< draft-ietf-dice-profile-13.txt   draft-ietf-dice-profile-14.txt >
dice H. Tschofenig, Ed. dice H. Tschofenig, Ed.
Internet-Draft ARM Ltd. Internet-Draft ARM Ltd.
Intended status: Standards Track T. Fossati Intended status: Standards Track T. Fossati
Expires: December 13, 2015 Alcatel-Lucent Expires: February 18, 2016 Alcatel-Lucent
June 11, 2015 August 17, 2015
A TLS/DTLS Profile for the Internet of Things TLS/DTLS Profiles for the Internet of Things
draft-ietf-dice-profile-13.txt draft-ietf-dice-profile-14.txt
Abstract Abstract
A common design pattern in Internet of Things (IoT) deployments is A common design pattern in Internet of Things (IoT) deployments is
the use of a constrained device that collects data via sensor or the use of a constrained device that collects data via sensor or
controls actuators for use in home automation, industrial control controls actuators for use in home automation, industrial control
systems, smart cities and other IoT deployments. systems, smart cities and other IoT deployments.
This document defines a Transport Layer Security (TLS) and Datagram This document defines a Transport Layer Security (TLS) and Datagram
TLS (DTLS) 1.2 profile that offers communications security for this TLS (DTLS) 1.2 profile that offers communications security for this
skipping to change at page 1, line 42 skipping to change at page 1, line 42
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 13, 2015. This Internet-Draft will expire on February 18, 2016.
Copyright Notice Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 24 skipping to change at page 2, line 24
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4 3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4
4. Communication Models . . . . . . . . . . . . . . . . . . . . 5 4. Communication Models . . . . . . . . . . . . . . . . . . . . 5
4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 6 4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 6
4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 13 4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 13
5. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 18 5. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 18
6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 19 6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 20
6.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 19 6.1. Pre-Conditions . . . . . . . . . . . . . . . . . . . . . 20
6.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 21 6.2. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 21
6.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 23 6.3. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 24
7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 29 6.4. Certificates . . . . . . . . . . . . . . . . . . . . . . 25
8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 29 7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 31
9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 30 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 31
10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 31 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 32
11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 32 10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 33
12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 32 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 34
13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 34 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 34
14. Random Number Generation . . . . . . . . . . . . . . . . . . 35 13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 36
15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 36 14. Random Number Generation . . . . . . . . . . . . . . . . . . 37
16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 37 15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 38
17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 37 16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 39
18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 37 17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 39
19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 38 18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 40
20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 38 19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 40
21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 39 20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 41
22. Key Length Recommendations . . . . . . . . . . . . . . . . . 40 21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 41
23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 41 22. Key Length Recommendations . . . . . . . . . . . . . . . . . 42
24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 42 23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 43
25. Security Considerations . . . . . . . . . . . . . . . . . . . 42 24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 44
26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 43 25. Security Considerations . . . . . . . . . . . . . . . . . . . 45
27. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 43 26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 45
28. References . . . . . . . . . . . . . . . . . . . . . . . . . 43 27. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 45
28.1. Normative References . . . . . . . . . . . . . . . . . . 43 28. References . . . . . . . . . . . . . . . . . . . . . . . . . 46
28.2. Informative References . . . . . . . . . . . . . . . . . 45 28.1. Normative References . . . . . . . . . . . . . . . . . . 46
Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 50 28.2. Informative References . . . . . . . . . . . . . . . . . 47
A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 50
A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 51 Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 53
A.3. Multiplexing Security Associations . . . . . . . . . . . 52 A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 54
A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 53 A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 54
Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 53 A.3. Multiplexing Security Associations . . . . . . . . . . . 55
Appendix C. DTLS Fragmentation . . . . . . . . . . . . . . . . . 54 A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 56
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 55 Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 56
Appendix C. DTLS Fragmentation . . . . . . . . . . . . . . . . . 58
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 58
1. Introduction 1. Introduction
An engineer developing an Internet of Things (IoT) device needs to An engineer developing an Internet of Things (IoT) device needs to
investigate the security threats and decide about the security investigate the security threats and decide about the security
services that can be used to mitigate these threats. services that can be used to mitigate these threats.
Enabling IoT devices to exchange data often requires authentication Enabling IoT devices to exchange data often requires authentication
of the two endpoints and the ability to provide integrity- and of the two endpoints and the ability to provide integrity- and
confidentiality-protection of exchanged data. While these security confidentiality-protection of exchanged data. While these security
skipping to change at page 3, line 47 skipping to change at page 3, line 49
TLS 1.2 [RFC5246] that offers communication security services for IoT TLS 1.2 [RFC5246] that offers communication security services for IoT
applications and is reasonably implementable on many constrained applications and is reasonably implementable on many constrained
devices. Profile thereby means that available configuration options devices. Profile thereby means that available configuration options
and protocol extensions are utilized to best support the IoT and protocol extensions are utilized to best support the IoT
environment. This document does not alter TLS/DTLS specifications environment. This document does not alter TLS/DTLS specifications
and does not introduce any new TLS/DTLS extension. and does not introduce any new TLS/DTLS extension.
The main target audience for this document is the embedded system The main target audience for this document is the embedded system
developer configuring and using a TLS/DTLS stack. This document may, developer configuring and using a TLS/DTLS stack. This document may,
however, also help those developing or selecting a suitable TLS/DTLS however, also help those developing or selecting a suitable TLS/DTLS
stack for an Internet of Things product. stack for an Internet of Things product. If you are familiar with
(D)TLS, then skip ahead to Section 6.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
This specification refers to TLS as well as DTLS and particularly to This specification refers to TLS as well as DTLS and particularly to
version 1.2, which is the most recent version at the time of writing. version 1.2, which is the most recent version at the time of writing.
We refer to TLS/DTLS whenever the text is applicable to both versions We refer to TLS/DTLS whenever the text is applicable to both versions
of the protocol and to TLS or DTLS when there are differences between of the protocol and to TLS or DTLS when there are differences between
the two protocols. the two protocols. Note that TLS 1.3 is being developed but it is
not expected that this profile will "just work" due to the
significant changes being done to TLS for version 1.3.
Note that "Client" and "Server" in this document refer to TLS/DTLS Note that "Client" and "Server" in this document refer to TLS/DTLS
roles, where the client initiates the handshake. This does not roles, where the client initiates the handshake. This does not
restrict the interaction pattern of the protocols on top of DTLS restrict the interaction pattern of the protocols on top of DTLS
since the record layer allows bi-directional communication. This since the record layer allows bi-directional communication. This
aspect is further described in Section 4. aspect is further described in Section 4.
RFC 7228 [RFC7228] introduces the notion of constrained-node RFC 7228 [RFC7228] introduces the notion of constrained-node
networks, which are made of small devices with severe constraints on networks, which are made of small devices with severe constraints on
power, memory, and processing resources. The terms constrained power, memory, and processing resources. The terms constrained
skipping to change at page 6, line 16 skipping to change at page 6, line 16
The communication architecture shown in Figure 1 assumes a unicast The communication architecture shown in Figure 1 assumes a unicast
communication interaction with an IoT device utilizing a constrained communication interaction with an IoT device utilizing a constrained
TLS/DTLS client interacting with one or multiple TLS/DTLS servers. TLS/DTLS client interacting with one or multiple TLS/DTLS servers.
Before a client can initiate the TLS/DTLS handshake it needs to know Before a client can initiate the TLS/DTLS handshake it needs to know
the IP address of that server and what credentials to use. the IP address of that server and what credentials to use.
Application layer protocols, such as CoAP, which is conveyed on top Application layer protocols, such as CoAP, which is conveyed on top
of DTLS, may be configured with URIs of the endpoints to which CoAP of DTLS, may be configured with URIs of the endpoints to which CoAP
needs to register and publish data. This configuration information needs to register and publish data. This configuration information
(including credentials) may be conveyed to clients as part of a (including non-confidential credentials, like certificates) may be
firmware/software package or via a configuration protocol. The conveyed to clients as part of a firmware/software package or via a
following credential types are supported by this profile: configuration protocol. The following credential types are supported
by this profile:
o For PSK-based authentication (see Section 6.1), this includes the o For PSK-based authentication (see Section 6.2), this includes the
paired "PSK identity" and shared secret to be used with each paired "PSK identity" and shared secret to be used with each
server. server.
o For raw public key-based authentication (see Section 6.2), this o For raw public key-based authentication (see Section 6.3), this
includes either the server's public key or the hash of the includes either the server's public key or the hash of the
server's public key. server's public key.
o For certificate-based authentication (see Section 6.3), this o For certificate-based authentication (see Section 6.4), this
includes a pre-populated trust anchor store that allows the DTLS includes a pre-populated trust anchor store that allows the DTLS
stack to perform path validation for the certificate obtained stack to perform path validation for the certificate obtained
during the handshake with the server. during the handshake with the server.
Figure 1 shows example configuration information stored at the Figure 1 shows example configuration information stored at the
constrained client for use with respective servers. constrained client for use with respective servers.
This document focuses on the description of the DTLS client-side This document focuses on the description of the DTLS client-side
functionality but, quite naturally, the equivalent server-side functionality but, quite naturally, the equivalent server-side
support has to be available. support has to be available.
skipping to change at page 11, line 11 skipping to change at page 11, line 11
a significant amount of flash memory. Note, however, that the a significant amount of flash memory. Note, however, that the
credentials used for network access authentication and those used for credentials used for network access authentication and those used for
application layer security are very likely different. application layer security are very likely different.
4.1.1.2. CoAP-based Data Exchange Example 4.1.1.2. CoAP-based Data Exchange Example
When a constrained client uploads sensor data to a server When a constrained client uploads sensor data to a server
infrastructure it may use CoAP by pushing the data via a POST message infrastructure it may use CoAP by pushing the data via a POST message
to a pre-configured endpoint on the server. In certain circumstances to a pre-configured endpoint on the server. In certain circumstances
this might be too limiting and additional functionality is needed, as this might be too limiting and additional functionality is needed, as
shown in Figure 4, where the IoT device itself runs a CoAP server shown in Figure 4 and Figure 4, where the IoT device itself runs a
hosting the resource that is made accessible to other entities. CoAP server hosting the resource that is made accessible to other
Despite running a CoAP server on the IoT device it is still the DTLS entities. Despite running a CoAP server on the IoT device it is
client on the IoT device that initiates the interaction with the non- still the DTLS client on the IoT device that initiates the
constrained resource server in our scenario. interaction with the non-constrained resource server in our scenario.
Figure 4 shows a sensor starting a DTLS exchange with a resource Figure 4 shows a sensor starting a DTLS exchange with a resource
directory to register available resources. directory and uses CoAP to register available resources in Figure 5.
[I-D.ietf-core-resource-directory] defines the resource directory [I-D.ietf-core-resource-directory] defines the resource directory
(RD) as a web entity that stores information about web resources and (RD) as a web entity that stores information about web resources and
implements Representational State Transfer (REST) interfaces for implements Representational State Transfer (REST) interfaces for
registration and lookup of those resources. Note that the described registration and lookup of those resources. Note that the described
exchange is borrowed from the OMA Lightweight Machine-to-Machine exchange is borrowed from the OMA Lightweight Machine-to-Machine
(LWM2M) specification [LWM2M] that uses RD but adds proxy (LWM2M) specification [LWM2M] that uses RD but adds proxy
functionality. functionality.
The initial DTLS interaction between the sensor, acting as a DTLS The initial DTLS interaction between the sensor, acting as a DTLS
client, and the resource directory, acting as a DTLS server, will be client, and the resource directory, acting as a DTLS server, will be
skipping to change at page 12, line 26 skipping to change at page 12, line 39
A| Certificate A| Certificate
K| ClientKeyExchange K| ClientKeyExchange
E| CertificateVerify E| CertificateVerify
| [ChangeCipherSpec] | [ChangeCipherSpec]
| Finished --------> | Finished -------->
| |
| [ChangeCipherSpec] | [ChangeCipherSpec]
| <-------- Finished | <-------- Finished
+--- +---
Note: Extensions marked with '#' were introduced with
RFC 7250.
Figure 4: DTLS/CoAP exchange using Resource Directory: Part 1 - DTLS
Handshake.
Figure 5 shows the DTLS-secured communication between the sensor and
the resource directory using CoAP.
Resource
Sensor Directory
------ ---------
[[==============DTLS-secured Communication===================]]
+--- ///+ +--- ///+
C| \ D C| \ D
O| Req: POST coap://rd.example.com/rd?ep=node1 \ T O| Req: POST coap://rd.example.com/rd?ep=node1 \ T
A| Payload: \ L A| Payload: \ L
P| </temp>;ct=41; \ S P| </temp>;ct=41; \ S
| rt="temperature-c";if="sensor", \ | rt="temperature-c";if="sensor", \
R| </light>;ct=41; \ R R| </light>;ct=41; \ R
D| rt="light-lux";if="sensor" \ E D| rt="light-lux";if="sensor" \ E
| --------> \ C | --------> \ C
R| \ O R| \ O
skipping to change at page 13, line 8 skipping to change at page 13, line 41
C| \ R C| \ R
O| Req: GET coaps://sensor.example.com/temp \ O O| Req: GET coaps://sensor.example.com/temp \ O
A| <-------- \ T A| <-------- \ T
P| \ E P| \ E
| Res: 2.05 Content \ C | Res: 2.05 Content \ C
G| Payload: \ T G| Payload: \ T
E| 25.5 --------> \ E E| 25.5 --------> \ E
T| \ D T| \ D
+--- ///+ +--- ///+
Note: Extensions marked with '#' were introduced with Figure 5: DTLS/CoAP exchange using Resource Directory: Part 2 - CoAP/
RFC 7250. RD Exchange.
Figure 4: DTLS/CoAP exchange using Resource Directory. Note that the CoAP GET message transmitted from the Resource Server
is protected using the previously established DTLS Record Layer.
4.2. Constrained TLS/DTLS Servers 4.2. Constrained TLS/DTLS Servers
Section 4.1 illustrates a deployment model where the TLS/DTLS client Section 4.1 illustrates a deployment model where the TLS/DTLS client
is constrained and efforts need to be taken to improve memory is constrained and efforts need to be taken to improve memory
utilization, bandwidth consumption, reduce performance impacts, etc. utilization, bandwidth consumption, reduce performance impacts, etc.
In this section, we assume a scenario where constrained devices run In this section, we assume a scenario where constrained devices run
TLS/ DTLS servers to secure access to application layer services TLS/ DTLS servers to secure access to application layer services
running on top of CoAP, HTTP or other protocols. Figure 5 running on top of CoAP, HTTP or other protocols. Figure 6
illustrates a possible deployment whereby a number of constrained illustrates a possible deployment whereby a number of constrained
servers are waiting for regular clients to access their resources. servers are waiting for regular clients to access their resources.
The entire process is likely, but not necessarily, controlled by a The entire process is likely, but not necessarily, controlled by a
third party, the authentication and authorization server. This third party, the authentication and authorization server. This
authentication and authorization server is responsible for holding authentication and authorization server is responsible for holding
authorization policies that govern the access to resources and authorization policies that govern the access to resources and
distribution of keying material. distribution of keying material.
+////////////////////////////////////+ +////////////////////////////////////+
| Configuration | | Configuration |
skipping to change at page 14, line 42 skipping to change at page 15, line 42
\ / +-----------+ \ / +-----------+
`. ,' |Constrained| `. ,' |Constrained|
'---+---' | Server S2 | '---+---' | Server S2 |
| +-----------+ | +-----------+
| |
| +-----------+ | +-----------+
+-----------------> |Constrained| +-----------------> |Constrained|
| Server S3 | | Server S3 |
+-----------+ +-----------+
Figure 5: Constrained Server Profile. Figure 6: Constrained Server Profile.
A deployment with constrained servers has to overcome several A deployment with constrained servers has to overcome several
challenges. Below we explain how these challenges have be solved challenges. Below we explain how these challenges can be solved with
with CoAP, as an example. Other protocols may offer similar CoAP, as an example. Other protocols may offer similar capabilities.
capabilities. While the requirements for the TLS/DTLS protocol While the requirements for the TLS/DTLS protocol profile change only
profile change only slightly when run on a constrained server (in slightly when run on a constrained server (in comparison to running
comparison to running it on a constrained client) several other eco- it on a constrained client) several other eco-system factor will
system factor will impact deployment. impact deployment.
There are several challenges that need to be addressed: There are several challenges that need to be addressed:
Discovery and Reachability: Discovery and Reachability:
A client must first and foremost discover the server before A client must first and foremost discover the server before
initiating a connection to it. Once it has been discovered, initiating a connection to it. Once it has been discovered,
reachability to the device needs to be maintained. reachability to the device needs to be maintained.
In CoAP the discovery of resources offered by servers is In CoAP the discovery of resources offered by servers is
skipping to change at page 15, line 38 skipping to change at page 16, line 38
Authentication: Authentication:
The next challenge concerns the provisioning of authentication The next challenge concerns the provisioning of authentication
credentials to the clients as well as servers. In Section 4.1 we credentials to the clients as well as servers. In Section 4.1 we
assumed that credentials (and other configuration information) are assumed that credentials (and other configuration information) are
provisioned to the device and that those can be used with the provisioned to the device and that those can be used with the
authorization servers. Of course, this leads to a very static authorization servers. Of course, this leads to a very static
relationship between the clients and their server-side relationship between the clients and their server-side
infrastructure but poses fewer challenges from a deployment point infrastructure but poses fewer challenges from a deployment point
of view, as described in Section 2 of [RFC7452] these different of view, as described in Section 2 of [RFC7452]. In any case,
communication patterns. In any case, engineers and product engineers and product designers have to determine how the relevant
designers have to determine how the relevant credentials are credentials are distributed to the respective parties. For
distributed to the respective parties. For example, shared example, shared secrets may need to be provisioned to clients and
secrets may need to be provisioned to clients and the constrained the constrained servers for subsequent use of TLS/DTLS PSK. In
servers for subsequent use of TLS/DTLS PSK. In other deployments, other deployments, certificates, private keys, and trust anchors
certificates, private keys, and trust anchors for use with for use with certificate-based authentication may need to be
certificate-based authentication may need to be utilized. utilized.
Practical solutions either use pairing (also called imprinting) or Practical solutions either use pairing (also called imprinting) or
a trusted third party. With pairing two devices execute a special a trusted third party. With pairing two devices execute a special
protocol exchange that is unauthenticated to establish an shared protocol exchange that is unauthenticated to establish an shared
key (for example using an unauthenticated Diffie-Hellman exchange) key (for example using an unauthenticated Diffie-Hellman exchange)
key. To avoid man-in-the-middle attacks an out-of-band channel is key. To avoid man-in-the-middle attacks an out-of-band channel is
used to verify that nobody has tampered with the exchanged used to verify that nobody has tampered with the exchanged
protocol messages. This out-of-band channel can come in many protocol messages. This out-of-band channel can come in many
forms, including: forms, including:
skipping to change at page 16, line 33 skipping to change at page 17, line 33
Authorization Authorization
The last challenge is the ability for the constrained server to The last challenge is the ability for the constrained server to
make an authorization decision when clients access protected make an authorization decision when clients access protected
resources. Pre-provisioning access control information to resources. Pre-provisioning access control information to
constrained servers may be one option but works only in a small constrained servers may be one option but works only in a small
scale, less dynamic environment. For a more fine-grained and scale, less dynamic environment. For a more fine-grained and
dynamic access control the reader is referred to the ongoing work dynamic access control the reader is referred to the ongoing work
in the ACE working group. in the ACE working group.
Figure 6 shows an example interaction whereby a device, a thermostat Figure 7 shows an example interaction whereby a device, a thermostat
in our case, searches in the local network for discoverable resources in our case, searches in the local network for discoverable resources
and accesses those. The thermostat starts the procedure using a and accesses those. The thermostat starts the procedure using a
link-local discovery message using the "All CoAP Nodes" multicast link-local discovery message using the "All CoAP Nodes" multicast
address by utilizing the RFC 6690 [RFC6690] link format. The IPv6 address by utilizing the RFC 6690 [RFC6690] link format. The IPv6
multicast address used for site-local discovery is FF02::FD. As a multicast address used for site-local discovery is FF02::FD. As a
result, a temperature sensor and a fan respond. These responses result, a temperature sensor and a fan respond. These responses
allow the thermostat to subsequently read temperature information allow the thermostat to subsequently read temperature information
from the temperature sensor with a CoAP GET request issued to the from the temperature sensor with a CoAP GET request issued to the
previously learned endpoint. In this example we assume that previously learned endpoint. In this example we assume that
accessing the temperature sensor readings and controlling the fan accessing the temperature sensor readings and controlling the fan
skipping to change at page 17, line 4 skipping to change at page 18, line 8
from the temperature sensor with a CoAP GET request issued to the from the temperature sensor with a CoAP GET request issued to the
previously learned endpoint. In this example we assume that previously learned endpoint. In this example we assume that
accessing the temperature sensor readings and controlling the fan accessing the temperature sensor readings and controlling the fan
requires authentication and authorization of the thermostat and TLS requires authentication and authorization of the thermostat and TLS
is used to authenticate both endpoint and to secure the is used to authenticate both endpoint and to secure the
communication. communication.
Temperature Temperature
Thermostat Sensor Fan Thermostat Sensor Fan
---------- --------- --- ---------- --------- ---
Discovery Discovery
--------------------> -------------------->
GET coap://[FF02::FD]/.well-known/core GET coap://[FF02::FD]/.well-known/core
CoAP 2.05 Content CoAP 2.05 Content
<------------------------------- <-------------------------------
</3303/0/5700>;rt="temperature"; </3303/0/5700>;rt="temperature";
if="sensor" if="sensor"
CoAP 2.05 Content CoAP 2.05 Content
<-------------------------------------------------- <--------------------------------------------------
</fan>;rt="fan";if="actuation" </fan>;rt="fan";if="actuation"
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
\ /
\ Protocol steps to obtain access token or keying / \ Protocol steps to obtain access token or keying /
\ material for access to the temperature sensor and fan. / \ material for access to the temperature sensor and fan. /
\ /
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
Read Sensor Data Read Sensor Data
(authenticated/authorized) (authenticated/authorized)
-------------------------------> ------------------------------->
GET /3303/0/5700 GET /3303/0/5700
CoAP 2.05 Content CoAP 2.05 Content
<------------------------------- <-------------------------------
22.5 C 22.5 C
skipping to change at page 17, line 37 skipping to change at page 18, line 40
GET /3303/0/5700 GET /3303/0/5700
CoAP 2.05 Content CoAP 2.05 Content
<------------------------------- <-------------------------------
22.5 C 22.5 C
Configure Actuator Configure Actuator
(authenticated/authorized) (authenticated/authorized)
-------------------------------------------------> ------------------------------------------------->
PUT /fan?on-off=true PUT /fan?on-off=true
CoAP 2.04 Changed CoAP 2.04 Changed
<------------------------------------------------- <-------------------------------------------------
Figure 6: Local Discovery and Resource Access. Figure 7: Local Discovery and Resource Access.
5. The Ciphersuite Concept 5. The Ciphersuite Concept
TLS (and consequently DTLS) has the concept of ciphersuites and an TLS (and consequently DTLS) has the concept of ciphersuites and an
IANA registry [IANA-TLS] was created to register the suites. A IANA registry [IANA-TLS] was created to register the suites. A
ciphersuite (and the specification that defines it) contains the ciphersuite (and the specification that defines it) contains the
following information: following information:
o Authentication and key exchange algorithm (e.g., PSK) o Authentication and key exchange algorithm (e.g., PSK)
skipping to change at page 19, line 26 skipping to change at page 20, line 18
recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC
algorithm and the hash functions used with the TLS PRF. algorithm and the hash functions used with the TLS PRF.
6. Credential Types 6. Credential Types
The mandatory-to-implement functionality will depend on the The mandatory-to-implement functionality will depend on the
credential type used with IoT devices. The sub-sections below credential type used with IoT devices. The sub-sections below
describe the implications of three different credential types, namely describe the implications of three different credential types, namely
pre-shared secrets, raw public keys, and certificates. pre-shared secrets, raw public keys, and certificates.
6.1. Pre-Shared Secret 6.1. Pre-Conditions
All exchanges described in the subsequent sections assume that some
information has been distributed before the TLS/DTLS interaction can
start. The credentials are used to authenticate the client to the
server and vice versa. What information items have to be distributed
depends on the chosen credential types. In all cases the IoT device
needs to know what algorithms to prefer, particularly if there are
multiple algorithms choices available as part of the implemented
ciphersuites, as well as information about the other communication
endpoint (for example in form of a URI) a particular credential has
to be used with.
Pre-Shared Secrets: In this case a shared secret together with an
identifier needs to be made available to the device as well as to
the other communication party.
Raw Public Keys: A public key together with a private key are stored
on the device and typically associated with some identifier. To
authenticate the other communication party the appropriate
credential has to be know. If the other end uses raw public keys
as well then their public key needs to be provisioned (out-of-
band) to the device.
Certificates The use of certificates requires the device to store
the public key (as part of the certificate) as well as the private
key. The certificate will contain the identifier of the device as
well as various other attributes. Both communication parties are
assumed to be in possession of a trust anchor store that contains
CA certificates and, in case of certificate pinning, end-entity
certificates. Similarly to the other credentials the IoT device
needs information about which entity to use which certificate
with. Without a trust anchor store on the IoT device it will not
be possible to perform certificate validation.
We call the above-listed information device credentials and these
device credentials may be provisioned to the device already during
the manufacturing time or later in the process, depending on the
envisioned business and deployment model. These initial credentials
are often called 'root of trust'. Whatever process for generating
these initial device credential is chosen it MUST be ensured that a
different key pair is provisioned for each device and installed in
as-secure a manner as possible. For example, it is preferable to
generate public / private keys on the IoT device itself rather than
generating them outside the device. Since an IoT device is likely to
interact with various other parties the initial device credential may
only be used with some dedicated entities and configuring further
configuration and credentials to the device is left to a separate
interaction. An example of a dedicated protocol used to distribute
credentials, access control lists and configuration information is
the Lightweight Machine-to-Machine (LWM2M) protocol [LWM2M].
For all the credentials listed above there is a chance that those may
need to be replaced or deleted. While separate protocols have been
developed to check the status of these credentials and to manage
these credentials, such as the Trust Anchor Management Protocol
(TAMP) [RFC5934], their usage is, however, not envisioned in the IoT
context so far. IoT device are assumed to have a software update
mechanism built-in and it will allow updates of low-level device
information, including credentials and configuration parameters.
This document does, however, not mandate a specific software /
firmware update protocol.
With all credentials used as input to TLS/DTLS authentication it is
important that these credentials have been generated with care. When
using a pre-shared secret, a critical consideration is use sufficient
entropy during the key generation, as discussed in [RFC4086].
Deriving a shared secret from a password, some device identifiers, or
other low-entropy source is not secure. A low-entropy secret, or
password, is subject to dictionary attacks. Attention also has to be
paid when generating public / private key pairs since the lack of
randomness can result in the same key pair being used in many
devices. This topic is also discussed in Section 14 since keys are
generated during the TLS/DTLS exchange itself as well and the same
considerations apply.
6.2. Pre-Shared Secret
The use of pre-shared secrets is one of the most basic techniques for The use of pre-shared secrets is one of the most basic techniques for
TLS/DTLS since it is both computational efficient and bandwidth TLS/DTLS since it is both computational efficient and bandwidth
conserving. Pre-shared secret based authentication was introduced to conserving. Pre-shared secret based authentication was introduced to
TLS with RFC 4279 [RFC4279]. When using a pre-shared secret, a TLS with RFC 4279 [RFC4279].
critical consideration is how to assure the randomness of these
secrets. The best practice is to ensure that any pre-shared key
contains as much randomness as possible. Deriving a shared secret
from a password, name, or other low-entropy source is not secure. A
low-entropy secret, or password, is subject to dictionary attacks.
The exchange shown in Figure 7 illustrates the DTLS exchange The exchange shown in Figure 8 illustrates the DTLS exchange
including the cookie exchange. While the server is not required to including the cookie exchange. While the server is not required to
initiate a cookie exchange with every handshake, the client is initiate a cookie exchange with every handshake, the client is
required to implement and to react on it when challenged. The cookie required to implement and to react on it when challenged, as defined
exchange allows the server to react to flooding attacks. in RFC 6347 [RFC6347]. The cookie exchange allows the server to
react to flooding attacks.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
<-------- HelloVerifyRequest <-------- HelloVerifyRequest
(contains cookie) (contains cookie)
ClientHello --------> ClientHello -------->
(with cookie) (with cookie)
skipping to change at page 20, line 29 skipping to change at page 22, line 36
Finished --------> Finished -------->
ChangeCipherSpec ChangeCipherSpec
<-------- Finished <-------- Finished
Application Data <-------> Application Data Application Data <-------> Application Data
Legend: Legend:
* indicates an optional message payload * indicates an optional message payload
Figure 7: DTLS PSK Authentication including the Cookie Exchange. Figure 8: DTLS PSK Authentication including the Cookie Exchange.
Note that [RFC4279] used the term PSK identity to refer to the Note that [RFC4279] used the term PSK identity to refer to the
identifier used to refer to the appropriate secret. While identifier used to refer to the appropriate secret. While
'identifier' would be more appropriate in this context we re-use the 'identifier' would be more appropriate in this context we re-use the
terminology defined in RFC 4279 to avoid confusion. RFC 4279 does terminology defined in RFC 4279 to avoid confusion. RFC 4279 does
not mandate the use of any particular type of PSK identity and the not mandate the use of any particular type of PSK identity and the
client and server have to agree on the identities and keys to be client and server have to agree on the identities and keys to be
used. The UTF-8 encoding of identities described in Section 5.1 of used. The UTF-8 encoding of identities described in Section 5.1 of
RFC 4279 aims to improve interoperability for those cases where the RFC 4279 aims to improve interoperability for those cases where the
identity is configured by a human using some management interface identity is configured by a human using some management interface
provided by a Web browser. However, many IoT devices do not have a provided by a Web browser. However, many IoT devices do not have a
user interface and most of their credentials are bound to the device user interface and most of their credentials are bound to the device
rather than to the user. Furthermore, credentials are often rather than to the user. Furthermore, credentials are often
provisioned into hardware modules or into the firmware by developers. provisioned into hardware modules or provisioned alongside with
As such, the encoding considerations are not applicable to this usage firmware. As such, the encoding considerations are not applicable to
environment. For use with this profile the PSK identities SHOULD NOT this usage environment. For use with this profile the PSK identities
assume a structured format (such as domain names, Distinguished SHOULD NOT assume a structured format (such as domain names,
Names, or IP addresses) and a bit-by-bit comparison operation MUST be Distinguished Names, or IP addresses) and a constant time bit-by-bit
used by the server for any operation related to the PSK identity. comparison operation MUST be used by the server for any operation
related to the PSK identity.
Protocol-wise the client indicates which key it uses by including a Protocol-wise the client indicates which key it uses by including a
"PSK identity" in the ClientKeyExchange message. As described in "PSK identity" in the ClientKeyExchange message. As described in
Section 4 clients may have multiple pre-shared keys with a single Section 4 clients may have multiple pre-shared keys with a single
server, for example in a hosting context. The TLS Server Name server, for example in a hosting context. The TLS Server Name
Indication (SNI) extension allows the client to convey the name of Indication (SNI) extension allows the client to convey the name of
the server it is contacting. A server implementation needs to guide the server it is contacting. A server implementation needs to guide
the selection based on a received SNI value from the client. the selection based on a received SNI value from the client.
RFC 4279 requires TLS implementations supporting PSK ciphersuites to RFC 4279 requires TLS implementations supporting PSK ciphersuites to
skipping to change at page 21, line 23 skipping to change at page 23, line 32
assumption for TLS stacks used in the desktop and mobile environments assumption for TLS stacks used in the desktop and mobile environments
where management interfaces are used to provision identities and where management interfaces are used to provision identities and
keys. Implementations in compliance with this profile MAY use PSK keys. Implementations in compliance with this profile MAY use PSK
identities up to 128 octets in length, and arbitrary PSKs up to 64 identities up to 128 octets in length, and arbitrary PSKs up to 64
octets in length. The use of shorter PSK identities is RECOMMENDED. octets in length. The use of shorter PSK identities is RECOMMENDED.
Constrained Application Protocol (CoAP) [RFC7252] currently specifies Constrained Application Protocol (CoAP) [RFC7252] currently specifies
TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite
for use with shared secrets. This ciphersuite uses the AES algorithm for use with shared secrets. This ciphersuite uses the AES algorithm
with 128 bit keys and CCM as the mode of operation. The label "_8" with 128 bit keys and CCM as the mode of operation. The label "_8"
indicates that an 8-octet authentication tag is used. This indicates that an 8-octet authentication tag is used. Note that the
ciphersuite makes use of the default TLS 1.2 Pseudorandom Function shorted authentication tag increases the chance that an adversary
(PRF), which uses an HMAC with the SHA-256 hash function. Note: with no knowledge of the secret key can present a message with a MAC
Starting with TLS 1.2 (and consequently DTLS 1.2) ciphersuites have that will pass the verification procedure. The likelihoods of
to specify the pseudorandom function. RFC 5246 states that 'New accepting forged data is explained in Section 5.3.5 of
[SP800-107-rev1] and depends on the lengths of the authentication tag
and allowed numbers of MAC verifications using a given key.
This ciphersuite makes use of the default TLS 1.2 Pseudorandom
Function (PRF), which uses an HMAC with the SHA-256 hash function.
Note: Starting with TLS 1.2 (and consequently DTLS 1.2) ciphersuites
have to specify the pseudorandom function. RFC 5246 states that 'New
cipher suites MUST explicitly specify a PRF and, in general, SHOULD cipher suites MUST explicitly specify a PRF and, in general, SHOULD
use the TLS PRF with SHA-256 or a stronger standard hash function.'. use the TLS PRF with SHA-256 or a stronger standard hash function.'.
The ciphersuites recommended in this document use the SHA-256 The ciphersuites recommended in this document use the SHA-256
construct defined in Section 5 of RFC 5246. construct defined in Section 5 of RFC 5246.
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section.
6.2. Raw Public Key 6.3. Raw Public Key
The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is
the first entry point into public key cryptography without having to the first entry point into public key cryptography without having to
pay the price of certificates and a public key infrastructure (PKI). pay the price of certificates and a public key infrastructure (PKI).
The specification re-uses the existing Certificate message to convey The specification re-uses the existing Certificate message to convey
the raw public key encoded in the SubjectPublicKeyInfo structure. To the raw public key encoded in the SubjectPublicKeyInfo structure. To
indicate support two new extensions had been defined, as shown in indicate support two new extensions had been defined, as shown in
Figure 8, namely the server_certificate_type*' and the Figure 9, namely the server_certificate_type*' and the
client_certificate_type. To operate this mechanism securely it is client_certificate_type.
necessary to authenticate and authorize the public keys out-of-band.
This key distribution step may, for example, be provided by a
dedicated protocol, such as the OMA LWM2M [LWM2M]. This document
therefore assumes that a client implementation comes with one or
multiple raw public keys of servers, it has to communicate with, pre-
provisioned. To replace, delete, or add raw public keys to this list
requires a software update, for example using a firmware update
mechanism. Additionally, a device will have its own raw public key
and the corresponding private key. This key pair may, for example,
be configured during the manufacturing process of the device.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
#client_certificate_type# #client_certificate_type#
#server_certificate_type# #server_certificate_type#
ServerHello ServerHello
#client_certificate_type# #client_certificate_type#
skipping to change at page 22, line 36 skipping to change at page 24, line 43
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Note: Extensions marked with '#' were introduced with Note: Extensions marked with '#' were introduced with
RFC 7250. RFC 7250.
Figure 8: DTLS Raw Public Key Exchange. Figure 9: DTLS Raw Public Key Exchange.
The CoAP recommended ciphersuite for use with this credential type is The CoAP recommended ciphersuite for use with this credential type is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve
cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral
Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment
mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA)
for authentication. Due to the use of Ephemeral Elliptic Curve for authentication. Due to the use of Ephemeral Elliptic Curve
Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman
groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this
profile. This ciphersuite makes use of the AEAD capability in DTLS profile. This ciphersuite makes use of the AEAD capability in DTLS
skipping to change at page 23, line 14 skipping to change at page 25, line 20
[RFC6090] provides valuable information for implementing Elliptic [RFC6090] provides valuable information for implementing Elliptic
Curve Cryptography algorithms, particularly for choosing methods that Curve Cryptography algorithms, particularly for choosing methods that
have been available in the literature for a long time (i.e., 20 years have been available in the literature for a long time (i.e., 20 years
and more). and more).
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
6.3. Certificates 6.4. Certificates
The use of mutual certificate-based authentication is shown in The use of mutual certificate-based authentication is shown in
Figure 9, which makes use of the cached info extension Figure 10, which makes use of the cached info extension
[I-D.ietf-tls-cached-info]. Support of the cached info extension is [I-D.ietf-tls-cached-info]. Support of the cached info extension is
REQUIRED. Caching certificate chains allows the client to reduce the REQUIRED. Caching certificate chains allows the client to reduce the
communication overhead significantly since otherwise the server would communication overhead significantly since otherwise the server would
provide the end entity certificate, and the certificate chain with provide the end entity certificate, and the certificate chain with
every full DTLS handshake. Because certificate validation requires every full DTLS handshake.
that root keys be distributed independently, the self-signed
certificate that specifies the root certification authority is
omitted from the chain. Client implementations MUST be provisioned
with a trust anchor store that contains these root certificates. The
use of the Trust Anchor Management Protocol (TAMP) [RFC5934] is,
however, not envisioned. Instead IoT devices using this profile MUST
use a software update mechanism to populate the trust anchor store.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
*cached_info* *cached_info*
ServerHello ServerHello
*cached_info* *cached_info*
Certificate Certificate
skipping to change at page 24, line 30 skipping to change at page 26, line 30
CertificateVerify CertificateVerify
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
Note: Extensions marked with '*' were introduced with Note: Extensions marked with '*' were introduced with
[I-D.ietf-tls-cached-info]. [I-D.ietf-tls-cached-info].
Figure 9: DTLS Mutual Certificate-based Authentication. Figure 10: DTLS Mutual Certificate-based Authentication.
TLS/DTLS offers a lot of freedom for the use with ECC. This document TLS/DTLS offers a lot of freedom for the use with ECC. This document
restricts the use of ECC ciphersuites to named curves defined in RFC restricts the use of ECC ciphersuites to named curves defined in RFC
4492 [RFC4492]. At the time of writing the recommended curve is 4492 [RFC4492]. At the time of writing the recommended curve is
secp256r1 and the use of uncompressed points to follow the secp256r1 and the use of uncompressed points to follow the
recommendation in CoAP. Note that standardization for Curve25519 recommendation in CoAP. Note that standardization for Curve25519
(for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for (for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for
this curve will likely be required in the future. To offer elliptic- this curve will likely be required in the future.
curve signatures using the Edwards-curve Digital Signature Algorithm
(EdDSA) standardization work on Ed25519 is also ongoing (see
[I-D.josefsson-eddsa-ed25519]).
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
6.3.1. Certificates used by Servers 6.4.1. Certificates used by Servers
The algorithm for verifying the service identity, as described in RFC The algorithm for verifying the service identity, as described in RFC
6125 [RFC6125], is essential for ensuring proper security when 6125 [RFC6125], is essential for ensuring proper security when
certificates are used. As a summary, the algorithm contains the certificates are used. As a summary, the algorithm contains the
following steps: following steps:
1. The client constructs a list of acceptable reference identifiers 1. The client constructs a list of acceptable reference identifiers
based on the source domain and, optionally, the type of service based on the source domain and, optionally, the type of service
to which the client is connecting. to which the client is connecting.
skipping to change at page 26, line 4 skipping to change at page 27, line 50
described in the previous paragraph. described in the previous paragraph.
2. Certificates MUST NOT contain domain names with wildcard 2. Certificates MUST NOT contain domain names with wildcard
characters. characters.
3. Certificates MUST NOT contains multiple names (e.g., more than 3. Certificates MUST NOT contains multiple names (e.g., more than
one dNSName field). one dNSName field).
Note that there will be servers that are not provisioned for use with Note that there will be servers that are not provisioned for use with
DNS domain names, for example, IoT devices that offer resources to DNS domain names, for example, IoT devices that offer resources to
nearby devices in a local area network, as shown in Figure 6. When nearby devices in a local area network, as shown in Figure 7. When
such constrained servers are used then the use of certificates as such constrained servers are used then the use of certificates as
described in Section 6.3.2 is applicable. Note that the Service Name described in Section 6.4.2 is applicable. Note that the Service Name
Indication (SNI) extension cannot be used in this case since SNI does Indication (SNI) extension cannot be used in this case since SNI does
not offer the ability to convey EUI-64 [EUI64] identifiers. not offer the ability to convey EUI-64 [EUI64] identifiers. Note
that this document does not recommend to use IP addresses in
certificates nor does it discuss the implications of placing IP
addresses in certificates.
6.3.2. Certificates used by Clients 6.4.2. Certificates used by Clients
For client certificates the identifier used in the SubjectAltName or For client certificates the identifier used in the SubjectAltName or
in the leftmost CN component of subject name MUST be an EUI-64, as in the leftmost CN component of subject name MUST be an EUI-64, as
mandated in Section 9.1.3.3 of [RFC7252]. mandated in Section 9.1.3.3 of [RFC7252].
6.3.3. Certificate Revocation 6.4.3. Certificate Revocation
For certificate revocation neither the Online Certificate Status For certificate revocation neither the Online Certificate Status
Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
Instead, this profile relies on a software update mechanism to Instead, this profile relies on a software update mechanism to
provision information about revoked certificates. While multiple provision information about revoked certificates. While multiple
OCSP stapling [RFC6961] has recently been introduced as a mechanism OCSP stapling [RFC6961] has recently been introduced as a mechanism
to piggyback OCSP request/responses inside the DTLS/TLS handshake (to to piggyback OCSP request/responses inside the DTLS/TLS handshake (to
avoid the cost of a separate protocol handshake), further avoid the cost of a separate protocol handshake), further
investigations are needed to determine its suitability for the IoT investigations are needed to determine its suitability for the IoT
environment. environment.
As stated earlier in this section, modifications to the trust anchor As stated earlier in this section, modifications to the trust anchor
store depends on a software update mechanism as well. store depends on a software update mechanism as well.
6.3.4. Certificate Content 6.4.4. Certificate Content
All certificate elements listed in Table 1 are mandatory-to-implement All certificate elements listed in Table 1 are mandatory-to-implement
for client and servers claiming support for certificate-based for client and servers claiming support for certificate-based
authentication. No other certificate elements are used by this authentication. No other certificate elements are used by this
specification. specification.
When using certificates, IoT devices MUST provide support for a When using certificates, IoT devices MUST provide support for a
server certificate chain of at least 3 not including the trust anchor server certificate chain of at least 3 not including the trust anchor
and MAY reject connections from servers offering chains longer than and MAY reject connections from servers offering chains longer than
3. IoT devices MAY have client certificate chains of any length. 3. IoT devices MAY have client certificate chains of any length.
skipping to change at page 28, line 25 skipping to change at page 30, line 25
There are various algorithms used to sign digital certificates, such There are various algorithms used to sign digital certificates, such
as RSA, the Digital Signature Algorithm (DSA), and the Elliptic Curve as RSA, the Digital Signature Algorithm (DSA), and the Elliptic Curve
Digital Signature Algorithm (ECDSA). As Table 1 indicates Digital Signature Algorithm (ECDSA). As Table 1 indicates
certificate are signed using ECDSA. This is not only true for the certificate are signed using ECDSA. This is not only true for the
end-entity certificates but also for all other certificates in the end-entity certificates but also for all other certificates in the
chain, including CA certificates. chain, including CA certificates.
Further details about X.509 certificates can be found in Further details about X.509 certificates can be found in
Section 9.1.3.3 of [RFC7252]. Section 9.1.3.3 of [RFC7252].
6.3.5. Client Certificate URLs 6.4.5. Client Certificate URLs
RFC 6066 [RFC6066] allows to avoid sending client-side certificates RFC 6066 [RFC6066] allows to avoid sending client-side certificates
and uses URLs instead. This reduces the over-the-air transmission. and uses URLs instead. This reduces the over-the-air transmission.
Note that the TLS cached info extension does not provide any help Note that the TLS cached info extension does not provide any help
with caching client certificates. with caching client certificates.
TLS/DTLS clients MUST implement support for client certificate URLs TLS/DTLS clients MUST implement support for client certificate URLs
for those environments where client-side certificates are used and for those environments where client-side certificates are used and
the server-side is not constrained. For constrained servers this the server-side is not constrained. For constrained servers this
functionality is NOT RECOMMENDED since it forces the server to functionality is NOT RECOMMENDED since it forces the server to
execute an additional protocol exchange, potentially using a protocol execute an additional protocol exchange, potentially using a protocol
it does not even support. The use of this extension also increases it does not even support. The use of this extension also increases
the risk of a denial of service attack against the constrained server the risk of a denial of service attack against the constrained server
due to the additional workload. due to the additional workload.
6.3.6. Trusted CA Indication 6.4.6. Trusted CA Indication
RFC 6066 [RFC6066] allows clients to indicate what trust anchor they RFC 6066 [RFC6066] allows clients to indicate what trust anchor they
support. With certificate-based authentication a DTLS server conveys support. With certificate-based authentication a DTLS server conveys
its end entity certificate to the client during the DTLS exchange its end entity certificate to the client during the DTLS exchange
provides. Since the server does not necessarily know what trust provides. Since the server does not necessarily know what trust
anchors the client has stored and to facilitate certification path anchors the client has stored and to facilitate certification path
construction as well as path validation, it includes intermediate CA construction as well as path validation, it includes intermediate CA
certs in the certificate payload. certs in the certificate payload.
Today, in most IoT deployments there is a fairly static relationship Today, in most IoT deployments there is a fairly static relationship
skipping to change at page 29, line 25 skipping to change at page 31, line 25
7. Signature Algorithm Extension 7. Signature Algorithm Extension
The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of
RFC 5246 [RFC5246], allows the client to indicate to the server which RFC 5246 [RFC5246], allows the client to indicate to the server which
signature/hash algorithm pairs may be used in digital signatures. signature/hash algorithm pairs may be used in digital signatures.
The client MUST send this extension to select the use of SHA-256 The client MUST send this extension to select the use of SHA-256
since otherwise absent this extension RFC 5246 defaults to SHA-1 / since otherwise absent this extension RFC 5246 defaults to SHA-1 /
ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms. ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms.
The "signature_algorithms" extension is not applicable to the PSK- The "signature_algorithms" extension is not applicable to the PSK-
based ciphersuite described in Section 6.1. based ciphersuite described in Section 6.2.
8. Error Handling 8. Error Handling
TLS/DTLS uses the Alert protocol to convey errors and specifies a TLS/DTLS uses the Alert protocol to convey errors and specifies a
long list of error types. However, not all error messages defined in long list of error types. However, not all error messages defined in
the TLS/DTLS specification are applicable to this profile. In the TLS/DTLS specification are applicable to this profile. In
general, there are two categories of errors (as defined in general, there are two categories of errors (as defined in
Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert
messages with a level of fatal result in the immediate termination of messages with a level of fatal result in the immediate termination of
the connection. If possible, developers should try to develop the connection. If possible, developers should try to develop
skipping to change at page 30, line 50 skipping to change at page 32, line 50
one ciphersuite per profile but it is likely that additional one ciphersuite per profile but it is likely that additional
ciphersuites get added over time. ciphersuites get added over time.
user_canceled: Many IoT devices are unattended and hence this error user_canceled: Many IoT devices are unattended and hence this error
message is unlikely to occur. message is unlikely to occur.
9. Session Resumption 9. Session Resumption
Session resumption is a feature of the core TLS/DTLS specifications Session resumption is a feature of the core TLS/DTLS specifications
that allows a client to continue with an earlier established session that allows a client to continue with an earlier established session
state. The resulting exchange is shown in Figure 10. In addition, state. The resulting exchange is shown in Figure 11. In addition,
the server may choose not to do a cookie exchange when a session is the server may choose not to do a cookie exchange when a session is
resumed. Still, clients have to be prepared to do a cookie exchange resumed. Still, clients have to be prepared to do a cookie exchange
with every handshake. The cookie exchange is not shown in the with every handshake. The cookie exchange is not shown in the
figure. figure.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
ServerHello ServerHello
[ChangeCipherSpec] [ChangeCipherSpec]
<-------- Finished <-------- Finished
[ChangeCipherSpec] [ChangeCipherSpec]
Finished --------> Finished -------->
Application Data <-------> Application Data Application Data <-------> Application Data
Figure 10: DTLS Session Resumption. Figure 11: DTLS Session Resumption.
Constrained clients MUST implement session resumption to improve the Constrained clients MUST implement session resumption to improve the
performance of the handshake. This will lead to a reduced number of performance of the handshake. This will lead to a reduced number of
message exchanges, lower computational overhead (since only symmetric message exchanges, lower computational overhead (since only symmetric
cryptography is used during a session resumption exchange), and cryptography is used during a session resumption exchange), and
session resumption requires less bandwidth. session resumption requires less bandwidth.
For cases where the server constrained (but not the client) the For cases where the server constrained (but not the client) the
client MUST implement RFC 5077 [RFC5077]. Note that the constrained client MUST implement RFC 5077 [RFC5077]. Note that the constrained
server refers to a device that has limitations in terms of RAM and server refers to a device that has limitations in terms of RAM and
skipping to change at page 32, line 13 skipping to change at page 34, line 13
at the DTLS layer increases code size and complexity. at the DTLS layer increases code size and complexity.
This TLS/DTLS profile MUST NOT implement TLS/DTLS layer compression. This TLS/DTLS profile MUST NOT implement TLS/DTLS layer compression.
11. Perfect Forward Secrecy 11. Perfect Forward Secrecy
Perfect forward secrecy (PFS) is a property that preserves the Perfect forward secrecy (PFS) is a property that preserves the
confidentiality of past conversations even in situations where the confidentiality of past conversations even in situations where the
long-term secret is compromised. long-term secret is compromised.
The PSK ciphersuite recommended in Section 6.1 does not offer this The PSK ciphersuite recommended in Section 6.2 does not offer this
property since it does not utilize a Diffie-Hellman exchange. New property since it does not utilize a Diffie-Hellman exchange. New
ciphersuites that support PFS for PSK-based authentication, such as ciphersuites that support PFS for PSK-based authentication, such as
proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become
available as standardized ciphersuite in the (near) future. The available as standardized ciphersuite in the (near) future. The
recommended PSK-based ciphersuite offers excellent performance, a recommended PSK-based ciphersuite offers excellent performance, a
very small memory footprint, and has the lowest on the wire overhead very small memory footprint, and has the lowest on the wire overhead
at the expense of not using any public cryptography. For deployments at the expense of not using any public cryptography. For deployments
where public key cryptography is acceptable the raw public might where public key cryptography is acceptable the raw public might
offer an acceptable middle ground between the PSK ciphersuite in offer an acceptable middle ground between the PSK ciphersuite in
terms of out-of-band validation and the functionality offered by terms of out-of-band validation and the functionality offered by
skipping to change at page 34, line 41 skipping to change at page 36, line 41
of the handshake protocol). of the handshake protocol).
For server-initiated messages the heartbeat extension is RECOMMENDED. For server-initiated messages the heartbeat extension is RECOMMENDED.
13. Timeouts 13. Timeouts
To connect to the Internet a variety of wired and wireless To connect to the Internet a variety of wired and wireless
technologies are available. Many of the low power radio technologies are available. Many of the low power radio
technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support
small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as
explained in RFC 4919 [RFC4919]). Other radio technologies, such as explained in [RFC4919]). Other radio technologies, such as the
the Global System for Mobile Communications (GSM) using the short Global System for Mobile Communications (GSM) using the short
messaging service (SMS) have similar constraints in terms of payload messaging service (SMS) have similar constraints in terms of payload
sizes, such as 140 bytes without the optional segmentation and sizes, such as 140 bytes without the optional segmentation and
reassembly scheme known as Concatenated SMS, but show higher latency. reassembly scheme known as Concatenated SMS, but show higher latency.
The DTLS handshake protocol adds a fragmentation and reassembly The DTLS handshake protocol adds a fragmentation and reassembly
mechanism to the TLS handshake protocol since each DTLS record must mechanism to the TLS handshake protocol since each DTLS record must
fit within a single transport layer datagram, as described in fit within a single transport layer datagram, as described in
Section 4.2.3 of [RFC6347]. Since handshake messages are potentially Section 4.2.3 of [RFC6347]. Since handshake messages are potentially
bigger than the maximum record size, the mechanism fragments a bigger than the maximum record size, the mechanism fragments a
handshake message over a number of DTLS records, each of which can be handshake message over a number of DTLS records, each of which can be
transmitted separately. transmitted separately.
To deal with the unreliable message delivery provided by UDP, DTLS To deal with the unreliable message delivery provided by UDP, DTLS
adds timeouts and re-transmissions, as described in Section 4.2.4 of adds timeouts and re-transmissions, as described in Section 4.2.4 of
[RFC6347]. Although the timeout values are implementation specific, [RFC6347]. Although the timeout values are implementation specific,
recommendations are provided in Section 4.2.4.1 of [RFC6347], with an recommendations are provided in Section 4.2.4.1 of [RFC6347], with an
initial timer value of 1 second and doubled with at each initial timer value of 1 second and doubled with at each
retransmission up to no less than 60 seconds. Due to the nature of retransmission up to no less than 60 seconds.
some radio technologies, these values are too aggressive and lead to
spurious failures when messages in flight need longer.
Note: If a round-trip time estimator (such as proposed in TLS protocol steps can take longer due to higher processing time on
[I-D.bormann-core-cocoa]) is available in the protocol stack of the the constrained side. On the other hand, the way DTLS handles
device, it could be used to dynamically update the setting of the retransmission, which is per-flight instead of per-segment, tends to
retransmit timeout. interact poorly with low bandwidth networks.
Choosing appropriate timeout values is difficult with changing For these reasons, it's essential that the probability of a spurious
network conditions, and large variance in latency. This retransmit is minimized and, on timeout, the sending endpoint does
specification therefore RECOMMENDS an initial timer value of 10 not react too aggressively. The latter is particularly relevant when
seconds with exponential back off up to no less then 60 seconds. the WSN is temporarily congested: if lost packets are re-injected too
Appendix A provides additional normative text for carrying DTLS over quickly, congestion worsens.
SMS.
An initial timer value of 9 seconds with exponential back off up to
no less then 60 seconds is therefore RECOMMENDED.
This value is chosen big enough to absorb large latency variance due
to either slow computation on constrained endpoints or to intrinsic
network characteristics (e.g. GSM-SMS), as well as to produce a low
number of retransmission events and relax the pacing between them.
Its worst case wait time is the same as using 1s timeout (i.e. 63s),
while triggering less then half retransmissions (2 instead of 5).
In order to minimise the wake time during DTLS handshake, sleepy
nodes might decide to select a lower threshold, and consequently a
smaller initial timeout value. If this is the case, the
implementation MUST keep into account the considerations about
network stability described in this section.
14. Random Number Generation 14. Random Number Generation
The TLS/DTLS protocol requires random numbers to be available during The TLS/DTLS protocol requires random numbers to be available during
the protocol run. For example, during the ClientHello and the the protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie-Hellman exchange requires numbers. Also, the use of the Diffie-Hellman exchange requires
random numbers during the key pair generation. Special care has to random numbers during the key pair generation.
be taken when generating random numbers in embedded systems as many
entropy sources available on desktop operating systems or mobile
devices might be missing, as described in [Heninger]. Consequently,
if not enough time is given during system start time to fill the
entropy pool then the output might be predictable and repeatable, for
example leading to the same keys generated again and again.
It is important to note that sources contributing to the randomness It is important to note that sources contributing to the randomness
pool on laptops, or desktop PCs are not available on many IoT device, pool on laptops, or desktop PCs are not available on many IoT device,
such as mouse movement, timing of keystrokes, air turbulence on the such as mouse movement, timing of keystrokes, air turbulence on the
movement of hard drive heads, etc. Other sources have to be found or movement of hard drive heads, etc. Other sources have to be found or
dedicated hardware has to be added. dedicated hardware has to be added.
Lacking sources of randomness in an embedded system may lead to the
same keys generated again and again.
The ClientHello and the ServerHello messages contains the 'Random' The ClientHello and the ServerHello messages contains the 'Random'
structure, which has two components: gmt_unix_time and a sequence of structure, which has two components: gmt_unix_time and a sequence of
28 random bytes. gmt_unix_time holds the current time and date in 28 random bytes. gmt_unix_time holds the current time and date in
standard UNIX 32-bit format (seconds since the midnight starting Jan standard UNIX 32-bit format (seconds since the midnight starting Jan
1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues that the entire 1, 1970, GMT). Since many IoT devices do not have access to an
ClientHello.Random value (including gmt_unix_time) should be a accurate clock, it is RECOMMENDED to place a sequence of random bytes
sequence of random bits because of device fingerprinting privacy in the two components of the 'Random' structure when creating a
concerns. Since many IoT devices do not have access to an accurate ClientHello or ServerHello message and not to assume a structure when
clock, it is RECOMMENDED to follow the guidance outlined in receiving these payloads.
[I-D.mathewson-no-gmtunixtime] regarding the content of the
ClientHello.Random field. However, for the ServerHello.Random
structure it is RECOMMENDED to maintain the existing structure with
gmt_unix_time followed by a sequence of 28 random bytes since the
client can use the received time information to securely obtain time
information. For constrained servers it cannot be assumed that they
maintain accurate time information; these devices MUST include time
information in the Server.Random structure when they actually obtain
accurate time information that can be utilized by clients. Clients
MUST only use time information obtained from servers they trust and
the use of this approach has to be agreed out-of-band.
IoT devices using TLS/DTLS MUST offer ways to generate quality random When TLS is used with certificate-based authentication the
numbers using hardware-based random number generators. Note that availability of time information is needed to check the validity of a
these hardware-based random number generators do not necessarily need certificate. Higher-layer protocols may provide secure time
to be implemented inside the microcontroller itself but could be made information. The gmt_unix_time component of the ServerHello is not
available in dedicated crypto-chips as well. Guidelines and used for this purpose.
requirements for random number generation can be found in RFC 4086
[RFC4086] and in the NIST Special Publication 800-90a [SP800-90A]. IoT devices using TLS/DTLS must offer ways to generate quality random
numbers. There are various implementation choices for integrating a
hardware-based random number generator into a product: an
implementation inside the microcontroller itself is one option but
also dedicated crypto-chips are reasonable choices. The best choice
will depend on various factors outside the scope of this document.
Guidelines and requirements for random number generation can be found
in RFC 4086 [RFC4086] and in the NIST Special Publication 800-90a
[SP800-90A].
Chip manufacturers are highly encouraged to provide sufficient Chip manufacturers are highly encouraged to provide sufficient
documentation of their design for random number generators so that documentation of their design for random number generators so that
customers can have confidence about the quality of the generated customers can have confidence about the quality of the generated
random numbers. The confidence can be increased by providing random numbers. The confidence can be increased by providing
information about the procedures that have been used to verify the information about the procedures that have been used to verify the
randomness of numbers generated by the hardware modules. For randomness of numbers generated by the hardware modules. For
example, NIST Special Publication 800-22b [SP800-22b] describes example, NIST Special Publication 800-22b [SP800-22b] describes
statistical tests that can be used to verify random random number statistical tests that can be used to verify random random number
generators. generators.
skipping to change at page 39, line 38 skipping to change at page 42, line 4
21. Crypto Agility 21. Crypto Agility
This document recommends software and chip manufacturers to implement This document recommends software and chip manufacturers to implement
AES and the CCM mode of operation. This document references the CoAP AES and the CCM mode of operation. This document references the CoAP
recommended ciphersuite choices, which have been selected based on recommended ciphersuite choices, which have been selected based on
implementation and deployment experience from the IoT community. implementation and deployment experience from the IoT community.
Over time the preference for algorithms will, however, change. Not Over time the preference for algorithms will, however, change. Not
all components of a ciphersuite are likely to change at the same all components of a ciphersuite are likely to change at the same
speed. Changes are more likely expected for ciphers, the mode of speed. Changes are more likely expected for ciphers, the mode of
operation, and the hash algorithms. The recommended key lengths have operation, and the hash algorithms. The recommended key lengths have
to be adjusted over time. Some deployment environments will also be to be adjusted over time as well. Some deployment environments will
impacted by local regulation, which might dictate a certain cipher also be impacted by local regulation, which might dictate a certain
and key size. Ongoing discussions regarding the choice of specific algorithm and key size combination. Ongoing discussions regarding
ECC curves will also likely impact implementations. Note that this the choice of specific ECC curves will also likely impact
document does not recommend or mandate a specific ECC curve. implementations. Note that this document does not recommend or
mandate a specific ECC curve.
The following recommendations can be made to chip manufacturers: The following recommendations can be made to chip manufacturers:
o Make any AES hardware-based crypto implementation accessible to o Make any AES hardware-based crypto implementation accessible to
developers working on security implementations at higher layers. developers working on security implementations at higher layers in
Sometimes hardware implementations are added to microcontrollers the protocol stack. Sometimes hardware implementations are added
to offer support for functionality needed at the link layer and to microcontrollers to offer support for functionality needed at
are only available to the on-chip link layer protocol the link layer and are only available to the on-chip link layer
implementation. protocol implementation. Such a setup does not allow application
developers to re-use the hardware-based AES implementation.
o Provide flexibility for the use of the crypto function with future o Provide flexibility for the use of the crypto function with future
extensibility in mind. For example, making an AES-CCM extensibility in mind. For example, making an AES-CCM
implementation available to developers is a first step but such an implementation available to developers is a first step but such an
implementation may not be usable due to parameter differences implementation may not be usable due to parameter differences
between an AES-CCM implementations. AES-CCM in IEEE 802.15.4 and between an AES-CCM implementations. AES-CCM in IEEE 802.15.4 and
Bluetooth Smart uses a nonce length of 13-octets while DTLS uses a Bluetooth Smart uses a nonce length of 13-octets while DTLS uses a
nonce length of 12-octets. Hardware implementations of AES-CCM nonce length of 12-octets. Hardware implementations of AES-CCM
for IEEE 802.15.4 and Bluetooth Smart are therefore not re-usable for IEEE 802.15.4 and Bluetooth Smart are therefore not re-usable
by a DTLS stack. by a DTLS stack.
o Offer access to building blocks in addition (or as an alternative) o Offer access to building blocks in addition (or as an alternative)
to the complete functionality. For example, a chip manufacturer to the complete functionality. For example, a chip manufacturer
who gives developers access to the AES crypto function can use it who gives developers access to the AES crypto function can use it
to build an efficient AES-GCM implementations. Another example is to build an efficient AES-GCM implementations. Another example is
to make a special instruction available that increases the speed to make a special instruction available that increases the speed
of speed-up carryless multiplications. of speed-up carryless multiplications.
As a recommendation for developers and product architects we As a recommendation for developers and product architects we suggest
recommend that sufficient headroom is provided to allow an upgrade to that sufficient headroom is provided to allow an upgrade to a newer
a newer cryptographic algorithms over the lifetime of the product. cryptographic algorithms over the lifetime of the product. As an
As an example, while AES-CCM is recommended throughout this example, while AES-CCM is recommended throughout this specification
specification future products might use the ChaCha20 cipher in future products might use the ChaCha20 cipher in combination with the
combination with the Poly1305 authenticator [RFC7539]. The Poly1305 authenticator [RFC7539]. The assumption is made that a
assumption is made that a robust software update mechanism is robust software update mechanism is offered.
offered.
22. Key Length Recommendations 22. Key Length Recommendations
RFC 4492 [RFC4492] gives approximate comparable key sizes for RFC 4492 [RFC4492] gives approximate comparable key sizes for
symmetric- and asymmetric-key cryptosystems based on the best-known symmetric- and asymmetric-key cryptosystems based on the best-known
algorithms for attacking them. While other publications suggest algorithms for attacking them. While other publications suggest
slightly different numbers, such as [Keylength], the approximate slightly different numbers, such as [Keylength], the approximate
relationship still holds true. Figure 11 illustrates the comparable relationship still holds true. Figure 12 illustrates the comparable
key sizes in bits. key sizes in bits.
Symmetric | ECC | DH/DSA/RSA Symmetric | ECC | DH/DSA/RSA
------------+---------+------------- ------------+---------+-------------
80 | 163 | 1024 80 | 163 | 1024
112 | 233 | 2048 112 | 233 | 2048
128 | 283 | 3072 128 | 283 | 3072
192 | 409 | 7680 192 | 409 | 7680
256 | 571 | 15360 256 | 571 | 15360
Figure 11: Comparable Key Sizes (in bits) based on RFC 4492. Figure 12: Comparable Key Sizes (in bits) based on RFC 4492.
At the time of writing the key size recommendations for use with TLS- At the time of writing the key size recommendations for use with TLS-
based ciphers found in [RFC7525] recommend DH key lengths of at least based ciphers found in [RFC7525] recommend DH key lengths of at least
2048 bit, which corresponds to a 112-bit symmetric key and a 233 bit 2048 bit, which corresponds to a 112-bit symmetric key and a 233 bit
ECC key. These recommendations are roughly inline with those from ECC key. These recommendations are roughly inline with those from
other organizations, such as the National Institute of Standards and other organizations, such as the National Institute of Standards and
Technology (NIST) or the European Network and Information Security Technology (NIST) or the European Network and Information Security
Agency (ENISA). The authors of [ENISA-Report2013] add that a 80-bit Agency (ENISA). The authors of [ENISA-Report2013] add that a 80-bit
symmetric key is sufficient for legacy applications for the coming symmetric key is sufficient for legacy applications for the coming
years, but a 128-bit symmetric key is the minimum requirement for new years, but a 128-bit symmetric key is the minimum requirement for new
skipping to change at page 41, line 39 skipping to change at page 44, line 5
23. False Start 23. False Start
A full TLS handshake as specified in [RFC5246] requires two full A full TLS handshake as specified in [RFC5246] requires two full
protocol rounds (four flights) before the handshake is complete and protocol rounds (four flights) before the handshake is complete and
the protocol parties may begin to send application data. the protocol parties may begin to send application data.
An abbreviated handshake (resuming an earlier TLS session) is An abbreviated handshake (resuming an earlier TLS session) is
complete after three flights, thus adding just one round-trip time if complete after three flights, thus adding just one round-trip time if
the client sends application data first. the client sends application data first.
If the conditions outlined in [I-D.bmoeller-tls-falsestart] are met, If the conditions outlined in [I-D.ietf-tls-falsestart] are met,
application data can be transmitted when the sender has sent its own application data can be transmitted when the sender has sent its own
"ChangeCipherSpec" and "Finished" messages. This achieves an "ChangeCipherSpec" and "Finished" messages. This achieves an
improvement of one round-trip time for full handshakes if the client improvement of one round-trip time for full handshakes if the client
sends application data first, and for abbreviated handshakes if the sends application data first, and for abbreviated handshakes if the
server sends application data first. server sends application data first.
The conditions for using the TLS False Start mechanism are met by the The conditions for using the TLS False Start mechanism are met by the
public-key-based ciphersuites in this document. In summary, the public-key-based ciphersuites in this document. In summary, the
conditions are conditions are
skipping to change at page 42, line 24 skipping to change at page 44, line 38
The DTLS handshake exchange conveys various identifiers, which can be The DTLS handshake exchange conveys various identifiers, which can be
observed by an on-path eavesdropper. For example, the DTLS PSK observed by an on-path eavesdropper. For example, the DTLS PSK
exchange reveals the PSK identity, the supported extensions, the exchange reveals the PSK identity, the supported extensions, the
session id, algorithm parameters, etc. When session resumption is session id, algorithm parameters, etc. When session resumption is
used then individual TLS sessions can be correlated by an on-path used then individual TLS sessions can be correlated by an on-path
adversary. With many IoT deployments it is likely that keying adversary. With many IoT deployments it is likely that keying
material and their identifiers are persistent over a longer period of material and their identifiers are persistent over a longer period of
time due to the cost of updating software on these devices. time due to the cost of updating software on these devices.
User participation with many IoT deployments poses a challenge since User participation poses a challenge in many IoT deployments since
many of the IoT devices operate unattended, even though they will many of the IoT devices operate unattended, even though they are
initially be provisioned by a human. The ability to control data initially provisioned by a human. The ability to control data
sharing and to configure preference will have to be provided at a sharing and to configure preferences will have to be provided at a
system level rather than at the level of the DTLS exchange itself, system level rather than at the level of the DTLS exchange itself,
which is the scope of this document. Quite naturally, the use of which is the scope of this document. Quite naturally, the use of
DTLS with mutual authentication will allow a TLS server to collect DTLS with mutual authentication will allow a TLS server to collect
authentication information about the IoT device (likely over a long authentication information about the IoT device (likely over a long
period of time). While this strong form of authentication will period of time). While this strong form of authentication will
prevent mis-attribution, it also allows strong identification. prevent mis-attribution, it also allows strong identification.
Device-related data collection (e.g., sensor recordings) associated Device-related data collection (e.g., sensor recordings) associated
with other data type will prove to be truly useful but this extra with other data type will prove to be truly useful but this extra
data might include personal information about the owner of the device data might include personal information about the owner of the device
or data about the environment it senses. Consequently, the data or data about the environment it senses. Consequently, the data
stored on the server-side will be vulnerable to stored data stored on the server-side will be vulnerable to stored data
compromise. For the communication between the client and the server compromise. For the communication between the client and the server
this specification prevents eavesdroppers to gain access to the this specification prevents eavesdroppers to gain access to the
communication content. While the PSK-based ciphersuite does not communication content. While the PSK-based ciphersuite does not
provide PFS the asymmetric versions do. This prevents an adversary provide PFS the asymmetric versions do. This prevents an adversary
from obtaining past communication content when access to a long-term from obtaining past communication content when access to a long-term
secret has been gained. Note that no extra effort to make traffic secret has been gained. Note that no extra effort to make traffic
analysis more difficult is provided by the recommendations made in analysis more difficult is provided by the recommendations made in
this document. this document.
Note that the absence or presence of communication itself might
reveal information to an adversary. For example, a presence sensor
may initiate messaging when a person enters a building. While TLS/
DTLS would offer confidentiality protection of the transmitted
information it does not help to conceal all communication patterns.
Furthermore, the IP header, which is not protected by TLS/DTLS,
additionally reveals information about the other communication
endpoint. For applications where such privacy concerns exist
additional safeguards are required, such as injecting dummy traffic
and onion routing. A detailed treatment of such solutions is outside
the scope of this document and requires a system-level view.
25. Security Considerations 25. Security Considerations
This entire document is about security. This entire document is about security.
We would also like to point out that designing a software update We would also like to point out that designing a software update
mechanism into an IoT system is crucial to ensure that both mechanism into an IoT system is crucial to ensure that both
functionality can be enhanced and that potential vulnerabilities can functionality can be enhanced and that potential vulnerabilities can
be fixed. This software update mechanism is important for changing be fixed. This software update mechanism is important for changing
configuration information, for example, trust anchors and other configuration information, for example, trust anchors and other
keying related information. Such a suitable software update keying related information. Such a suitable software update
skipping to change at page 43, line 41 skipping to change at page 46, line 18
Finally, we would like to thank our area director (Stephen Farrell) Finally, we would like to thank our area director (Stephen Farrell)
and our working group chairs (Zach Shelby and Dorothy Gellert) for and our working group chairs (Zach Shelby and Dorothy Gellert) for
their support. their support.
28. References 28. References
28.1. Normative References 28.1. Normative References
[EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64)
REGISTRATION AUTHORITY", April 2010, REGISTRATION AUTHORITY", April 2010,
<http://standards.ieee.org/regauth/oui/tutorials/ <https://standards.ieee.org/regauth/oui/tutorials/
EUI64.html>. EUI64.html>.
[GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation [GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation
Partnership Project; Technical Specification Group Core Partnership Project; Technical Specification Group Core
Network and Terminals; Technical realization of the Short Network and Terminals; Technical realization of the Short
Message Service (SMS) (Release 7)", March 2007. Message Service (SMS) (Release 7)", March 2007.
[I-D.ietf-tls-cached-info] [I-D.ietf-tls-cached-info]
Santesson, S. and H. Tschofenig, "Transport Layer Security Santesson, S. and H. Tschofenig, "Transport Layer Security
(TLS) Cached Information Extension", draft-ietf-tls- (TLS) Cached Information Extension", draft-ietf-tls-
cached-info-19 (work in progress), March 2015. cached-info-19 (work in progress), March 2015.
[I-D.ietf-tls-session-hash] [I-D.ietf-tls-session-hash]
Bhargavan, K., Delignat-Lavaud, A., Pironti, A., Langley, Bhargavan, K., Delignat-Lavaud, A., Pironti, A., Langley,
A., and M. Ray, "Transport Layer Security (TLS) Session A., and M. Ray, "Transport Layer Security (TLS) Session
Hash and Extended Master Secret Extension", draft-ietf- Hash and Extended Master Secret Extension", draft-ietf-
tls-session-hash-05 (work in progress), April 2015. tls-session-hash-06 (work in progress), July 2015.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/
RFC2119, March 1997,
<http://www.rfc-editor.org/info/rfc2119>.
[RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites [RFC4279] Eronen, P., Ed. and H. Tschofenig, Ed., "Pre-Shared Key
for Transport Layer Security (TLS)", RFC 4279, December Ciphersuites for Transport Layer Security (TLS)", RFC
2005. 4279, DOI 10.17487/RFC4279, December 2005,
<http://www.rfc-editor.org/info/rfc4279>.
[RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security
(TLS) Protocol Version 1.2", RFC 5246, August 2008. (TLS) Protocol Version 1.2", RFC 5246, DOI 10.17487/
RFC5246, August 2008,
<http://www.rfc-editor.org/info/rfc5246>.
[RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov,
"Transport Layer Security (TLS) Renegotiation Indication "Transport Layer Security (TLS) Renegotiation Indication
Extension", RFC 5746, February 2010. Extension", RFC 5746, DOI 10.17487/RFC5746, February 2010,
<http://www.rfc-editor.org/info/rfc5746>.
[RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions: [RFC6066] Eastlake 3rd, D., "Transport Layer Security (TLS)
Extension Definitions", RFC 6066, January 2011. Extensions: Extension Definitions", RFC 6066, DOI
10.17487/RFC6066, January 2011,
<http://www.rfc-editor.org/info/rfc6066>.
[RFC6125] Saint-Andre, P. and J. Hodges, "Representation and [RFC6125] Saint-Andre, P. and J. Hodges, "Representation and
Verification of Domain-Based Application Service Identity Verification of Domain-Based Application Service Identity
within Internet Public Key Infrastructure Using X.509 within Internet Public Key Infrastructure Using X.509
(PKIX) Certificates in the Context of Transport Layer (PKIX) Certificates in the Context of Transport Layer
Security (TLS)", RFC 6125, March 2011. Security (TLS)", RFC 6125, DOI 10.17487/RFC6125, March
2011, <http://www.rfc-editor.org/info/rfc6125>.
[RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer
Security Version 1.2", RFC 6347, January 2012. Security Version 1.2", RFC 6347, DOI 10.17487/RFC6347,
January 2012, <http://www.rfc-editor.org/info/rfc6347>.
[RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport
Layer Security (TLS) and Datagram Transport Layer Security Layer Security (TLS) and Datagram Transport Layer Security
(DTLS) Heartbeat Extension", RFC 6520, February 2012. (DTLS) Heartbeat Extension", RFC 6520, DOI 10.17487/
RFC6520, February 2012,
<http://www.rfc-editor.org/info/rfc6520>.
[RFC7250] Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and [RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J.,
T. Kivinen, "Using Raw Public Keys in Transport Layer Weiler, S., and T. Kivinen, "Using Raw Public Keys in
Security (TLS) and Datagram Transport Layer Security Transport Layer Security (TLS) and Datagram Transport
(DTLS)", RFC 7250, June 2014. Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250,
June 2014, <http://www.rfc-editor.org/info/rfc7250>.
[RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- [RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES-
CCM Elliptic Curve Cryptography (ECC) Cipher Suites for CCM Elliptic Curve Cryptography (ECC) Cipher Suites for
TLS", RFC 7251, June 2014. TLS", RFC 7251, DOI 10.17487/RFC7251, June 2014,
<http://www.rfc-editor.org/info/rfc7251>.
[WAP-WDP] Wireless Application Protocol Forum, "Wireless Datagram [WAP-WDP] Wireless Application Protocol Forum, "Wireless Datagram
Protocol", June 2001. Protocol", June 2001.
28.2. Informative References 28.2. Informative References
[ACE-WG] IETF, "Authentication and Authorization for Constrained [ACE-WG] IETF, "Authentication and Authorization for Constrained
Environments (ace) Working Group", URL: Environments (ace) Working Group", URL:
https://datatracker.ietf.org/wg/ace/charter/, Jan 2015. https://datatracker.ietf.org/wg/ace/charter/, Jan 2015.
[AES] National Institute of Standards and Technology, "FIPS PUB [AES] National Institute of Standards and Technology, "FIPS PUB
197, Advanced Encryption Standard (AES)", 197, Advanced Encryption Standard (AES)",
http://www.iana.org/assignments/tls-parameters/ https://www.iana.org/assignments/tls-parameters/tls-
tls-parameters.xhtml#tls-parameters-4, November 2001. parameters.xhtml#tls-parameters-4, November 2001.
[CCM] National Institute of Standards and Technology, "Special [CCM] National Institute of Standards and Technology, "Special
Publication 800-38C, Recommendation for Block Cipher Modes Publication 800-38C, Recommendation for Block Cipher Modes
of Operation: The CCM Mode for Authentication and of Operation: The CCM Mode for Authentication and
Confidentiality", http://csrc.nist.gov/publications/ Confidentiality", http://csrc.nist.gov/publications/
nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf, May nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf, May
2004. 2004.
[ENISA-Report2013] [ENISA-Report2013]
ENISA, "Algorithms, Key Sizes and Parameters Report - ENISA, "Algorithms, Key Sizes and Parameters Report -
2013", http://www.enisa.europa.eu/activities/identity-and- 2013", https://www.enisa.europa.eu/activities/identity-
trust/library/deliverables/ and-trust/library/deliverables/algorithms-key-sizes-and-
algorithms-key-sizes-and-parameters-report, October 2013. parameters-report, October 2013.
[Heninger]
Heninger, N., Durumeric, Z., Wustrow, E., and A.
Halderman, "Mining Your Ps and Qs: Detection of Widespread
Weak Keys in Network Devices", 21st USENIX Security
Symposium,
https://www.usenix.org/conference/usenixsecurity12/
technical-sessions/presentation/heninger, 2012.
[HomeGateway] [HomeGateway]
Eggert, L., "An experimental study of home gateway Eggert, L., "An experimental study of home gateway
characteristics, In Proceedings of the '10th annual characteristics, In Proceedings of the '10th annual
conference on Internet measurement'", 2010. conference on Internet measurement'", 2010.
[I-D.bmoeller-tls-falsestart]
Langley, A., Modadugu, N., and B. Moeller, "Transport
Layer Security (TLS) False Start", draft-bmoeller-tls-
falsestart-01 (work in progress), November 2014.
[I-D.bormann-core-cocoa]
Bormann, C., Betzler, A., Gomez, C., and I. Demirkol,
"CoAP Simple Congestion Control/Advanced", draft-bormann-
core-cocoa-02 (work in progress), July 2014.
[I-D.ietf-core-resource-directory] [I-D.ietf-core-resource-directory]
Shelby, Z. and C. Bormann, "CoRE Resource Directory", Shelby, Z., Koster, M., Bormann, C., and P. Stok, "CoRE
draft-ietf-core-resource-directory-02 (work in progress), Resource Directory", draft-ietf-core-resource-directory-04
November 2014. (work in progress), July 2015.
[I-D.ietf-tls-falsestart]
Langley, A., Modadugu, N., and B. Moeller, "Transport
Layer Security (TLS) False Start", draft-ietf-tls-
falsestart-00 (work in progress), May 2015.
[I-D.ietf-tls-negotiated-dl-dhe] [I-D.ietf-tls-negotiated-dl-dhe]
Gillmor, D., "Negotiated Discrete Log Diffie-Hellman Gillmor, D., "Negotiated Discrete Log Diffie-Hellman
Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- Ephemeral Parameters for TLS", draft-ietf-tls-negotiated-
dl-dhe-00 (work in progress), July 2014. dl-dhe-00 (work in progress), July 2014.
[I-D.ietf-tls-sslv3-diediedie] [I-D.ietf-tls-sslv3-diediedie]
Barnes, R., Thomson, M., Pironti, A., and A. Langley, Barnes, R., Thomson, M., Pironti, A., and A. Langley,
"Deprecating Secure Sockets Layer Version 3.0", draft- "Deprecating Secure Sockets Layer Version 3.0", draft-
ietf-tls-sslv3-diediedie-03 (work in progress), April ietf-tls-sslv3-diediedie-03 (work in progress), April
2015. 2015.
[I-D.irtf-cfrg-curves] [I-D.irtf-cfrg-curves]
Langley, A. and R. Salz, "Elliptic Curves for Security", Langley, A. and R. Salz, "Elliptic Curves for Security",
draft-irtf-cfrg-curves-02 (work in progress), March 2015. draft-irtf-cfrg-curves-02 (work in progress), March 2015.
[I-D.josefsson-eddsa-ed25519]
Josefsson, S. and N. Moller, "EdDSA and Ed25519", draft-
josefsson-eddsa-ed25519-03 (work in progress), May 2015.
[I-D.mathewson-no-gmtunixtime]
Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in
TLS", draft-mathewson-no-gmtunixtime-00 (work in
progress), December 2013.
[I-D.schmertmann-dice-ccm-psk-pfs] [I-D.schmertmann-dice-ccm-psk-pfs]
Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher
Suites with Forward Secrecy for Transport Layer Security Suites with Forward Secrecy for Transport Layer Security
(TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in (TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in
progress), August 2014. progress), August 2014.
[IANA-TLS] [IANA-TLS]
IANA, "TLS Cipher Suite Registry", IANA, "TLS Cipher Suite Registry",
http://www.iana.org/assignments/tls-parameters/ https://www.iana.org/assignments/tls-parameters/tls-
tls-parameters.xhtml#tls-parameters-4, 2014. parameters.xhtml#tls-parameters-4, 2014.
[ImprintingSurvey] [ImprintingSurvey]
Chilton, E., "A Brief Survey of Imprinting Options for Chilton, E., "A Brief Survey of Imprinting Options for
Constrained Devices", URL: http://www.lix.polytechnique.fr Constrained Devices", URL: http://www.lix.polytechnique.fr
/hipercom/SmartObjectSecurity/papers/EricRescorla.pdf, /hipercom/SmartObjectSecurity/papers/EricRescorla.pdf,
March 2012. March 2012.
[Keylength] [Keylength]
Giry, D., "Cryptographic Key Length Recommendations", Giry, D., "Cryptographic Key Length Recommendations",
http://www.keylength.com, November 2014. http://www.keylength.com, November 2014.
[LWM2M] Open Mobile Alliance, "Lightweight Machine-to-Machine, [LWM2M] Open Mobile Alliance, "Lightweight Machine-to-Machine,
Technical Specification, Candidate Version 1.0", December Technical Specification, Candidate Version 1.0", December
2013. 2013.
[RFC1191] Mogul, J. and S. Deering, "Path MTU discovery", RFC 1191,
November 1990.
[RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery [RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery
for IP version 6", RFC 1981, August 1996. for IP version 6", RFC 1981, DOI 10.17487/RFC1981, August
1996, <http://www.rfc-editor.org/info/rfc1981>.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, February Hashing for Message Authentication", RFC 2104, DOI
1997. 10.17487/RFC2104, February 1997,
<http://www.rfc-editor.org/info/rfc2104>.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson, [RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)", RFC "Remote Authentication Dial In User Service (RADIUS)", RFC
2865, June 2000. 2865, DOI 10.17487/RFC2865, June 2000,
<http://www.rfc-editor.org/info/rfc2865>.
[RFC3610] Whiting, D., Housley, R., and N. Ferguson, "Counter with [RFC3610] Whiting, D., Housley, R., and N. Ferguson, "Counter with
CBC-MAC (CCM)", RFC 3610, September 2003. CBC-MAC (CCM)", RFC 3610, DOI 10.17487/RFC3610, September
2003, <http://www.rfc-editor.org/info/rfc3610>.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H. [RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and H.
Levkowetz, "Extensible Authentication Protocol (EAP)", RFC Levkowetz, Ed., "Extensible Authentication Protocol
3748, June 2004. (EAP)", RFC 3748, DOI 10.17487/RFC3748, June 2004,
<http://www.rfc-editor.org/info/rfc3748>.
[RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness [RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker,
Requirements for Security", BCP 106, RFC 4086, June 2005. "Randomness Requirements for Security", BCP 106, RFC 4086,
DOI 10.17487/RFC4086, June 2005,
<http://www.rfc-editor.org/info/rfc4086>.
[RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B.
Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites
for Transport Layer Security (TLS)", RFC 4492, May 2006. for Transport Layer Security (TLS)", RFC 4492, DOI
10.17487/RFC4492, May 2006,
<http://www.rfc-editor.org/info/rfc4492>.
[RFC4821] Mathis, M. and J. Heffner, "Packetization Layer Path MTU
Discovery", RFC 4821, DOI 10.17487/RFC4821, March 2007,
<http://www.rfc-editor.org/info/rfc4821>.
[RFC4919] Kushalnagar, N., Montenegro, G., and C. Schumacher, "IPv6 [RFC4919] Kushalnagar, N., Montenegro, G., and C. Schumacher, "IPv6
over Low-Power Wireless Personal Area Networks (6LoWPANs): over Low-Power Wireless Personal Area Networks (6LoWPANs):
Overview, Assumptions, Problem Statement, and Goals", RFC Overview, Assumptions, Problem Statement, and Goals", RFC
4919, August 2007. 4919, DOI 10.17487/RFC4919, August 2007,
<http://www.rfc-editor.org/info/rfc4919>.
[RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig,
"Transport Layer Security (TLS) Session Resumption without "Transport Layer Security (TLS) Session Resumption without
Server-Side State", RFC 5077, January 2008. Server-Side State", RFC 5077, DOI 10.17487/RFC5077,
January 2008, <http://www.rfc-editor.org/info/rfc5077>.
[RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated
Encryption", RFC 5116, January 2008. Encryption", RFC 5116, DOI 10.17487/RFC5116, January 2008,
<http://www.rfc-editor.org/info/rfc5116>.
[RFC5216] Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS [RFC5216] Simon, D., Aboba, B., and R. Hurst, "The EAP-TLS
Authentication Protocol", RFC 5216, March 2008. Authentication Protocol", RFC 5216, DOI 10.17487/RFC5216,
March 2008, <http://www.rfc-editor.org/info/rfc5216>.
[RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible [RFC5247] Aboba, B., Simon, D., and P. Eronen, "Extensible
Authentication Protocol (EAP) Key Management Framework", Authentication Protocol (EAP) Key Management Framework",
RFC 5247, August 2008. RFC 5247, DOI 10.17487/RFC5247, August 2008,
<http://www.rfc-editor.org/info/rfc5247>.
[RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S.,
Housley, R., and W. Polk, "Internet X.509 Public Key Housley, R., and W. Polk, "Internet X.509 Public Key
Infrastructure Certificate and Certificate Revocation List Infrastructure Certificate and Certificate Revocation List
(CRL) Profile", RFC 5280, May 2008. (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008,
<http://www.rfc-editor.org/info/rfc5280>.
[RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois [RFC5288] Salowey, J., Choudhury, A., and D. McGrew, "AES Galois
Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, Counter Mode (GCM) Cipher Suites for TLS", RFC 5288, DOI
August 2008. 10.17487/RFC5288, August 2008,
<http://www.rfc-editor.org/info/rfc5288>.
[RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk, [RFC5480] Turner, S., Brown, D., Yiu, K., Housley, R., and T. Polk,
"Elliptic Curve Cryptography Subject Public Key "Elliptic Curve Cryptography Subject Public Key
Information", RFC 5480, March 2009. Information", RFC 5480, DOI 10.17487/RFC5480, March 2009,
<http://www.rfc-editor.org/info/rfc5480>.
[RFC5758] Dang, Q., Santesson, S., Moriarty, K., Brown, D., and T. [RFC5758] Dang, Q., Santesson, S., Moriarty, K., Brown, D., and T.
Polk, "Internet X.509 Public Key Infrastructure: Polk, "Internet X.509 Public Key Infrastructure:
Additional Algorithms and Identifiers for DSA and ECDSA", Additional Algorithms and Identifiers for DSA and ECDSA",
RFC 5758, January 2010. RFC 5758, DOI 10.17487/RFC5758, January 2010,
<http://www.rfc-editor.org/info/rfc5758>.
[RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor
Management Protocol (TAMP)", RFC 5934, August 2010. Management Protocol (TAMP)", RFC 5934, DOI 10.17487/
RFC5934, August 2010,
<http://www.rfc-editor.org/info/rfc5934>.
[RFC6024] Reddy, R. and C. Wallace, "Trust Anchor Management [RFC6024] Reddy, R. and C. Wallace, "Trust Anchor Management
Requirements", RFC 6024, October 2010. Requirements", RFC 6024, DOI 10.17487/RFC6024, October
2010, <http://www.rfc-editor.org/info/rfc6024>.
[RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic
Curve Cryptography Algorithms", RFC 6090, February 2011. Curve Cryptography Algorithms", RFC 6090, DOI 10.17487/
RFC6090, February 2011,
<http://www.rfc-editor.org/info/rfc6090>.
[RFC6234] Eastlake, D. and T. Hansen, "US Secure Hash Algorithms [RFC6234] Eastlake 3rd, D. and T. Hansen, "US Secure Hash Algorithms
(SHA and SHA-based HMAC and HKDF)", RFC 6234, May 2011. (SHA and SHA-based HMAC and HKDF)", RFC 6234, DOI
10.17487/RFC6234, May 2011,
<http://www.rfc-editor.org/info/rfc6234>.
[RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for
Transport Layer Security (TLS)", RFC 6655, July 2012. Transport Layer Security (TLS)", RFC 6655, DOI 10.17487/
RFC6655, July 2012,
<http://www.rfc-editor.org/info/rfc6655>.
[RFC6690] Shelby, Z., "Constrained RESTful Environments (CoRE) Link [RFC6690] Shelby, Z., "Constrained RESTful Environments (CoRE) Link
Format", RFC 6690, August 2012. Format", RFC 6690, DOI 10.17487/RFC6690, August 2012,
<http://www.rfc-editor.org/info/rfc6690>.
[RFC6733] Fajardo, V., Arkko, J., Loughney, J., and G. Zorn, [RFC6733] Fajardo, V., Ed., Arkko, J., Loughney, J., and G. Zorn,
"Diameter Base Protocol", RFC 6733, October 2012. Ed., "Diameter Base Protocol", RFC 6733, DOI 10.17487/
RFC6733, October 2012,
<http://www.rfc-editor.org/info/rfc6733>.
[RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS)
Multiple Certificate Status Request Extension", RFC 6961, Multiple Certificate Status Request Extension", RFC 6961,
June 2013. DOI 10.17487/RFC6961, June 2013,
<http://www.rfc-editor.org/info/rfc6961>.
[RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for [RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for
Constrained-Node Networks", RFC 7228, May 2014. Constrained-Node Networks", RFC 7228, DOI 10.17487/
RFC7228, May 2014,
<http://www.rfc-editor.org/info/rfc7228>.
[RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained
Application Protocol (CoAP)", RFC 7252, June 2014. Application Protocol (CoAP)", RFC 7252, DOI 10.17487/
RFC7252, June 2014,
<http://www.rfc-editor.org/info/rfc7252>.
[RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an
Attack", BCP 188, RFC 7258, May 2014. Attack", BCP 188, RFC 7258, DOI 10.17487/RFC7258, May
2014, <http://www.rfc-editor.org/info/rfc7258>.
[RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer [RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer
Security (TLS) and Datagram Transport Layer Security Security (TLS) and Datagram Transport Layer Security
(DTLS)", RFC 7366, September 2014. (DTLS)", RFC 7366, DOI 10.17487/RFC7366, September 2014,
<http://www.rfc-editor.org/info/rfc7366>.
[RFC7390] Rahman, A. and E. Dijk, "Group Communication for the [RFC7390] Rahman, A., Ed. and E. Dijk, Ed., "Group Communication for
Constrained Application Protocol (CoAP)", RFC 7390, the Constrained Application Protocol (CoAP)", RFC 7390,
October 2014. DOI 10.17487/RFC7390, October 2014,
<http://www.rfc-editor.org/info/rfc7390>.
[RFC7397] Gilger, J. and H. Tschofenig, "Report from the Smart [RFC7397] Gilger, J. and H. Tschofenig, "Report from the Smart
Object Security Workshop", RFC 7397, December 2014. Object Security Workshop", RFC 7397, DOI 10.17487/RFC7397,
December 2014, <http://www.rfc-editor.org/info/rfc7397>.
[RFC7400] Bormann, C., "6LoWPAN-GHC: Generic Header Compression for [RFC7400] Bormann, C., "6LoWPAN-GHC: Generic Header Compression for
IPv6 over Low-Power Wireless Personal Area Networks IPv6 over Low-Power Wireless Personal Area Networks
(6LoWPANs)", RFC 7400, November 2014. (6LoWPANs)", RFC 7400, DOI 10.17487/RFC7400, November
2014, <http://www.rfc-editor.org/info/rfc7400>.
[RFC7452] Tschofenig, H., Arkko, J., Thaler, D., and D. McPherson, [RFC7452] Tschofenig, H., Arkko, J., Thaler, D., and D. McPherson,
"Architectural Considerations in Smart Object Networking", "Architectural Considerations in Smart Object Networking",
RFC 7452, March 2015. RFC 7452, DOI 10.17487/RFC7452, March 2015,
<http://www.rfc-editor.org/info/rfc7452>.
[RFC7465] Popov, A., "Prohibiting RC4 Cipher Suites", RFC 7465, [RFC7465] Popov, A., "Prohibiting RC4 Cipher Suites", RFC 7465, DOI
February 2015. 10.17487/RFC7465, February 2015,
<http://www.rfc-editor.org/info/rfc7465>.
[RFC7507] Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher [RFC7507] Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher
Suite Value (SCSV) for Preventing Protocol Downgrade Suite Value (SCSV) for Preventing Protocol Downgrade
Attacks", RFC 7507, April 2015. Attacks", RFC 7507, DOI 10.17487/RFC7507, April 2015,
<http://www.rfc-editor.org/info/rfc7507>.
[RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre, [RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of Transport Layer "Recommendations for Secure Use of Transport Layer
Security (TLS) and Datagram Transport Layer Security Security (TLS) and Datagram Transport Layer Security
(DTLS)", BCP 195, RFC 7525, May 2015. (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
2015, <http://www.rfc-editor.org/info/rfc7525>.
[RFC7539] Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF [RFC7539] Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF
Protocols", RFC 7539, May 2015. Protocols", RFC 7539, DOI 10.17487/RFC7539, May 2015,
<http://www.rfc-editor.org/info/rfc7539>.
[SP800-107-rev1]
NIST, "NIST Special Publication 800-107, Revision 1,
Recommendation for Applications Using Approved Hash
Algorithms", http://csrc.nist.gov/publications/
nistpubs/800-107-rev1/sp800-107-rev1.pdf, August 2012.
[SP800-22b] [SP800-22b]
National Institute of Standards and Technology, "Special National Institute of Standards and Technology, "Special
Publication 800-22, Revision 1a, A Statistical Test Suite Publication 800-22, Revision 1a, A Statistical Test Suite
for Random and Pseudorandom Number Generators for for Random and Pseudorandom Number Generators for
Cryptographic Applications", Cryptographic Applications",
http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/ http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/
SP800-22rev1a.pdf, April 2010. SP800-22rev1a.pdf, April 2010.
[SP800-90A] [SP800-90A]
skipping to change at page 52, line 25 skipping to change at page 55, line 44
If the DTLS server allows more than one client to be active at any If the DTLS server allows more than one client to be active at any
given time, then the WAP User Datagram Protocol [WAP-WDP] can be used given time, then the WAP User Datagram Protocol [WAP-WDP] can be used
to achieve multiplexing of the different security associations. (The to achieve multiplexing of the different security associations. (The
use of WDP provides the additional benefit that upper layer protocols use of WDP provides the additional benefit that upper layer protocols
can operate independently of the underlying wireless network, hence can operate independently of the underlying wireless network, hence
achieving application-agnostic transport handover.) achieving application-agnostic transport handover.)
The total overhead cost for encoding the WDP source and destination The total overhead cost for encoding the WDP source and destination
ports is either 5 or 7 bytes out of the total available for the SMS ports is either 5 or 7 bytes out of the total available for the SMS
content depending on if 1-byte or 2-byte port identifiers are used, content depending on if 1-byte or 2-byte port identifiers are used,
as shown in Figure 12 and Figure 13. as shown in Figure 13 and Figure 14.
0 1 2 3 4 0 1 2 3 4
+--------+--------+--------+--------+--------+ +--------+--------+--------+--------+--------+
| ... | 0x04 | 2 | ... | ... | | ... | 0x04 | 2 | ... | ... |
+--------+--------+--------+--------+--------+ +--------+--------+--------+--------+--------+
UDH IEI IE Dest Source UDH IEI IE Dest Source
Length Length Port Port Length Length Port Port
Figure 12: Application Port Addressing Scheme (8 bit address). Figure 13: Application Port Addressing Scheme (8 bit address).
0 1 2 3 4 5 6 0 1 2 3 4 5 6
+--------+--------+--------+--------+--------+--------+--------+ +--------+--------+--------+--------+--------+--------+--------+
| ... | 0x05 | 4 | ... | ... | | ... | 0x05 | 4 | ... | ... |
+--------+--------+--------+--------+--------+--------+--------+ +--------+--------+--------+--------+--------+--------+--------+
UDH IEI IE Dest Source UDH IEI IE Dest Source
Length Length Port Port Length Length Port Port
Figure 13: Application Port Addressing Scheme (16 bit address). Figure 14: Application Port Addressing Scheme (16 bit address).
The receiving side of the communication gets the source address from The receiving side of the communication gets the source address from
the originator address (TP-OA) field of the SMS-DELIVER TPDU. This the originator address (TP-OA) field of the SMS-DELIVER TPDU. This
way an unique 4-tuple identifying the security association can be way an unique 4-tuple identifying the security association can be
reconstructed at both ends. (When replying to its DTLS peer, the reconstructed at both ends. (When replying to its DTLS peer, the
sender will swaps the TP-OA and TP-DA parameters and the source and sender will swaps the TP-OA and TP-DA parameters and the source and
destination ports in the WDP.) destination ports in the WDP.)
A.4. Timeout A.4. Timeout
skipping to change at page 53, line 25 skipping to change at page 56, line 47
Handshake messages MUST carry a validity period (TP-VP parameter in a Handshake messages MUST carry a validity period (TP-VP parameter in a
SMS-SUBMIT TPDU) that is not less than the current value of the SMS-SUBMIT TPDU) that is not less than the current value of the
retransmission timeout. In order to avoid persisting messages in the retransmission timeout. In order to avoid persisting messages in the
network that will be discarded by the receiving party, handshake network that will be discarded by the receiving party, handshake
messages SHOULD carry a validity period that is the same as, or just messages SHOULD carry a validity period that is the same as, or just
slightly higher than, the current value of the retransmission slightly higher than, the current value of the retransmission
timeout. timeout.
Appendix B. DTLS Record Layer Per-Packet Overhead Appendix B. DTLS Record Layer Per-Packet Overhead
Figure 14 shows the overhead for the DTLS record layer for protecting Figure 15 shows the overhead for the DTLS record layer for protecting
data traffic when AES-128-CCM with an 8-octet Integrity Check Value data traffic when AES-128-CCM with an 8-octet Integrity Check Value
(ICV) is used. (ICV) is used.
DTLS Record Layer Header................13 bytes DTLS Record Layer Header................13 bytes
Nonce (Explicit).........................8 bytes Nonce (Explicit).........................8 bytes
ICV..................................... 8 bytes ICV..................................... 8 bytes
------------------------------------------------ ------------------------------------------------
Overhead................................29 bytes Overhead................................29 bytes
------------------------------------------------ ------------------------------------------------
Figure 14: AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead. Figure 15: AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead.
The DTLS record layer header has 13 octets and consists of The DTLS record layer header has 13 octets and consists of
o 1 octet content type field, o 1 octet content type field,
o 2 octet version field, o 2 octet version field,
o 2 octet epoch field, o 2 octet epoch field,
o 6 octet sequence number, o 6 octet sequence number,
skipping to change at page 54, line 31 skipping to change at page 58, line 7
To avoid this 8-byte duplication RFC 7400 [RFC7400] provides help To avoid this 8-byte duplication RFC 7400 [RFC7400] provides help
with the use of the generic header compression technique for IPv6 with the use of the generic header compression technique for IPv6
over Low-Power Wireless Personal Area Networks (6LoWPANs). Note over Low-Power Wireless Personal Area Networks (6LoWPANs). Note
that this header compression technique is not available when DTLS that this header compression technique is not available when DTLS
is exchanged over transports that do not use IPv6 or 6LoWPAN, such is exchanged over transports that do not use IPv6 or 6LoWPAN, such
as the SMS transport described in Appendix A. as the SMS transport described in Appendix A.
Appendix C. DTLS Fragmentation Appendix C. DTLS Fragmentation
[Editor's Note: Proposed text that requires discussion. ]
Section 4.2.3 of [RFC6347] advises DTLS implementations to not Section 4.2.3 of [RFC6347] advises DTLS implementations to not
produce overlapping fragments, but requires receivers to be able to produce overlapping fragments. However, it requires receivers to be
cope with them. The need for the latter requisite is explained in able to cope with them. The need for the latter requisite is
Section 4.1.1.1 of [RFC6347]: accurate path MTU (PMTU) estimation may explained in Section 4.1.1.1 of [RFC6347]: accurate path MTU (PMTU)
be traded for shorter handshake completion time. This approach may estimation may be traded for shorter handshake completion time.
be beneficial in unconstrained networks where a PMTU of 1280 bytes
can be pretty much universally assumed. However, an handshake that In many cases, the cost of handling fragment overlaps has proved to
is carried over a narrow-band radio technology, such as IEEE be unaffordable for constrained implementations, particularly because
802.15.4, Bluetooth Smart or GSM-SMS, and the client is lacking of the increased complexity in buffer management.
reliable PMTU data to inform fragmentation (e.g., using [RFC1981] or
[RFC1191]) can place a cost on the constrained implementation in
terms of memory (due to re-buffering) and latency (due to re-
transmission) much higher than the benefit that it would get from a
shorter handshake.
In order to reduce the likelihood of producing different fragment In order to reduce the likelihood of producing different fragment
sizes (and consequent overlaps) within the same handshake, this sizes and consequent overlaps within the same handshake, this
document RECOMMENDs: document RECOMMENDs:
o for clients (handshake initiators), to perform PMTU discovery o clients (handshake initiators) to use reliable PMTU information
towards the server before handshake starts, and not rely on any for the intended destination;
guesses (unless the network path characteristics are reliably
known from another source);
o for servers, to mirror the fragment size selected by their o servers to mirror the fragment size selected by their clients.
clients.
The PMTU information comes either from a "fresh enough" discovery
performed by the client ([RFC1981], [RFC4821]), or from some other
reliable out-of-band channel.
Authors' Addresses Authors' Addresses
Hannes Tschofenig (editor) Hannes Tschofenig (editor)
ARM Ltd. ARM Ltd.
110 Fulbourn Rd 110 Fulbourn Rd
Cambridge CB1 9NJ Cambridge CB1 9NJ
Great Britain Great Britain
Email: Hannes.tschofenig@gmx.net Email: Hannes.tschofenig@gmx.net
 End of changes. 135 change blocks. 
343 lines changed or deleted 485 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/