFC 6090, February 2011. Curve Cryptography Algorithms", RFC 6090, February 2011.
[RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for
Transport Layer Security (TLS)", RFC 6655, July 2012. Transport Layer Security (TLS)", RFC 6655, July 2012.
[RFC6690] Shelby, Z., "Constrained RESTful Environments (CoRE) Link [RFC6690] Shelby, Z., "Constrained RESTful Environments (CoRE) Link
Format", RFC 6690, August 2012. Format", RFC 6690, August 2012.
[RFC6733] Fajardo, V., Arkko, J., Loughney, J., and G. Zorn,
"Diameter Base Protocol", RFC 6733, October 2012.
[RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS)
Multiple Certificate Status Request Extension", RFC 6961, Multiple Certificate Status Request Extension", RFC 6961,
June 2013. June 2013.
[RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for [RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for
Constrained-Node Networks", RFC 7228, May 2014. Constrained-Node Networks", RFC 7228, May 2014.
[RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained
Application Protocol (CoAP)", RFC 7252, June 2014. Application Protocol (CoAP)", RFC 7252, June 2014.
skipping to change at page 46, line 21 skipping to change at page 48, line 34
October 2014. October 2014.
[RFC7397] Gilger, J. and H. Tschofenig, "Report from the Smart [RFC7397] Gilger, J. and H. Tschofenig, "Report from the Smart
Object Security Workshop", RFC 7397, December 2014. Object Security Workshop", RFC 7397, December 2014.
[RFC7400] Bormann, C., "6LoWPAN-GHC: Generic Header Compression for [RFC7400] Bormann, C., "6LoWPAN-GHC: Generic Header Compression for
IPv6 over Low-Power Wireless Personal Area Networks IPv6 over Low-Power Wireless Personal Area Networks
(6LoWPANs)", RFC 7400, November 2014. (6LoWPANs)", RFC 7400, November 2014.
[SP800-22b] [SP800-22b]
NIST, "Special Publication 800-22, Revision 1a, A National Institute of Standards and Technology, "Special
Statistical Test Suite for Random and Pseudorandom Number Publication 800-22, Revision 1a, A Statistical Test Suite
Generators for Cryptographic Applications", for Random and Pseudorandom Number Generators for
Cryptographic Applications",
http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/ http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/
SP800-22rev1a.pdf, April 2010. SP800-22rev1a.pdf, April 2010.
[SP800-90A] [SP800-90A]
NIST, "DRAFT Special Publication 800-90a, Revision 1, NIST, "DRAFT Special Publication 800-90a, Revision 1,
Recommendation for Random Number Generation Using Recommendation for Random Number Generation Using
Deterministic Random Bit Generators", Deterministic Random Bit Generators",
http://csrc.nist.gov/publications/drafts/800-90/ http://csrc.nist.gov/publications/drafts/800-90/
sp800-90a_r1_draft_november2014_ver.pdf, November 2014. sp800-90a_r1_draft_november2014_ver.pdf, November 2014.
[Tripple-HS] [Triple-HS]
Bhargavan, K., Delignat-Lavaud, C., Pironti, A., and P. Bhargavan, K., Delignat-Lavaud, C., Pironti, A., and P.
Strub, "Triple Handshakes and Cookie Cutters: Breaking and Strub, "Triple Handshakes and Cookie Cutters: Breaking and
Fixing Authentication over TLS", IEEE Symposium on Fixing Authentication over TLS", IEEE Symposium on
Security and Privacy, pages 98-113, 2014. Security and Privacy, pages 98-113, 2014.
Appendix A. Conveying DTLS over SMS Appendix A. Conveying DTLS over SMS
This section is normative for the use of DTLS over SMS. Timer This section is normative for the use of DTLS over SMS. Timer
recommendations are already outlined in Section 13 and also recommendations are already outlined in Section 13 and also
applicable to the transport of DTLS over SMS. applicable to the transport of DTLS over SMS.
skipping to change at page 48, line 35 skipping to change at page 50, line 52
usually done with the host/port number. usually done with the host/port number.
If the DTLS server allows more than one client to be active at any If the DTLS server allows more than one client to be active at any
given time, then the WAP User Datagram Protocol [WAP-WDP] can be used given time, then the WAP User Datagram Protocol [WAP-WDP] can be used
to achieve multiplexing of the different security associations. (The to achieve multiplexing of the different security associations. (The
use of WDP provides the additional benefit that upper layer protocols use of WDP provides the additional benefit that upper layer protocols
can operate independently of the underlying wireless network, hence can operate independently of the underlying wireless network, hence
achieving application-agnostic transport handover.) achieving application-agnostic transport handover.)
The total overhead cost for encoding the WDP source and destination The total overhead cost for encoding the WDP source and destination
ports is 7 bytes out of the total available for the SMS content. ports is either 5 or 7 bytes out of the total available for the SMS
content depending on if 1-byte or 2-byte port identifiers are used,
as shown in Figure 12 and Figure 13.
0 1 2 3 4
+--------+--------+--------+--------+--------+
| ... | 0x04 | 2 | ... | ... |
+--------+--------+--------+--------+--------+
UDH IEI IE Dest Source
Length Length Port Port
Figure 12: Application Port Addressing Scheme (8 bit address).
0 1 2 3 4 5 6
+--------+--------+--------+--------+--------+--------+--------+
| ... | 0x05 | 4 | ... | ... |
+--------+--------+--------+--------+--------+--------+--------+
UDH IEI IE Dest Source
Length Length Port Port
Figure 13: Application Port Addressing Scheme (16 bit address).
The receiving side of the communication gets the source address from The receiving side of the communication gets the source address from
the originator address (TP-OA) field of the SMS-DELIVER TPDU. This the originator address (TP-OA) field of the SMS-DELIVER TPDU. This
way an unique 4-tuple identifying the security association can be way an unique 4-tuple identifying the security association can be
reconstructed at both ends. (When replying to its DTLS peer, the reconstructed at both ends. (When replying to its DTLS peer, the
sender will swaps the TP-OA and TP-DA parameters and the source and sender will swaps the TP-OA and TP-DA parameters and the source and
destination ports in the WDP.) destination ports in the WDP.)
A.4. Timeout A.4. Timeout
skipping to change at page 49, line 15 skipping to change at page 52, line 7
Handshake messages MUST carry a validity period (TP-VP parameter in a Handshake messages MUST carry a validity period (TP-VP parameter in a
SMS-SUBMIT TPDU) that is not less than the current value of the SMS-SUBMIT TPDU) that is not less than the current value of the
retransmission timeout. In order to avoid persisting messages in the retransmission timeout. In order to avoid persisting messages in the
network that will be discarded by the receiving party, handshake network that will be discarded by the receiving party, handshake
messages SHOULD carry a validity period that is the same as, or just messages SHOULD carry a validity period that is the same as, or just
slightly higher than, the current value of the retransmission slightly higher than, the current value of the retransmission
timeout. timeout.
Appendix B. DTLS Record Layer Per-Packet Overhead Appendix B. DTLS Record Layer Per-Packet Overhead
Figure 12 shows the overhead for the DTLS record layer for protecting Figure 14 shows the overhead for the DTLS record layer for protecting
data traffic when AES-128-CCM with an 8-octet Integrity Check Value data traffic when AES-128-CCM with an 8-octet Integrity Check Value
(ICV) is used. (ICV) is used.
DTLS Record Layer Header................13 bytes DTLS Record Layer Header................13 bytes
Nonce (Explicit).........................8 bytes Nonce (Explicit).........................8 bytes
ICV..................................... 8 bytes ICV..................................... 8 bytes
------------------------------------------------ ------------------------------------------------
Overhead................................29 bytes Overhead................................29 bytes
------------------------------------------------ ------------------------------------------------
Figure 12: AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead. Figure 14: AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead.
The DTLS record layer header has 13 octets and consists of The DTLS record layer header has 13 octets and consists of
o 1 octet content type field, o 1 octet content type field,
o 2 octet version field, o 2 octet version field,
o 2 octet epoch field, o 2 octet epoch field,
o 6 octet sequence number, o 6 octet sequence number,
skipping to change at page 50, line 25 skipping to change at page 53, line 17
Appendix C. DTLS Fragmentation Appendix C. DTLS Fragmentation
[Editor's Note: Proposed text that requires discussion. ] [Editor's Note: Proposed text that requires discussion. ]
Section 4.2.3 of [RFC6347] advises DTLS implementations to not Section 4.2.3 of [RFC6347] advises DTLS implementations to not
produce overlapping fragments, but requires receivers to be able to produce overlapping fragments, but requires receivers to be able to
cope with them. The need for the latter requisite is explained in cope with them. The need for the latter requisite is explained in
Section 4.1.1.1 of [RFC6347]: accurate path MTU (PMTU) estimation may Section 4.1.1.1 of [RFC6347]: accurate path MTU (PMTU) estimation may
be traded for shorter handshake completion time. This approach may be traded for shorter handshake completion time. This approach may
be beneficial in unconstrained networks where a PMTU of 1280 bytes be beneficial in unconstrained networks where a PMTU of 1280 bytes
can be pretty much universally assumed. However, when the handshake can be pretty much universally assumed. However, an handshake that
is carried over a narrow-band radio technology, such as IEEE 802.15.4 is carried over a narrow-band radio technology, such as IEEE
or GSM-SMS, and the client is lacking reliable PMTU data to inform 802.15.4, Bluetooth Smart or GSM-SMS, and the client is lacking
fragmentation (e.g., using [RFC1981] or [RFC1191]) can put a cost on reliable PMTU data to inform fragmentation (e.g., using [RFC1981] or
the constrained implementation in terms of memory (due to re- [RFC1191]) can place a cost on the constrained implementation in
buffering) and latency (due to re-transmission) much higher than the terms of memory (due to re-buffering) and latency (due to re-
benefit that it would get from a shorter handshake. transmission) much higher than the benefit that it would get from a
shorter handshake.
In order to reduce the likelihood of producing different fragment In order to reduce the likelihood of producing different fragment
sizes (and consequent overlaps) within the same handshake, this sizes (and consequent overlaps) within the same handshake, this
document RECOMMENDs: document RECOMMENDs:
o for clients (handshake initiators), to perform PMTU discovery o for clients (handshake initiators), to perform PMTU discovery
towards the server before handshake starts, and not rely on any towards the server before handshake starts, and not rely on any
guesses (unless the network path characteristics are reliably guesses (unless the network path characteristics are reliably
known from another source); known from another source);
 End of changes. 114 change blocks. 
473 lines changed or deleted 589 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/