< draft-ietf-dice-profile-14.txt   draft-ietf-dice-profile-15.txt >
dice H. Tschofenig, Ed. dice H. Tschofenig, Ed.
Internet-Draft ARM Ltd. Internet-Draft ARM Ltd.
Intended status: Standards Track T. Fossati Intended status: Standards Track T. Fossati
Expires: February 18, 2016 Alcatel-Lucent Expires: March 12, 2016 Alcatel-Lucent
August 17, 2015 September 9, 2015
TLS/DTLS Profiles for the Internet of Things TLS/DTLS Profiles for the Internet of Things
draft-ietf-dice-profile-14.txt draft-ietf-dice-profile-15.txt
Abstract Abstract
A common design pattern in Internet of Things (IoT) deployments is A common design pattern in Internet of Things (IoT) deployments is
the use of a constrained device that collects data via sensor or the use of a constrained device that collects data via sensors or
controls actuators for use in home automation, industrial control controls actuators for use in home automation, industrial control
systems, smart cities and other IoT deployments. systems, smart cities and other IoT deployments.
This document defines a Transport Layer Security (TLS) and Datagram This document defines a Transport Layer Security (TLS) and Datagram
TLS (DTLS) 1.2 profile that offers communications security for this TLS (DTLS) 1.2 profile that offers communications security for this
data exchange thereby preventing eavesdropping, tampering, and data exchange thereby preventing eavesdropping, tampering, and
message forgery. The lack of communication security is a common message forgery. The lack of communication security is a common
vulnerability in Internet of Things products that can easily be vulnerability in Internet of Things products that can easily be
solved by using these well-researched and widely deployed Internet solved by using these well-researched and widely deployed Internet
security protocols. security protocols.
skipping to change at page 1, line 42 skipping to change at page 1, line 42
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on February 18, 2016. This Internet-Draft will expire on March 12, 2016.
Copyright Notice Copyright Notice
Copyright (c) 2015 IETF Trust and the persons identified as the Copyright (c) 2015 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. TLS/DTLS Protocol Overview . . . . . . . . . . . . . . . . . 4 3. Overview . . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Communication Models . . . . . . . . . . . . . . . . . . . . 5 3.1. TLS and DTLS . . . . . . . . . . . . . . . . . . . . . . 4
4.1. Constrained TLS/DTLS Clients . . . . . . . . . . . . . . 6 3.2. Communication Models . . . . . . . . . . . . . . . . . . 5
4.2. Constrained TLS/DTLS Servers . . . . . . . . . . . . . . 13 3.3. The Ciphersuite Concept . . . . . . . . . . . . . . . . . 18
5. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 18 4. Credential Types . . . . . . . . . . . . . . . . . . . . . . 20
6. Credential Types . . . . . . . . . . . . . . . . . . . . . . 20 4.1. Pre-Conditions . . . . . . . . . . . . . . . . . . . . . 20
6.1. Pre-Conditions . . . . . . . . . . . . . . . . . . . . . 20 4.2. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 21
6.2. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 21 4.3. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 24
6.3. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 24 4.4. Certificates . . . . . . . . . . . . . . . . . . . . . . 25
6.4. Certificates . . . . . . . . . . . . . . . . . . . . . . 25 5. Signature Algorithm Extension . . . . . . . . . . . . . . . . 31
7. Signature Algorithm Extension . . . . . . . . . . . . . . . . 31 6. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 31
8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 31 7. Session Resumption . . . . . . . . . . . . . . . . . . . . . 32
9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 32 8. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 33
10. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 33 9. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 34
11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 34 10. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 34
12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 34 11. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 36
13. Timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . 36 12. Random Number Generation . . . . . . . . . . . . . . . . . . 37
14. Random Number Generation . . . . . . . . . . . . . . . . . . 37 13. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 38
15. Truncated MAC and Encrypt-then-MAC Extension . . . . . . . . 38 14. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 39
16. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 39 15. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 39
17. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 39 16. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 39
18. Session Hash . . . . . . . . . . . . . . . . . . . . . . . . 40 17. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 40
19. Re-Negotiation Attacks . . . . . . . . . . . . . . . . . . . 40 18. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 40
20. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . . 41 19. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 41
21. Crypto Agility . . . . . . . . . . . . . . . . . . . . . . . 41 20. Key Length Recommendations . . . . . . . . . . . . . . . . . 42
22. Key Length Recommendations . . . . . . . . . . . . . . . . . 42 21. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 43
23. False Start . . . . . . . . . . . . . . . . . . . . . . . . . 43 22. Privacy Considerations . . . . . . . . . . . . . . . . . . . 44
24. Privacy Considerations . . . . . . . . . . . . . . . . . . . 44 23. Security Considerations . . . . . . . . . . . . . . . . . . . 45
25. Security Considerations . . . . . . . . . . . . . . . . . . . 45 24. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 45
26. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 45 25. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 45
27. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 45 26. References . . . . . . . . . . . . . . . . . . . . . . . . . 46
28. References . . . . . . . . . . . . . . . . . . . . . . . . . 46 26.1. Normative References . . . . . . . . . . . . . . . . . . 46
28.1. Normative References . . . . . . . . . . . . . . . . . . 46 26.2. Informative References . . . . . . . . . . . . . . . . . 47
28.2. Informative References . . . . . . . . . . . . . . . . . 47 Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 54
Appendix A. Conveying DTLS over SMS . . . . . . . . . . . . . . 53
A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 54 A.1. Overview . . . . . . . . . . . . . . . . . . . . . . . . 54
A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 54 A.2. Message Segmentation and Re-Assembly . . . . . . . . . . 55
A.3. Multiplexing Security Associations . . . . . . . . . . . 55 A.3. Multiplexing Security Associations . . . . . . . . . . . 55
A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 56 A.4. Timeout . . . . . . . . . . . . . . . . . . . . . . . . . 56
Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 56 Appendix B. DTLS Record Layer Per-Packet Overhead . . . . . . . 57
Appendix C. DTLS Fragmentation . . . . . . . . . . . . . . . . . 58 Appendix C. DTLS Fragmentation . . . . . . . . . . . . . . . . . 58
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 58 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 58
1. Introduction 1. Introduction
An engineer developing an Internet of Things (IoT) device needs to An engineer developing an Internet of Things (IoT) device needs to
investigate the security threats and decide about the security investigate the security threats and decide about the security
services that can be used to mitigate these threats. services that can be used to mitigate these threats.
Enabling IoT devices to exchange data often requires authentication Enabling IoT devices to exchange data often requires authentication
skipping to change at page 3, line 32 skipping to change at page 3, line 30
confidentiality-protection of exchanged data. While these security confidentiality-protection of exchanged data. While these security
services can be provided at different layers in the protocol stack, services can be provided at different layers in the protocol stack,
the use of Transport Layer Security (TLS)/Datagram TLS (DTLS) has the use of Transport Layer Security (TLS)/Datagram TLS (DTLS) has
been very popular with many application protocols and it is likely to been very popular with many application protocols and it is likely to
be useful for IoT scenarios as well. be useful for IoT scenarios as well.
Fitting Internet protocols into constrained devices can be difficult Fitting Internet protocols into constrained devices can be difficult
but thanks to the standardization efforts new profiles and protocols but thanks to the standardization efforts new profiles and protocols
are available, such as the Constrained Application Protocol (CoAP) are available, such as the Constrained Application Protocol (CoAP)
[RFC7252]. UDP is mainly used to carry CoAP messages but other [RFC7252]. UDP is mainly used to carry CoAP messages but other
transports can be utilized, such as SMS or even TCP. transports can be utilized, such as SMS Appendix A or TCP
[I-D.tschofenig-core-coap-tcp-tls].
While the main goal for this document is to protect CoAP messages While the main goal for this document is to protect CoAP messages
using DTLS 1.2 [RFC6347] the information contained in the following using DTLS 1.2 [RFC6347], the information contained in the following
sections is not limited to CoAP nor to DTLS itself. sections is not limited to CoAP nor to DTLS itself.
Instead, this document defines a profile of DTLS 1.2 [RFC6347] and Instead, this document defines a profile of DTLS 1.2 [RFC6347] and
TLS 1.2 [RFC5246] that offers communication security services for IoT TLS 1.2 [RFC5246] that offers communication security services for IoT
applications and is reasonably implementable on many constrained applications and is reasonably implementable on many constrained
devices. Profile thereby means that available configuration options devices. Profile thereby means that available configuration options
and protocol extensions are utilized to best support the IoT and protocol extensions are utilized to best support the IoT
environment. This document does not alter TLS/DTLS specifications environment. This document does not alter TLS/DTLS specifications
and does not introduce any new TLS/DTLS extension. and does not introduce any new TLS/DTLS extension.
The main target audience for this document is the embedded system The main target audience for this document is the embedded system
developer configuring and using a TLS/DTLS stack. This document may, developer configuring and using a TLS/DTLS stack. This document may,
however, also help those developing or selecting a suitable TLS/DTLS however, also help those developing or selecting a suitable TLS/DTLS
stack for an Internet of Things product. If you are familiar with stack for an Internet of Things product. If you are familiar with
(D)TLS, then skip ahead to Section 6. (D)TLS, then skip ahead to Section 4.
2. Terminology 2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
This specification refers to TLS as well as DTLS and particularly to This specification refers to TLS as well as DTLS and particularly to
version 1.2, which is the most recent version at the time of writing. version 1.2, which is the most recent version at the time of writing.
We refer to TLS/DTLS whenever the text is applicable to both versions We refer to TLS/DTLS whenever the text is applicable to both versions
of the protocol and to TLS or DTLS when there are differences between of the protocol and to TLS or DTLS when there are differences between
the two protocols. Note that TLS 1.3 is being developed but it is the two protocols. Note that TLS 1.3 is being developed but it is
not expected that this profile will "just work" due to the not expected that this profile will "just work" due to the
significant changes being done to TLS for version 1.3. significant changes being done to TLS for version 1.3.
Note that "Client" and "Server" in this document refer to TLS/DTLS Note that "Client" and "Server" in this document refer to TLS/DTLS
roles, where the client initiates the handshake. This does not roles, where the client initiates the handshake. This does not
restrict the interaction pattern of the protocols on top of DTLS restrict the interaction pattern of the protocols on top of DTLS
since the record layer allows bi-directional communication. This since the record layer allows bi-directional communication. This
aspect is further described in Section 4. aspect is further described in Section 3.2.
RFC 7228 [RFC7228] introduces the notion of constrained-node RFC 7228 [RFC7228] introduces the notion of constrained-node
networks, which are made of small devices with severe constraints on networks, which are made of small devices with severe constraints on
power, memory, and processing resources. The terms constrained power, memory, and processing resources. The terms constrained
devices, and Internet of Things (IoT) devices are used devices, and Internet of Things (IoT) devices are used
interchangeably. interchangeably.
The terms "Certification Authority" (CA) and "Distinguished Name" The terms "Certification Authority" (CA) and "Distinguished Name"
(DN) are taken from [RFC5280]. The terms "trust anchor" and "trust (DN) are taken from [RFC5280]. The terms "trust anchor" and "trust
anchor store" are defined in [RFC6024] as anchor store" are defined in [RFC6024] as
"A trust anchor represents an authoritative entity via a public "A trust anchor represents an authoritative entity via a public
key and associated data. The public key is used to verify digital key and associated data. The public key is used to verify digital
signatures, and the associated data is used to constrain the types signatures, and the associated data is used to constrain the types
of information for which the trust anchor is authoritative." of information for which the trust anchor is authoritative."
"A trust anchor store is a set of one or more trust anchors stored "A trust anchor store is a set of one or more trust anchors stored
in a device. A device may have more than one trust anchor store, in a device. A device may have more than one trust anchor store,
each of which may be used by one or more applications." each of which may be used by one or more applications."
3. TLS/DTLS Protocol Overview 3. Overview
3.1. TLS and DTLS
The TLS protocol [RFC5246] provides authenticated, confidentiality- The TLS protocol [RFC5246] provides authenticated, confidentiality-
and integrity-protected communication between two endpoints. The and integrity-protected communication between two endpoints. The
protocol is composed of two layers: the Record Protocol and the protocol is composed of two layers: the Record Protocol and the
Handshaking Protocols. At the lowest level, layered on top of a Handshaking Protocols. At the lowest level, layered on top of a
reliable transport protocol (e.g., TCP), is the Record Protocol. It reliable transport protocol (e.g., TCP), is the Record Protocol. It
provides connection security by using symmetric cryptography for provides connection security by using symmetric cryptography for
confidentiality, data origin authentication, and integrity confidentiality, data origin authentication, and integrity
protection. The Record Protocol is used for encapsulation of various protection. The Record Protocol is used for encapsulation of various
higher-level protocols. The handshaking protocols consist of three higher-level protocols. The handshaking protocols consist of three
skipping to change at page 5, line 45 skipping to change at page 5, line 47
stateless cookie exchange for Denial of Service (DoS) resistance. stateless cookie exchange for Denial of Service (DoS) resistance.
For this purpose a new handshake message, the HelloVerifyRequest, For this purpose a new handshake message, the HelloVerifyRequest,
was added to DTLS. This handshake message is sent by the server was added to DTLS. This handshake message is sent by the server
and includes a stateless cookie, which is returned in a and includes a stateless cookie, which is returned in a
ClientHello message back to the server. Although the exchange is ClientHello message back to the server. Although the exchange is
optional for the server to execute, a client implementation has to optional for the server to execute, a client implementation has to
be prepared to respond to it. Furthermore, the handshake message be prepared to respond to it. Furthermore, the handshake message
format has been extended to deal with message loss, reordering, format has been extended to deal with message loss, reordering,
and fragmentation. and fragmentation.
4. Communication Models 3.2. Communication Models
This document describes a profile of DTLS and, to be useful, it has This document describes a profile of DTLS and, to be useful, it has
to make assumptions about the envisioned communication architecture. to make assumptions about the envisioned communication architecture.
Two communication architectures (and consequently two profiles) are Two communication architectures (and consequently two profiles) are
described in this document. described in this document.
4.1. Constrained TLS/DTLS Clients 3.2.1. Constrained TLS/DTLS Clients
The communication architecture shown in Figure 1 assumes a unicast The communication architecture shown in Figure 1 assumes a unicast
communication interaction with an IoT device utilizing a constrained communication interaction with an IoT device utilizing a constrained
TLS/DTLS client interacting with one or multiple TLS/DTLS servers. TLS/DTLS client interacting with one or multiple TLS/DTLS servers.
Before a client can initiate the TLS/DTLS handshake it needs to know Before a client can initiate the TLS/DTLS handshake it needs to know
the IP address of that server and what credentials to use. the IP address of that server and what credentials to use.
Application layer protocols, such as CoAP, which is conveyed on top Application layer protocols, such as CoAP, which is conveyed on top
of DTLS, may be configured with URIs of the endpoints to which CoAP of DTLS, may be configured with URIs of the endpoints to which CoAP
needs to register and publish data. This configuration information needs to register and publish data. This configuration information
(including non-confidential credentials, like certificates) may be (including non-confidential credentials, like certificates) may be
conveyed to clients as part of a firmware/software package or via a conveyed to clients as part of a firmware/software package or via a
configuration protocol. The following credential types are supported configuration protocol. The following credential types are supported
by this profile: by this profile:
o For PSK-based authentication (see Section 6.2), this includes the o For PSK-based authentication (see Section 4.2), this includes the
paired "PSK identity" and shared secret to be used with each paired "PSK identity" and shared secret to be used with each
server. server.
o For raw public key-based authentication (see Section 6.3), this o For raw public key-based authentication (see Section 4.3), this
includes either the server's public key or the hash of the includes either the server's public key or the hash of the
server's public key. server's public key.
o For certificate-based authentication (see Section 6.4), this o For certificate-based authentication (see Section 4.4), this
includes a pre-populated trust anchor store that allows the DTLS includes a pre-populated trust anchor store that allows the DTLS
stack to perform path validation for the certificate obtained stack to perform path validation for the certificate obtained
during the handshake with the server. during the handshake with the server.
Figure 1 shows example configuration information stored at the Figure 1 shows example configuration information stored at the
constrained client for use with respective servers. constrained client for use with respective servers.
This document focuses on the description of the DTLS client-side This document focuses on the description of the DTLS client-side
functionality but, quite naturally, the equivalent server-side functionality but, quite naturally, the equivalent server-side
support has to be available. support has to be available.
skipping to change at page 7, line 44 skipping to change at page 7, line 44
| | B | | | B |
| +------+ | +------+
| |
| +------+ | +------+
+----------------->|Server| +----------------->|Server|
| C | | C |
+------+ +------+
Figure 1: Constrained Client Profile. Figure 1: Constrained Client Profile.
4.1.1. Examples of Constrained Client Exchanges 3.2.1.1. Examples of Constrained Client Exchanges
4.1.1.1. Network Access Authentication Example 3.2.1.1.1. Network Access Authentication Example
Re-use is a recurring theme when considering constrained environments Re-use is a recurring theme when considering constrained environments
and is behind a lot of the directions taken in developments for and is behind a lot of the directions taken in developments for
constrained environments. The corollary of re-use is to not add constrained environments. The corollary of re-use is to not add
functionality if it can be avoided. An example relevant to the use functionality if it can be avoided. An example relevant to the use
of TLS is network access authentication, which takes place when a of TLS is network access authentication, which takes place when a
device connects to a network and needs to go through an device connects to a network and needs to go through an
authentication and access control procedure before it is allowed to authentication and access control procedure before it is allowed to
communicate with other devices or connect to the Internet. communicate with other devices or connect to the Internet.
skipping to change at page 11, line 5 skipping to change at page 11, line 5
Figure 3: EAP-TLS Exchange. Figure 3: EAP-TLS Exchange.
The guidance in this document also applies to the use of EAP-TLS for The guidance in this document also applies to the use of EAP-TLS for
network access authentication. An IoT device using a network access network access authentication. An IoT device using a network access
authentication solution based on TLS can re-use most parts of the authentication solution based on TLS can re-use most parts of the
code for the use of DTLS/TLS at the application layer thereby saving code for the use of DTLS/TLS at the application layer thereby saving
a significant amount of flash memory. Note, however, that the a significant amount of flash memory. Note, however, that the
credentials used for network access authentication and those used for credentials used for network access authentication and those used for
application layer security are very likely different. application layer security are very likely different.
4.1.1.2. CoAP-based Data Exchange Example 3.2.1.1.2. CoAP-based Data Exchange Example
When a constrained client uploads sensor data to a server When a constrained client uploads sensor data to a server
infrastructure it may use CoAP by pushing the data via a POST message infrastructure it may use CoAP by pushing the data via a POST message
to a pre-configured endpoint on the server. In certain circumstances to a pre-configured endpoint on the server. In certain circumstances
this might be too limiting and additional functionality is needed, as this might be too limiting and additional functionality is needed, as
shown in Figure 4 and Figure 4, where the IoT device itself runs a shown in Figure 4 and Figure 4, where the IoT device itself runs a
CoAP server hosting the resource that is made accessible to other CoAP server hosting the resource that is made accessible to other
entities. Despite running a CoAP server on the IoT device it is entities. Despite running a CoAP server on the IoT device it is
still the DTLS client on the IoT device that initiates the still the DTLS client on the IoT device that initiates the
interaction with the non-constrained resource server in our scenario. interaction with the non-constrained resource server in our scenario.
skipping to change at page 13, line 47 skipping to change at page 13, line 47
E| 25.5 --------> \ E E| 25.5 --------> \ E
T| \ D T| \ D
+--- ///+ +--- ///+
Figure 5: DTLS/CoAP exchange using Resource Directory: Part 2 - CoAP/ Figure 5: DTLS/CoAP exchange using Resource Directory: Part 2 - CoAP/
RD Exchange. RD Exchange.
Note that the CoAP GET message transmitted from the Resource Server Note that the CoAP GET message transmitted from the Resource Server
is protected using the previously established DTLS Record Layer. is protected using the previously established DTLS Record Layer.
4.2. Constrained TLS/DTLS Servers 3.2.2. Constrained TLS/DTLS Servers
Section 4.1 illustrates a deployment model where the TLS/DTLS client Section 3.2.1 illustrates a deployment model where the TLS/DTLS
is constrained and efforts need to be taken to improve memory client is constrained and efforts need to be taken to improve memory
utilization, bandwidth consumption, reduce performance impacts, etc. utilization, bandwidth consumption, reduce performance impacts, etc.
In this section, we assume a scenario where constrained devices run In this section, we assume a scenario where constrained devices run
TLS/ DTLS servers to secure access to application layer services TLS/DTLS servers to secure access to application layer services
running on top of CoAP, HTTP or other protocols. Figure 6 running on top of CoAP, HTTP or other protocols. Figure 6
illustrates a possible deployment whereby a number of constrained illustrates a possible deployment whereby a number of constrained
servers are waiting for regular clients to access their resources. servers are waiting for regular clients to access their resources.
The entire process is likely, but not necessarily, controlled by a The entire process is likely, but not necessarily, controlled by a
third party, the authentication and authorization server. This third party, the authentication and authorization server. This
authentication and authorization server is responsible for holding authentication and authorization server is responsible for holding
authorization policies that govern the access to resources and authorization policies that govern the access to resources and
distribution of keying material. distribution of keying material.
+////////////////////////////////////+ +////////////////////////////////////+
skipping to change at page 15, line 49 skipping to change at page 15, line 49
| Server S3 | | Server S3 |
+-----------+ +-----------+
Figure 6: Constrained Server Profile. Figure 6: Constrained Server Profile.
A deployment with constrained servers has to overcome several A deployment with constrained servers has to overcome several
challenges. Below we explain how these challenges can be solved with challenges. Below we explain how these challenges can be solved with
CoAP, as an example. Other protocols may offer similar capabilities. CoAP, as an example. Other protocols may offer similar capabilities.
While the requirements for the TLS/DTLS protocol profile change only While the requirements for the TLS/DTLS protocol profile change only
slightly when run on a constrained server (in comparison to running slightly when run on a constrained server (in comparison to running
it on a constrained client) several other eco-system factor will it on a constrained client) several other eco-system factors will
impact deployment. impact deployment.
There are several challenges that need to be addressed: There are several challenges that need to be addressed:
Discovery and Reachability: Discovery and Reachability:
A client must first and foremost discover the server before A client must first and foremost discover the server before
initiating a connection to it. Once it has been discovered, initiating a connection to it. Once it has been discovered,
reachability to the device needs to be maintained. reachability to the device needs to be maintained.
skipping to change at page 16, line 32 skipping to change at page 16, line 32
The use of Resource Directory (RD) The use of Resource Directory (RD)
[I-D.ietf-core-resource-directory] is yet another possibility for [I-D.ietf-core-resource-directory] is yet another possibility for
discovering registered servers and their resources. Since RD is discovering registered servers and their resources. Since RD is
usually not a proxy, clients can discover links registered with usually not a proxy, clients can discover links registered with
the RD and then access them directly. the RD and then access them directly.
Authentication: Authentication:
The next challenge concerns the provisioning of authentication The next challenge concerns the provisioning of authentication
credentials to the clients as well as servers. In Section 4.1 we credentials to the clients as well as servers. In Section 3.2.1
assumed that credentials (and other configuration information) are we assumed that credentials (and other configuration information)
provisioned to the device and that those can be used with the are provisioned to the device and that those can be used with the
authorization servers. Of course, this leads to a very static authorization servers. Of course, this leads to a very static
relationship between the clients and their server-side relationship between the clients and their server-side
infrastructure but poses fewer challenges from a deployment point infrastructure but poses fewer challenges from a deployment point
of view, as described in Section 2 of [RFC7452]. In any case, of view, as described in Section 2 of [RFC7452]. In any case,
engineers and product designers have to determine how the relevant engineers and product designers have to determine how the relevant
credentials are distributed to the respective parties. For credentials are distributed to the respective parties. For
example, shared secrets may need to be provisioned to clients and example, shared secrets may need to be provisioned to clients and
the constrained servers for subsequent use of TLS/DTLS PSK. In the constrained servers for subsequent use of TLS/DTLS PSK. In
other deployments, certificates, private keys, and trust anchors other deployments, certificates, private keys, and trust anchors
for use with certificate-based authentication may need to be for use with certificate-based authentication may need to be
utilized. utilized.
Practical solutions either use pairing (also called imprinting) or Practical solutions either use pairing (also called imprinting) or
a trusted third party. With pairing two devices execute a special a trusted third party. With pairing two devices execute a special
protocol exchange that is unauthenticated to establish an shared protocol exchange that is unauthenticated to establish a shared
key (for example using an unauthenticated Diffie-Hellman exchange) key (for example using an unauthenticated Diffie-Hellman
key. To avoid man-in-the-middle attacks an out-of-band channel is exchange). To avoid man-in-the-middle attacks an out-of-band
used to verify that nobody has tampered with the exchanged channel is used to verify that nobody has tampered with the
protocol messages. This out-of-band channel can come in many exchanged protocol messages. This out-of-band channel can come in
forms, including: many forms, including:
* Human involvement by comparing hashed keys, entering passkeys, * Human involvement by comparing hashed keys, entering passkeys,
scanning QR codes scanning QR codes
* The use of alternative wireless communication channels (e.g., * The use of alternative wireless communication channels (e.g.,
infra-red communication in addition to WiFi) infra-red communication in addition to WiFi)
* Proximity-based information * Proximity-based information
More details about these different pairing/imprinting techniques More details about these different pairing/imprinting techniques
can be found in the smart object security workshop report can be found in the smart object security workshop report
[RFC7397] and various position papers submitted to that topic, [RFC7397] and various position papers submitted on that topic,
such as [ImprintingSurvey]. The use of a trusted third party such as [ImprintingSurvey]. The use of a trusted third party
follows a different approach and is subject to ongoing follows a different approach and is subject to ongoing
standardization efforts in the 'Authentication and Authorization standardization efforts in the 'Authentication and Authorization
for Constrained Environments (ACE)' working group [ACE-WG]. for Constrained Environments (ACE)' working group [ACE-WG].
Authorization Authorization
The last challenge is the ability for the constrained server to The last challenge is the ability for the constrained server to
make an authorization decision when clients access protected make an authorization decision when clients access protected
resources. Pre-provisioning access control information to resources. Pre-provisioning access control information to
constrained servers may be one option but works only in a small constrained servers may be one option but works only in a small
scale, less dynamic environment. For a more fine-grained and scale, less dynamic environment. For a finer-grained and more
dynamic access control the reader is referred to the ongoing work dynamic access control solution the reader is referred to the
in the ACE working group. ongoing work in the IETF ACE working group.
Figure 7 shows an example interaction whereby a device, a thermostat Figure 7 shows an example interaction whereby a device, a thermostat
in our case, searches in the local network for discoverable resources in our case, searches in the local network for discoverable resources
and accesses those. The thermostat starts the procedure using a and accesses those. The thermostat starts the procedure using a
link-local discovery message using the "All CoAP Nodes" multicast link-local discovery message using the "All CoAP Nodes" multicast
address by utilizing the RFC 6690 [RFC6690] link format. The IPv6 address by utilizing the RFC 6690 [RFC6690] link format. The IPv6
multicast address used for site-local discovery is FF02::FD. As a multicast address used for site-local discovery is FF02::FD. As a
result, a temperature sensor and a fan respond. These responses result, a temperature sensor and a fan respond. These responses
allow the thermostat to subsequently read temperature information allow the thermostat to subsequently read temperature information
from the temperature sensor with a CoAP GET request issued to the from the temperature sensor with a CoAP GET request issued to the
previously learned endpoint. In this example we assume that previously learned endpoint. In this example we assume that
accessing the temperature sensor readings and controlling the fan accessing the temperature sensor readings and controlling the fan
requires authentication and authorization of the thermostat and TLS requires authentication and authorization of the thermostat and TLS
is used to authenticate both endpoint and to secure the is used to authenticate both endpoints and to secure the
communication. communication.
Temperature Temperature
Thermostat Sensor Fan Thermostat Sensor Fan
---------- --------- --- ---------- --------- ---
Discovery Discovery
--------------------> -------------------->
GET coap://[FF02::FD]/.well-known/core GET coap://[FF02::FD]/.well-known/core
skipping to change at page 18, line 45 skipping to change at page 18, line 45
Configure Actuator Configure Actuator
(authenticated/authorized) (authenticated/authorized)
-------------------------------------------------> ------------------------------------------------->
PUT /fan?on-off=true PUT /fan?on-off=true
CoAP 2.04 Changed CoAP 2.04 Changed
<------------------------------------------------- <-------------------------------------------------
Figure 7: Local Discovery and Resource Access. Figure 7: Local Discovery and Resource Access.
5. The Ciphersuite Concept 3.3. The Ciphersuite Concept
TLS (and consequently DTLS) has the concept of ciphersuites and an TLS (and consequently DTLS) has the concept of ciphersuites and an
IANA registry [IANA-TLS] was created to register the suites. A IANA registry [IANA-TLS] was created to register the suites. A
ciphersuite (and the specification that defines it) contains the ciphersuite (and the specification that defines it) contains the
following information: following information:
o Authentication and key exchange algorithm (e.g., PSK) o Authentication and key exchange algorithm (e.g., PSK)
o Cipher and key length (e.g., Advanced Encryption Standard (AES) o Cipher and key length (e.g., Advanced Encryption Standard (AES)
with 128 bit keys [AES]) with 128 bit keys [AES])
skipping to change at page 20, line 11 skipping to change at page 20, line 11
8-octet authentication tag, while the regular CCM ciphersuites have, 8-octet authentication tag, while the regular CCM ciphersuites have,
at the time of writing, 16-octet authentication tags. The design of at the time of writing, 16-octet authentication tags. The design of
CCM and the security properties are described in [CCM]. CCM and the security properties are described in [CCM].
TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in
the TLS pseudo random function (PRF) used in earlier versions of TLS the TLS pseudo random function (PRF) used in earlier versions of TLS
with cipher-suite-specified PRFs. For this reason authors of more with cipher-suite-specified PRFs. For this reason authors of more
recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC
algorithm and the hash functions used with the TLS PRF. algorithm and the hash functions used with the TLS PRF.
6. Credential Types 4. Credential Types
The mandatory-to-implement functionality will depend on the The mandatory-to-implement functionality will depend on the
credential type used with IoT devices. The sub-sections below credential type used with IoT devices. The sub-sections below
describe the implications of three different credential types, namely describe the implications of three different credential types, namely
pre-shared secrets, raw public keys, and certificates. pre-shared secrets, raw public keys, and certificates.
6.1. Pre-Conditions 4.1. Pre-Conditions
All exchanges described in the subsequent sections assume that some All exchanges described in the subsequent sections assume that some
information has been distributed before the TLS/DTLS interaction can information has been distributed before the TLS/DTLS interaction can
start. The credentials are used to authenticate the client to the start. The credentials are used to authenticate the client to the
server and vice versa. What information items have to be distributed server and vice versa. What information items have to be distributed
depends on the chosen credential types. In all cases the IoT device depends on the chosen credential types. In all cases the IoT device
needs to know what algorithms to prefer, particularly if there are needs to know what algorithms to prefer, particularly if there are
multiple algorithms choices available as part of the implemented multiple algorithms choices available as part of the implemented
ciphersuites, as well as information about the other communication ciphersuites, as well as information about the other communication
endpoint (for example in form of a URI) a particular credential has endpoint (for example in form of a URI) a particular credential has
to be used with. to be used with.
Pre-Shared Secrets: In this case a shared secret together with an Pre-Shared Secrets: In this case a shared secret together with an
identifier needs to be made available to the device as well as to identifier needs to be made available to the device as well as to
the other communication party. the other communication party.
Raw Public Keys: A public key together with a private key are stored Raw Public Keys: A public key together with a private key are stored
on the device and typically associated with some identifier. To on the device and typically associated with some identifier. To
authenticate the other communication party the appropriate authenticate the other communication party the appropriate
credential has to be know. If the other end uses raw public keys credential has to be known. If the other end uses raw public keys
as well then their public key needs to be provisioned (out-of- as well then their public key needs to be provisioned (out-of-
band) to the device. band) to the device.
Certificates The use of certificates requires the device to store Certificates The use of certificates requires the device to store
the public key (as part of the certificate) as well as the private the public key (as part of the certificate) as well as the private
key. The certificate will contain the identifier of the device as key. The certificate will contain the identifier of the device as
well as various other attributes. Both communication parties are well as various other attributes. Both communication parties are
assumed to be in possession of a trust anchor store that contains assumed to be in possession of a trust anchor store that contains
CA certificates and, in case of certificate pinning, end-entity CA certificates and, in case of certificate pinning, end-entity
certificates. Similarly to the other credentials the IoT device certificates. Similarly to the other credentials the IoT device
skipping to change at page 21, line 27 skipping to change at page 21, line 27
configuration and credentials to the device is left to a separate configuration and credentials to the device is left to a separate
interaction. An example of a dedicated protocol used to distribute interaction. An example of a dedicated protocol used to distribute
credentials, access control lists and configuration information is credentials, access control lists and configuration information is
the Lightweight Machine-to-Machine (LWM2M) protocol [LWM2M]. the Lightweight Machine-to-Machine (LWM2M) protocol [LWM2M].
For all the credentials listed above there is a chance that those may For all the credentials listed above there is a chance that those may
need to be replaced or deleted. While separate protocols have been need to be replaced or deleted. While separate protocols have been
developed to check the status of these credentials and to manage developed to check the status of these credentials and to manage
these credentials, such as the Trust Anchor Management Protocol these credentials, such as the Trust Anchor Management Protocol
(TAMP) [RFC5934], their usage is, however, not envisioned in the IoT (TAMP) [RFC5934], their usage is, however, not envisioned in the IoT
context so far. IoT device are assumed to have a software update context so far. IoT devices are assumed to have a software update
mechanism built-in and it will allow updates of low-level device mechanism built-in and it will allow updates of low-level device
information, including credentials and configuration parameters. information, including credentials and configuration parameters.
This document does, however, not mandate a specific software / This document does, however, not mandate a specific software /
firmware update protocol. firmware update protocol.
With all credentials used as input to TLS/DTLS authentication it is With all credentials used as input to TLS/DTLS authentication it is
important that these credentials have been generated with care. When important that these credentials have been generated with care. When
using a pre-shared secret, a critical consideration is use sufficient using a pre-shared secret, a critical consideration is use sufficient
entropy during the key generation, as discussed in [RFC4086]. entropy during the key generation, as discussed in [RFC4086].
Deriving a shared secret from a password, some device identifiers, or Deriving a shared secret from a password, some device identifiers, or
other low-entropy source is not secure. A low-entropy secret, or other low-entropy source is not secure. A low-entropy secret, or
password, is subject to dictionary attacks. Attention also has to be password, is subject to dictionary attacks. Attention also has to be
paid when generating public / private key pairs since the lack of paid when generating public / private key pairs since the lack of
randomness can result in the same key pair being used in many randomness can result in the same key pair being used in many
devices. This topic is also discussed in Section 14 since keys are devices. This topic is also discussed in Section 12 since keys are
generated during the TLS/DTLS exchange itself as well and the same generated during the TLS/DTLS exchange itself as well and the same
considerations apply. considerations apply.
6.2. Pre-Shared Secret 4.2. Pre-Shared Secret
The use of pre-shared secrets is one of the most basic techniques for The use of pre-shared secrets is one of the most basic techniques for
TLS/DTLS since it is both computational efficient and bandwidth TLS/DTLS since it is both computationally efficient and bandwidth
conserving. Pre-shared secret based authentication was introduced to conserving. Pre-shared secret based authentication was introduced to
TLS with RFC 4279 [RFC4279]. TLS with RFC 4279 [RFC4279].
The exchange shown in Figure 8 illustrates the DTLS exchange The exchange shown in Figure 8 illustrates the DTLS exchange
including the cookie exchange. While the server is not required to including the cookie exchange. While the server is not required to
initiate a cookie exchange with every handshake, the client is initiate a cookie exchange with every handshake, the client is
required to implement and to react on it when challenged, as defined required to implement and to react on it when challenged, as defined
in RFC 6347 [RFC6347]. The cookie exchange allows the server to in RFC 6347 [RFC6347]. The cookie exchange allows the server to
react to flooding attacks. react to flooding attacks.
skipping to change at page 23, line 13 skipping to change at page 23, line 13
provisioned into hardware modules or provisioned alongside with provisioned into hardware modules or provisioned alongside with
firmware. As such, the encoding considerations are not applicable to firmware. As such, the encoding considerations are not applicable to
this usage environment. For use with this profile the PSK identities this usage environment. For use with this profile the PSK identities
SHOULD NOT assume a structured format (such as domain names, SHOULD NOT assume a structured format (such as domain names,
Distinguished Names, or IP addresses) and a constant time bit-by-bit Distinguished Names, or IP addresses) and a constant time bit-by-bit
comparison operation MUST be used by the server for any operation comparison operation MUST be used by the server for any operation
related to the PSK identity. related to the PSK identity.
Protocol-wise the client indicates which key it uses by including a Protocol-wise the client indicates which key it uses by including a
"PSK identity" in the ClientKeyExchange message. As described in "PSK identity" in the ClientKeyExchange message. As described in
Section 4 clients may have multiple pre-shared keys with a single Section 3.2 clients may have multiple pre-shared keys with a single
server, for example in a hosting context. The TLS Server Name server, for example in a hosting context. The TLS Server Name
Indication (SNI) extension allows the client to convey the name of Indication (SNI) extension allows the client to convey the name of
the server it is contacting. A server implementation needs to guide the server it is contacting. A server implementation needs to guide
the selection based on a received SNI value from the client. the selection based on a received SNI value from the client.
RFC 4279 requires TLS implementations supporting PSK ciphersuites to RFC 4279 requires TLS implementations supporting PSK ciphersuites to
support arbitrary PSK identities up to 128 octets in length, and support arbitrary PSK identities up to 128 octets in length, and
arbitrary PSKs up to 64 octets in length. This is a useful arbitrary PSKs up to 64 octets in length. This is a useful
assumption for TLS stacks used in the desktop and mobile environments assumption for TLS stacks used in the desktop and mobile environments
where management interfaces are used to provision identities and where management interfaces are used to provision identities and
skipping to change at page 24, line 5 skipping to change at page 24, line 5
Note: Starting with TLS 1.2 (and consequently DTLS 1.2) ciphersuites Note: Starting with TLS 1.2 (and consequently DTLS 1.2) ciphersuites
have to specify the pseudorandom function. RFC 5246 states that 'New have to specify the pseudorandom function. RFC 5246 states that 'New
cipher suites MUST explicitly specify a PRF and, in general, SHOULD cipher suites MUST explicitly specify a PRF and, in general, SHOULD
use the TLS PRF with SHA-256 or a stronger standard hash function.'. use the TLS PRF with SHA-256 or a stronger standard hash function.'.
The ciphersuites recommended in this document use the SHA-256 The ciphersuites recommended in this document use the SHA-256
construct defined in Section 5 of RFC 5246. construct defined in Section 5 of RFC 5246.
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section.
6.3. Raw Public Key 4.3. Raw Public Key
The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is
the first entry point into public key cryptography without having to the first entry point into public key cryptography without having to
pay the price of certificates and a public key infrastructure (PKI). pay the price of certificates and a public key infrastructure (PKI).
The specification re-uses the existing Certificate message to convey The specification re-uses the existing Certificate message to convey
the raw public key encoded in the SubjectPublicKeyInfo structure. To the raw public key encoded in the SubjectPublicKeyInfo structure. To
indicate support two new extensions had been defined, as shown in indicate support two new extensions had been defined, as shown in
Figure 9, namely the server_certificate_type*' and the Figure 9, namely the server_certificate_type and the
client_certificate_type. client_certificate_type.
Client Server Client Server
------ ------ ------ ------
ClientHello --------> ClientHello -------->
#client_certificate_type# #client_certificate_type#
#server_certificate_type# #server_certificate_type#
ServerHello ServerHello
skipping to change at page 24, line 50 skipping to change at page 24, line 50
Note: Extensions marked with '#' were introduced with Note: Extensions marked with '#' were introduced with
RFC 7250. RFC 7250.
Figure 9: DTLS Raw Public Key Exchange. Figure 9: DTLS Raw Public Key Exchange.
The CoAP recommended ciphersuite for use with this credential type is The CoAP recommended ciphersuite for use with this credential type is
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve
cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral
Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment
mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA)
for authentication. Due to the use of Ephemeral Elliptic Curve for authentication. The named Diffie-Hellman groups
Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman
groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this profile
profile. This ciphersuite makes use of the AEAD capability in DTLS since it relies on the ECC-based counterparts. This ciphersuite
1.2 and utilizes an eight-octet authentication tag. The use of a makes use of the AEAD capability in DTLS 1.2 and utilizes an eight-
Diffie-Hellman key exchange provides perfect forward secrecy (PFS). octet authentication tag. The use of a Diffie-Hellman key exchange
More details about PFS can be found in Section 11. provides perfect forward secrecy (PFS). More details about PFS can
be found in Section 9.
[RFC6090] provides valuable information for implementing Elliptic [RFC6090] provides valuable information for implementing Elliptic
Curve Cryptography algorithms, particularly for choosing methods that Curve Cryptography algorithms, particularly for choosing methods that
have been available in the literature for a long time (i.e., 20 years have been available in the literature for a long time (i.e., 20 years
and more). and more).
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
6.4. Certificates 4.4. Certificates
The use of mutual certificate-based authentication is shown in The use of mutual certificate-based authentication is shown in
Figure 10, which makes use of the cached info extension Figure 10, which makes use of the cached info extension
[I-D.ietf-tls-cached-info]. Support of the cached info extension is [I-D.ietf-tls-cached-info]. Support of the cached info extension is
REQUIRED. Caching certificate chains allows the client to reduce the REQUIRED. Caching certificate chains allows the client to reduce the
communication overhead significantly since otherwise the server would communication overhead significantly since otherwise the server would
provide the end entity certificate, and the certificate chain with provide the end entity certificate, and the certificate chain with
every full DTLS handshake. every full DTLS handshake.
Client Server Client Server
skipping to change at page 26, line 44 skipping to change at page 26, line 44
4492 [RFC4492]. At the time of writing the recommended curve is 4492 [RFC4492]. At the time of writing the recommended curve is
secp256r1 and the use of uncompressed points to follow the secp256r1 and the use of uncompressed points to follow the
recommendation in CoAP. Note that standardization for Curve25519 recommendation in CoAP. Note that standardization for Curve25519
(for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for (for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for
this curve will likely be required in the future. this curve will likely be required in the future.
A device compliant with the profile in this section MUST implement A device compliant with the profile in this section MUST implement
TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
section. section.
6.4.1. Certificates used by Servers 4.4.1. Certificates used by Servers
The algorithm for verifying the service identity, as described in RFC The algorithm for verifying the service identity, as described in RFC
6125 [RFC6125], is essential for ensuring proper security when 6125 [RFC6125], is essential for ensuring proper security when
certificates are used. As a summary, the algorithm contains the certificates are used. As a summary, the algorithm contains the
following steps: following steps:
1. The client constructs a list of acceptable reference identifiers 1. The client constructs a list of acceptable reference identifiers
based on the source domain and, optionally, the type of service based on the source domain and, optionally, the type of service
to which the client is connecting. to which the client is connecting.
skipping to change at page 27, line 45 skipping to change at page 27, line 45
The following recommendation is provided: The following recommendation is provided:
1. Certificates MUST NOT use DNS domain names in the Common Name of 1. Certificates MUST NOT use DNS domain names in the Common Name of
certificates and instead use the subjectAltName attribute, as certificates and instead use the subjectAltName attribute, as
described in the previous paragraph. described in the previous paragraph.
2. Certificates MUST NOT contain domain names with wildcard 2. Certificates MUST NOT contain domain names with wildcard
characters. characters.
3. Certificates MUST NOT contains multiple names (e.g., more than 3. Certificates MUST NOT contain multiple names (e.g., more than one
one dNSName field). dNSName field).
Note that there will be servers that are not provisioned for use with Note that there will be servers that are not provisioned for use with
DNS domain names, for example, IoT devices that offer resources to DNS domain names, for example, IoT devices that offer resources to
nearby devices in a local area network, as shown in Figure 7. When nearby devices in a local area network, as shown in Figure 7. When
such constrained servers are used then the use of certificates as such constrained servers are used then the use of certificates as
described in Section 6.4.2 is applicable. Note that the Service Name described in Section 4.4.2 is applicable. Note that the Service Name
Indication (SNI) extension cannot be used in this case since SNI does Indication (SNI) extension cannot be used in this case since SNI does
not offer the ability to convey EUI-64 [EUI64] identifiers. Note not offer the ability to convey EUI-64 [EUI64] identifiers. Note
that this document does not recommend to use IP addresses in that this document does not recommend to use IP addresses in
certificates nor does it discuss the implications of placing IP certificates nor does it discuss the implications of placing IP
addresses in certificates. addresses in certificates.
6.4.2. Certificates used by Clients 4.4.2. Certificates used by Clients
For client certificates the identifier used in the SubjectAltName or For client certificates the identifier used in the SubjectAltName or
in the leftmost CN component of subject name MUST be an EUI-64, as in the leftmost CN component of subject name MUST be an EUI-64.
mandated in Section 9.1.3.3 of [RFC7252].
6.4.3. Certificate Revocation 4.4.3. Certificate Revocation
For certificate revocation neither the Online Certificate Status For certificate revocation neither the Online Certificate Status
Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
Instead, this profile relies on a software update mechanism to Instead, this profile relies on a software update mechanism to
provision information about revoked certificates. While multiple provision information about revoked certificates. While multiple
OCSP stapling [RFC6961] has recently been introduced as a mechanism OCSP stapling [RFC6961] has recently been introduced as a mechanism
to piggyback OCSP request/responses inside the DTLS/TLS handshake (to to piggyback OCSP request/responses inside the DTLS/TLS handshake (to
avoid the cost of a separate protocol handshake), further avoid the cost of a separate protocol handshake), further
investigations are needed to determine its suitability for the IoT investigations are needed to determine its suitability for the IoT
environment. environment.
As stated earlier in this section, modifications to the trust anchor As stated earlier in this section, modifications to the trust anchor
store depends on a software update mechanism as well. store depends on a software update mechanism as well.
6.4.4. Certificate Content 4.4.4. Certificate Content
All certificate elements listed in Table 1 are mandatory-to-implement All certificate elements listed in Table 1 MUST be implemented by
for client and servers claiming support for certificate-based clients and servers claiming support for certificate-based
authentication. No other certificate elements are used by this authentication. No other certificate elements are used by this
specification. specification.
When using certificates, IoT devices MUST provide support for a When using certificates, IoT devices MUST provide support for a
server certificate chain of at least 3 not including the trust anchor server certificate chain of at least 3 not including the trust anchor
and MAY reject connections from servers offering chains longer than and MAY reject connections from servers offering chains longer than
3. IoT devices MAY have client certificate chains of any length. 3. IoT devices MAY have client certificate chains of any length.
Obviously, longer chains require more digital signature verification Obviously, longer chains require more digital signature verification
operations to perform and lead to larger certificate messages in the operations to perform and lead to larger certificate messages in the
TLS handshake. TLS handshake.
skipping to change at page 30, line 25 skipping to change at page 30, line 24
There are various algorithms used to sign digital certificates, such There are various algorithms used to sign digital certificates, such
as RSA, the Digital Signature Algorithm (DSA), and the Elliptic Curve as RSA, the Digital Signature Algorithm (DSA), and the Elliptic Curve
Digital Signature Algorithm (ECDSA). As Table 1 indicates Digital Signature Algorithm (ECDSA). As Table 1 indicates
certificate are signed using ECDSA. This is not only true for the certificate are signed using ECDSA. This is not only true for the
end-entity certificates but also for all other certificates in the end-entity certificates but also for all other certificates in the
chain, including CA certificates. chain, including CA certificates.
Further details about X.509 certificates can be found in Further details about X.509 certificates can be found in
Section 9.1.3.3 of [RFC7252]. Section 9.1.3.3 of [RFC7252].
6.4.5. Client Certificate URLs 4.4.5. Client Certificate URLs
RFC 6066 [RFC6066] allows to avoid sending client-side certificates RFC 6066 [RFC6066] allows to avoid sending client-side certificates
and uses URLs instead. This reduces the over-the-air transmission. and uses URLs instead. This reduces the over-the-air transmission.
Note that the TLS cached info extension does not provide any help Note that the TLS cached info extension does not provide any help
with caching client certificates. with caching client certificates.
TLS/DTLS clients MUST implement support for client certificate URLs TLS/DTLS clients MUST implement support for client certificate URLs
for those environments where client-side certificates are used and for those environments where client-side certificates are used and
the server-side is not constrained. For constrained servers this the server-side is not constrained. For constrained servers this
functionality is NOT RECOMMENDED since it forces the server to functionality is NOT RECOMMENDED since it forces the server to
execute an additional protocol exchange, potentially using a protocol execute an additional protocol exchange, potentially using a protocol
it does not even support. The use of this extension also increases it does not even support. The use of this extension also increases
the risk of a denial of service attack against the constrained server the risk of a denial of service attack against the constrained server
due to the additional workload. due to the additional workload.
6.4.6. Trusted CA Indication 4.4.6. Trusted CA Indication
RFC 6066 [RFC6066] allows clients to indicate what trust anchor they RFC 6066 [RFC6066] allows clients to indicate what trust anchor they
support. With certificate-based authentication a DTLS server conveys support. With certificate-based authentication a DTLS server conveys
its end entity certificate to the client during the DTLS exchange its end entity certificate to the client during the DTLS exchange
provides. Since the server does not necessarily know what trust provides. Since the server does not necessarily know what trust
anchors the client has stored and to facilitate certification path anchors the client has stored and to facilitate certification path
construction as well as path validation, it includes intermediate CA construction as well as path validation, it includes intermediate CA
certs in the certificate payload. certs in the certificate payload.
Today, in most IoT deployments there is a fairly static relationship Today, in most IoT deployments there is a fairly static relationship
between the IoT device (and the software running on them) and the between the IoT device (and the software running on them) and the
server-side infrastructure. For these deployments where IoT devices server-side infrastructure. For these deployments where IoT devices
interact with a fixed, pre-configured set of servers this extension interact with a fixed, pre-configured set of servers this extension
is NOT RECOMMENDED. is NOT RECOMMENDED.
In cases where client interact with dynamically discovered TLS/DTLS In cases where client interact with dynamically discovered TLS/DTLS
servers, for example in the use cases described in Section 4.2, the servers, for example in the use cases described in Section 3.2.2, the
use of this extension is RECOMMENDED. use of this extension is RECOMMENDED.
7. Signature Algorithm Extension 5. Signature Algorithm Extension
The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of
RFC 5246 [RFC5246], allows the client to indicate to the server which RFC 5246 [RFC5246], allows the client to indicate to the server which
signature/hash algorithm pairs may be used in digital signatures. signature/hash algorithm pairs may be used in digital signatures.
The client MUST send this extension to select the use of SHA-256 The client MUST send this extension to select the use of SHA-256
since otherwise absent this extension RFC 5246 defaults to SHA-1 / since otherwise absent this extension RFC 5246 defaults to SHA-1 /
ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms. ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms.
The "signature_algorithms" extension is not applicable to the PSK- The "signature_algorithms" extension is not applicable to the PSK-
based ciphersuite described in Section 6.2. based ciphersuite described in Section 4.2.
8. Error Handling 6. Error Handling
TLS/DTLS uses the Alert protocol to convey errors and specifies a TLS/DTLS uses the Alert protocol to convey errors and specifies a
long list of error types. However, not all error messages defined in long list of error types. However, not all error messages defined in
the TLS/DTLS specification are applicable to this profile. In the TLS/DTLS specification are applicable to this profile. In
general, there are two categories of errors (as defined in general, there are two categories of errors (as defined in
Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert
messages with a level of fatal result in the immediate termination of messages with a level of fatal result in the immediate termination of
the connection. If possible, developers should try to develop the connection. If possible, developers should try to develop
strategies to react to those fatal errors, such as re-starting the strategies to react to those fatal errors, such as re-starting the
handshake or informing the user using the (often limited) user handshake or informing the user using the (often limited) user
skipping to change at page 32, line 46 skipping to change at page 32, line 43
DTLS 1.3 is in progress at the time of writing. DTLS 1.3 is in progress at the time of writing.
insufficient_security: This error message indicates that the server insufficient_security: This error message indicates that the server
requires ciphers to be more secure. This document specifies only requires ciphers to be more secure. This document specifies only
one ciphersuite per profile but it is likely that additional one ciphersuite per profile but it is likely that additional
ciphersuites get added over time. ciphersuites get added over time.
user_canceled: Many IoT devices are unattended and hence this error user_canceled: Many IoT devices are unattended and hence this error
message is unlikely to occur. message is unlikely to occur.
9. Session Resumption 7. Session Resumption
Session resumption is a feature of the core TLS/DTLS specifications Session resumption is a feature of the core TLS/DTLS specifications
that allows a client to continue with an earlier established session that allows a client to continue with an earlier established session
state. The resulting exchange is shown in Figure 11. In addition, state. The resulting exchange is shown in Figure 11. In addition,
the server may choose not to do a cookie exchange when a session is the server may choose not to do a cookie exchange when a session is
resumed. Still, clients have to be prepared to do a cookie exchange resumed. Still, clients have to be prepared to do a cookie exchange
with every handshake. The cookie exchange is not shown in the with every handshake. The cookie exchange is not shown in the
figure. figure.
Client Server Client Server
skipping to change at page 33, line 26 skipping to change at page 33, line 24
Application Data <-------> Application Data Application Data <-------> Application Data
Figure 11: DTLS Session Resumption. Figure 11: DTLS Session Resumption.
Constrained clients MUST implement session resumption to improve the Constrained clients MUST implement session resumption to improve the
performance of the handshake. This will lead to a reduced number of performance of the handshake. This will lead to a reduced number of
message exchanges, lower computational overhead (since only symmetric message exchanges, lower computational overhead (since only symmetric
cryptography is used during a session resumption exchange), and cryptography is used during a session resumption exchange), and
session resumption requires less bandwidth. session resumption requires less bandwidth.
For cases where the server constrained (but not the client) the For cases where the server is constrained (but not the client) the
client MUST implement RFC 5077 [RFC5077]. Note that the constrained client MUST implement RFC 5077 [RFC5077]. Note that the constrained
server refers to a device that has limitations in terms of RAM and server refers to a device that has limitations in terms of RAM and
flash memory, which place restrictions on the amount of TLS/DTLS flash memory, which place restrictions on the amount of TLS/DTLS
security state information that can be stored on such a device. RFC security state information that can be stored on such a device. RFC
5077 specifies a version of TLS/DTLS session resumption that does not 5077 specifies a version of TLS/DTLS session resumption that does not
require per-session state information to be maintained by the require per-session state information to be maintained by the
constrained server. This is accomplished by using a ticket-based constrained server. This is accomplished by using a ticket-based
approach. approach.
If both the client and the server are constrained devices both If both the client and the server are constrained devices both
devices SHOULD implement RFC 5077 and MUST implement basic session devices SHOULD implement RFC 5077 and MUST implement basic session
resumption. Clients that do not want to use session resumption are resumption. Clients that do not want to use session resumption are
always able to send a ClientHello message with an empty session_id to always able to send a ClientHello message with an empty session_id to
revert to a full handshake. revert to a full handshake.
10. Compression 8. Compression
Section 3.3 of [RFC7525] recommends to disable TLS/DTLS-level Section 3.3 of [RFC7525] recommends to disable TLS/DTLS-level
compression due to attacks, such as CRIME. For IoT applications compression due to attacks, such as CRIME [CRIME]. For IoT
compression at the TLS/DTLS layer is not needed since application applications compression at the TLS/DTLS layer is not needed since
layer protocols are highly optimized and the compression algorithms application layer protocols are highly optimized and the compression
at the DTLS layer increases code size and complexity. algorithms at the DTLS layer increases code size and complexity.
This TLS/DTLS profile MUST NOT implement TLS/DTLS layer compression. TLS/DTLS layer compression is NOT RECOMMENDED by this TLS/DTLS
profile.
11. Perfect Forward Secrecy 9. Perfect Forward Secrecy
Perfect forward secrecy (PFS) is a property that preserves the Perfect forward secrecy (PFS) is a property that preserves the
confidentiality of past conversations even in situations where the confidentiality of past conversations even in situations where the
long-term secret is compromised. long-term secret is compromised.
The PSK ciphersuite recommended in Section 6.2 does not offer this The PSK ciphersuite recommended in Section 4.2 does not offer this
property since it does not utilize a Diffie-Hellman exchange. New property since it does not utilize a Diffie-Hellman exchange. New
ciphersuites that support PFS for PSK-based authentication, such as ciphersuites that support PFS for PSK-based authentication, such as
proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become proposed in [I-D.schmertmann-dice-ccm-psk-pfs], might become
available as standardized ciphersuite in the (near) future. The available as standardized ciphersuite in the (near) future. The
recommended PSK-based ciphersuite offers excellent performance, a recommended PSK-based ciphersuite offers excellent performance, a
very small memory footprint, and has the lowest on the wire overhead very small memory footprint, and has the lowest on the wire overhead
at the expense of not using any public cryptography. For deployments at the expense of not using any public cryptography. For deployments
where public key cryptography is acceptable the raw public might where public key cryptography is acceptable the raw public might
offer an acceptable middle ground between the PSK ciphersuite in offer an acceptable middle ground between the PSK ciphersuite in
terms of out-of-band validation and the functionality offered by terms of out-of-band validation and the functionality offered by
skipping to change at page 34, line 42 skipping to change at page 34, line 40
multiple exchanges (rather than generating new keys for each multiple exchanges (rather than generating new keys for each
exchange). However, note that such key re-use over long periods exchange). However, note that such key re-use over long periods
voids the benefits of forward secrecy when an attack gains access to voids the benefits of forward secrecy when an attack gains access to
this DH key pair. this DH key pair.
The impact of the disclosure of past conversations and the desire to The impact of the disclosure of past conversations and the desire to
increase the cost for pervasive monitoring (as demanded by [RFC7258]) increase the cost for pervasive monitoring (as demanded by [RFC7258])
has to be taken into account when making a deployment decision. has to be taken into account when making a deployment decision.
Client implementations claiming support of this profile MUST Client implementations claiming support of this profile MUST
implement the ciphersuites listed in Section 6 according to the implement the ciphersuites listed in Section 4 according to the
selected credential type. selected credential type.
12. Keep-Alive 10. Keep-Alive
Application layer communication may create state at the endpoints and Application layer communication may create state at the endpoints and
this state my expire at some time. For this reason, applications this state my expire at some time. For this reason, applications
define ways to refresh state, if necessary. While the application define ways to refresh state, if necessary. While the application
layer exchanges are largely outside the scope of the underlying TLS/ layer exchanges are largely outside the scope of the underlying TLS/
DTLS exchange similar state considerations also play a role at the DTLS exchange similar state considerations also play a role at the
level of TLS/DTLS. While TLS/DTLS also creates state in form of a level of TLS/DTLS. While TLS/DTLS also creates state in form of a
security context (see the security parameter described in Appendix A6 security context (see the security parameter described in Appendix A6
in RFC 5246) at the client and the server this state information does in RFC 5246) at the client and the server this state information does
not expire. However, network intermediaries may also allocate state not expire. However, network intermediaries may also allocate state
skipping to change at page 35, line 36 skipping to change at page 35, line 34
functionality. There are three types of exchanges that need to be functionality. There are three types of exchanges that need to be
analyzed: analyzed:
Client-Initiated, One-Shot Messages Client-Initiated, One-Shot Messages
This is a common communication pattern where IoT devices upload This is a common communication pattern where IoT devices upload
data to a server on the Internet on an irregular basis. The data to a server on the Internet on an irregular basis. The
communication may be triggered by specific events, such as opening communication may be triggered by specific events, such as opening
a door. a door.
Since the upload happens on an irregular and unpredictable basis The DTLS handshake may need to be re-started (ideally using
and due to renumbering and Network Address Translation (NAT) the session resumption, if possible) in case of an IP address change.
DTLS handshake may need to be re-started (ideally using session
resumption, if possible).
In this case there is no use for a keep-alive extension for this In this case there is no use for a keep-alive extension for this
scenario. scenario.
Client-Initiated, Regular Data Uploads Client-Initiated, Regular Data Uploads
This is a variation of the previous case whereby data gets This is a variation of the previous case whereby data gets
uploaded on a regular basis, for example, based on frequent uploaded on a regular basis, for example, based on frequent
temperature readings. If neither NAT bindings nor IP address temperature readings. If neither NAT bindings nor IP address
changes occurred then the record layer will not notice any changes occurred then the record layer will not notice any
skipping to change at page 36, line 35 skipping to change at page 36, line 33
between the IoT device and the network itself (rather than some between the IoT device and the network itself (rather than some
links along the end-to-end path). Only in more complex network links along the end-to-end path). Only in more complex network
topologies, such as multi-hop mesh networks, path MTU discovery topologies, such as multi-hop mesh networks, path MTU discovery
might be appropriate. It also has to be noted that DTLS itself might be appropriate. It also has to be noted that DTLS itself
already provides a basic path discovery mechanism (see already provides a basic path discovery mechanism (see
Section 4.1.1.1 of RFC 6347 by using the fragmentation capability Section 4.1.1.1 of RFC 6347 by using the fragmentation capability
of the handshake protocol). of the handshake protocol).
For server-initiated messages the heartbeat extension is RECOMMENDED. For server-initiated messages the heartbeat extension is RECOMMENDED.
13. Timeouts 11. Timeouts
To connect to the Internet a variety of wired and wireless To connect to the Internet a variety of wired and wireless
technologies are available. Many of the low power radio technologies are available. Many of the low power radio
technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support
small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as
explained in [RFC4919]). Other radio technologies, such as the explained in [RFC4919]). Other radio technologies, such as the
Global System for Mobile Communications (GSM) using the short Global System for Mobile Communications (GSM) using the short
messaging service (SMS) have similar constraints in terms of payload messaging service (SMS) have similar constraints in terms of payload
sizes, such as 140 bytes without the optional segmentation and sizes, such as 140 bytes without the optional segmentation and
reassembly scheme known as Concatenated SMS, but show higher latency. reassembly scheme known as Concatenated SMS, but show higher latency.
skipping to change at page 37, line 30 skipping to change at page 37, line 28
retransmit is minimized and, on timeout, the sending endpoint does retransmit is minimized and, on timeout, the sending endpoint does
not react too aggressively. The latter is particularly relevant when not react too aggressively. The latter is particularly relevant when
the WSN is temporarily congested: if lost packets are re-injected too the WSN is temporarily congested: if lost packets are re-injected too
quickly, congestion worsens. quickly, congestion worsens.
An initial timer value of 9 seconds with exponential back off up to An initial timer value of 9 seconds with exponential back off up to
no less then 60 seconds is therefore RECOMMENDED. no less then 60 seconds is therefore RECOMMENDED.
This value is chosen big enough to absorb large latency variance due This value is chosen big enough to absorb large latency variance due
to either slow computation on constrained endpoints or to intrinsic to either slow computation on constrained endpoints or to intrinsic
network characteristics (e.g. GSM-SMS), as well as to produce a low network characteristics (e.g., GSM-SMS), as well as to produce a low
number of retransmission events and relax the pacing between them. number of retransmission events and relax the pacing between them.
Its worst case wait time is the same as using 1s timeout (i.e. 63s), Its worst case wait time is the same as using 1s timeout (i.e. 63s),
while triggering less then half retransmissions (2 instead of 5). while triggering less then half retransmissions (2 instead of 5).
In order to minimise the wake time during DTLS handshake, sleepy In order to minimise the wake time during DTLS handshake, sleepy
nodes might decide to select a lower threshold, and consequently a nodes might decide to select a lower threshold, and consequently a
smaller initial timeout value. If this is the case, the smaller initial timeout value. If this is the case, the
implementation MUST keep into account the considerations about implementation MUST keep into account the considerations about
network stability described in this section. network stability described in this section.
14. Random Number Generation 12. Random Number Generation
The TLS/DTLS protocol requires random numbers to be available during The TLS/DTLS protocol requires random numbers to be available during
the protocol run. For example, during the ClientHello and the the protocol run. For example, during the ClientHello and the
ServerHello exchange the client and the server exchange random ServerHello exchange the client and the server exchange random
numbers. Also, the use of the Diffie-Hellman exchange requires numbers. Also, the use of the Diffie-Hellman exchange requires
random numbers during the key pair generation. random numbers during the key pair generation.
It is important to note that sources contributing to the randomness It is important to note that sources contributing to the randomness
pool on laptops, or desktop PCs are not available on many IoT device, pool on laptops, or desktop PCs are not available on many IoT device,
such as mouse movement, timing of keystrokes, air turbulence on the such as mouse movement, timing of keystrokes, air turbulence on the
skipping to change at page 38, line 46 skipping to change at page 38, line 44
Chip manufacturers are highly encouraged to provide sufficient Chip manufacturers are highly encouraged to provide sufficient
documentation of their design for random number generators so that documentation of their design for random number generators so that
customers can have confidence about the quality of the generated customers can have confidence about the quality of the generated
random numbers. The confidence can be increased by providing random numbers. The confidence can be increased by providing
information about the procedures that have been used to verify the information about the procedures that have been used to verify the
randomness of numbers generated by the hardware modules. For randomness of numbers generated by the hardware modules. For
example, NIST Special Publication 800-22b [SP800-22b] describes example, NIST Special Publication 800-22b [SP800-22b] describes
statistical tests that can be used to verify random random number statistical tests that can be used to verify random random number
generators. generators.
15. Truncated MAC and Encrypt-then-MAC Extension 13. Truncated MAC and Encrypt-then-MAC Extension
The truncated MAC extension was introduced with RFC 6066 [RFC6066] The truncated MAC extension was introduced with RFC 6066 [RFC6066]
with the goal to reduce the size of the MAC used at the Record Layer. with the goal to reduce the size of the MAC used at the Record Layer.
This extension was developed for TLS ciphersuites that used older This extension was developed for TLS ciphersuites that used older
modes of operation where the MAC and the encryption operation was modes of operation where the MAC and the encryption operation was
performed independently. performed independently.
The recommended ciphersuites in this document use the newer The recommended ciphersuites in this document use the newer
Authenticated Encryption with Associated Data (AEAD) construct, Authenticated Encryption with Associated Data (AEAD) construct,
namely the CBC-MAC mode (CCM) with eight-octet authentication tags, namely the CBC-MAC mode (CCM) with eight-octet authentication tags,
and are therefore not applicable to the truncated MAC extension. and are therefore not applicable to the truncated MAC extension.
RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead
of the previously used MAC-then-encrypt) since the MAC-then-encrypt of the previously used MAC-then-encrypt) since the MAC-then-encrypt
mechanism has been the subject of a number of security mechanism has been the subject of a number of security
vulnerabilities. RFC 7366 is, however, also not applicable to the vulnerabilities. RFC 7366 is, however, also not applicable to the
AEAD ciphers recommended in this document. AEAD ciphers recommended in this document.
Implementations conformant to this specification MUST use AEAD Implementations conformant to this specification MUST use AEAD
ciphers. Hence, RFC 7366 and RFC 6066 are not applicable to this ciphers. Hence, RFC 7366 and the Truncated MAC extension of RFC 6066
specification and MUST NOT be implemented. are not applicable to this specification and are NOT RECOMMENDED.
16. Server Name Indication (SNI) 14. Server Name Indication (SNI)
The Server Name Indication extension defined in [RFC6066] defines a The Server Name Indication extension defined in [RFC6066] defines a
mechanism for a client to tell a TLS/DTLS server the name of the mechanism for a client to tell a TLS/DTLS server the name of the
server it wants to contact. This is a useful extension for many server it wants to contact. This is a useful extension for many
hosting environments where multiple virtual servers are run on single hosting environments where multiple virtual servers are run on single
IP address. IP address.
This specification RECOMMENDs the implementation of the Server Name This specification RECOMMENDs the implementation of the Server Name
Indication extension unless it is known that a TLS/DTLS client does Indication extension unless it is known that a TLS/DTLS client does
not interact with a server in a hosting environment. not interact with a server in a hosting environment.
17. Maximum Fragment Length Negotiation 15. Maximum Fragment Length Negotiation
This RFC 6066 extension lowers the maximum fragment length support This RFC 6066 extension lowers the maximum fragment length support
needed for the Record Layer from 2^14 bytes to 2^9 bytes. needed for the Record Layer from 2^14 bytes to 2^9 bytes.
This is a very useful extension that allows the client to indicate to This is a very useful extension that allows the client to indicate to
the server how much maximum memory buffers it uses for incoming the server how much maximum memory buffers it uses for incoming
messages. Ultimately, the main benefit of this extension is to allow messages. Ultimately, the main benefit of this extension is to allow
client implementations to lower their RAM requirements since the client implementations to lower their RAM requirements since the
client does not need to accept packets of large size (such as 16k client does not need to accept packets of large size (such as 16k
packets as required by plain TLS/DTLS). packets as required by plain TLS/DTLS).
Client implementations MUST support this extension. Client implementations MUST support this extension.
18. Session Hash 16. Session Hash
In order to begin connection protection, the Record Protocol requires In order to begin connection protection, the Record Protocol requires
specification of a suite of algorithms, a master secret, and the specification of a suite of algorithms, a master secret, and the
client and server random values. The algorithm for computing the client and server random values. The algorithm for computing the
master secret is defined in Section 8.1 of RFC 5246 but only includes master secret is defined in Section 8.1 of RFC 5246 but only includes
a small number of parameters exchanged during the handshake and does a small number of parameters exchanged during the handshake and does
not include parameters like the client and server identities. This not include parameters like the client and server identities. This
can be utilized by an attacker to mount a man-in-the-middle attack can be utilized by an attacker to mount a man-in-the-middle attack
since the master secret is not guaranteed to be unique across since the master secret is not guaranteed to be unique across
sessions, as discovered in the 'Triple Handshake' attack [Triple-HS]. sessions, as discovered in the 'Triple Handshake' attack [Triple-HS].
skipping to change at page 40, line 31 skipping to change at page 40, line 23
Client implementations SHOULD implement this extension even though Client implementations SHOULD implement this extension even though
the ciphersuites recommended by this profile are not vulnerable to the ciphersuites recommended by this profile are not vulnerable to
this attack. For Diffie-Hellman-based ciphersuites the keying this attack. For Diffie-Hellman-based ciphersuites the keying
material is contributed by both parties and in case of the pre-shared material is contributed by both parties and in case of the pre-shared
secret key ciphersuite, both parties need to be in possession of the secret key ciphersuite, both parties need to be in possession of the
shared secret to ensure that the handshake completes successfully. shared secret to ensure that the handshake completes successfully.
It is, however, possible that some application layer protocols will It is, however, possible that some application layer protocols will
tunnel other authentication protocols on top of DTLS making this tunnel other authentication protocols on top of DTLS making this
attack relevant again. attack relevant again.
19. Re-Negotiation Attacks 17. Re-Negotiation Attacks
TLS/DTLS allows a client and a server who already have a TLS/DTLS TLS/DTLS allows a client and a server who already have a TLS/DTLS
connection to negotiate new parameters, generate new keys, etc by connection to negotiate new parameters, generate new keys, etc by
using the re-negotiation feature. Renegotiation happens in the using the re-negotiation feature. Renegotiation happens in the
existing connection, with the new handshake packets being encrypted existing connection, with the new handshake packets being encrypted
along with application data. Upon completion of the re-negotiation along with application data. Upon completion of the re-negotiation
procedure the new channel replaces the old channel. procedure the new channel replaces the old channel.
As described in RFC 5746 [RFC5746] there is no cryptographic binding As described in RFC 5746 [RFC5746] there is no cryptographic binding
between the two handshakes, although the new handshake is carried out between the two handshakes, although the new handshake is carried out
using the cryptographic parameters established by the original using the cryptographic parameters established by the original
handshake. handshake.
To prevent the re-negotiation attack [RFC5746] this specification To prevent the re-negotiation attack [RFC5746] this specification
RECOMMENDS to disable the TLS renegotiation feature. Clients MUST RECOMMENDS to disable the TLS renegotiation feature. Clients MUST
respond to server-initiated re-negotiation attempts with an alert respond to server-initiated re-negotiation attempts with an alert
message (no_renegotiation) and clients MUST NOT initiate them. message (no_renegotiation) and clients MUST NOT initiate them.
20. Downgrading Attacks 18. Downgrading Attacks
When a client sends a ClientHello with a version higher than the When a client sends a ClientHello with a version higher than the
highest version known to the server, the server is supposed to reply highest version known to the server, the server is supposed to reply
with ServerHello.version equal to the highest version known to the with ServerHello.version equal to the highest version known to the
server and the handshake can proceed. This behavior is known as server and the handshake can proceed. This behavior is known as
version tolerance. Version-intolerance is when the server (or a version tolerance. Version-intolerance is when the server (or a
middlebox) breaks the handshake when it sees a ClientHello.version middlebox) breaks the handshake when it sees a ClientHello.version
higher than what it knows about. This is the behavior that leads higher than what it knows about. This is the behavior that leads
some clients to re-run the handshake with lower version. As a some clients to re-run the handshake with lower version. As a
result, a potential security vulnerability is introduced when a result, a potential security vulnerability is introduced when a
system is running an old TLS/SSL version (e.g., because of the need system is running an old TLS/SSL version (e.g., because of the need
to integrate with legacy systems). In the worst case, this allows an to integrate with legacy systems). In the worst case, this allows an
attacker to downgrade the protocol handshake to SSL 3.0. SSL 3.0 is attacker to downgrade the protocol handshake to SSL 3.0. SSL 3.0 is
so broken that there is no secure cipher available for it (see so broken that there is no secure cipher available for it (see
[I-D.ietf-tls-sslv3-diediedie]). [RFC7568]).
The above-described downgrade vulnerability is solved by the TLS The above-described downgrade vulnerability is solved by the TLS
Fallback Signaling Cipher Suite Value (SCSV) [RFC7507] extension. Fallback Signaling Cipher Suite Value (SCSV) [RFC7507] extension.
However, the solution is not applicable to implementations conforming However, the solution is not applicable to implementations conforming
to this profile since the version negotiation MUST use TLS/DTLS to this profile since the version negotiation MUST use TLS/DTLS
version 1.2 (or higher). More specifically, this implies: version 1.2 (or higher). More specifically, this implies:
o Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in o Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in
the ClientHello. the ClientHello.
skipping to change at page 41, line 43 skipping to change at page 41, line 32
o Servers MUST fail the handshake by sending a protocol_version o Servers MUST fail the handshake by sending a protocol_version
fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated. fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated.
Note that the aborted connection is non-resumable. Note that the aborted connection is non-resumable.
If at some time in the future this profile reaches the quality of SSL If at some time in the future this profile reaches the quality of SSL
3.0 a software update is needed since constrained devices are 3.0 a software update is needed since constrained devices are
unlikely to run multiple TLS/DTLS versions due to memory size unlikely to run multiple TLS/DTLS versions due to memory size
restrictions. restrictions.
21. Crypto Agility 19. Crypto Agility
This document recommends software and chip manufacturers to implement This document recommends software and chip manufacturers to implement
AES and the CCM mode of operation. This document references the CoAP AES and the CCM mode of operation. This document references the CoAP
recommended ciphersuite choices, which have been selected based on recommended ciphersuite choices, which have been selected based on
implementation and deployment experience from the IoT community. implementation and deployment experience from the IoT community.
Over time the preference for algorithms will, however, change. Not Over time the preference for algorithms will, however, change. Not
all components of a ciphersuite are likely to change at the same all components of a ciphersuite are likely to change at the same
speed. Changes are more likely expected for ciphers, the mode of speed. Changes are more likely expected for ciphers, the mode of
operation, and the hash algorithms. The recommended key lengths have operation, and the hash algorithms. The recommended key lengths have
to be adjusted over time as well. Some deployment environments will to be adjusted over time as well. Some deployment environments will
skipping to change at page 42, line 46 skipping to change at page 42, line 38
of speed-up carryless multiplications. of speed-up carryless multiplications.
As a recommendation for developers and product architects we suggest As a recommendation for developers and product architects we suggest
that sufficient headroom is provided to allow an upgrade to a newer that sufficient headroom is provided to allow an upgrade to a newer
cryptographic algorithms over the lifetime of the product. As an cryptographic algorithms over the lifetime of the product. As an
example, while AES-CCM is recommended throughout this specification example, while AES-CCM is recommended throughout this specification
future products might use the ChaCha20 cipher in combination with the future products might use the ChaCha20 cipher in combination with the
Poly1305 authenticator [RFC7539]. The assumption is made that a Poly1305 authenticator [RFC7539]. The assumption is made that a
robust software update mechanism is offered. robust software update mechanism is offered.
22. Key Length Recommendations 20. Key Length Recommendations
RFC 4492 [RFC4492] gives approximate comparable key sizes for RFC 4492 [RFC4492] gives approximate comparable key sizes for
symmetric- and asymmetric-key cryptosystems based on the best-known symmetric- and asymmetric-key cryptosystems based on the best-known
algorithms for attacking them. While other publications suggest algorithms for attacking them. While other publications suggest
slightly different numbers, such as [Keylength], the approximate slightly different numbers, such as [Keylength], the approximate
relationship still holds true. Figure 12 illustrates the comparable relationship still holds true. Figure 12 illustrates the comparable
key sizes in bits. key sizes in bits.
Symmetric | ECC | DH/DSA/RSA Symmetric | ECC | DH/DSA/RSA
------------+---------+------------- ------------+---------+-------------
skipping to change at page 43, line 41 skipping to change at page 43, line 39
Note that the recommendations for 112-bit symmetric keys are chosen Note that the recommendations for 112-bit symmetric keys are chosen
conservatively under the assumption that IoT devices have a long conservatively under the assumption that IoT devices have a long
expected lifetime (such as 10+ years) and that this key length expected lifetime (such as 10+ years) and that this key length
recommendation refers to the long-term keys used for device recommendation refers to the long-term keys used for device
authentication. Keys, which are provisioned dynamically, for the authentication. Keys, which are provisioned dynamically, for the
protection of transactional data (such as ephemeral Diffie-Hellman protection of transactional data (such as ephemeral Diffie-Hellman
keys used in various TLS/DTLS ciphersuites) may be shorter keys used in various TLS/DTLS ciphersuites) may be shorter
considering the sensitivity of the exchanged data. considering the sensitivity of the exchanged data.
23. False Start 21. False Start
A full TLS handshake as specified in [RFC5246] requires two full A full TLS handshake as specified in [RFC5246] requires two full
protocol rounds (four flights) before the handshake is complete and protocol rounds (four flights) before the handshake is complete and
the protocol parties may begin to send application data. the protocol parties may begin to send application data.
An abbreviated handshake (resuming an earlier TLS session) is An abbreviated handshake (resuming an earlier TLS session) is
complete after three flights, thus adding just one round-trip time if complete after three flights, thus adding just one round-trip time if
the client sends application data first. the client sends application data first.
If the conditions outlined in [I-D.ietf-tls-falsestart] are met, If the conditions outlined in [I-D.ietf-tls-falsestart] are met,
skipping to change at page 44, line 27 skipping to change at page 44, line 23
such as AES-128-CCM such as AES-128-CCM
o Client certificate types, such as ecdsa_sign o Client certificate types, such as ecdsa_sign
o Key exchange methods, such as ECDHE_ECDSA o Key exchange methods, such as ECDHE_ECDSA
Based on the improvement over a full round-trip for the full TLS/DTLS Based on the improvement over a full round-trip for the full TLS/DTLS
exchange this specification RECOMMENDS the use of the False Start exchange this specification RECOMMENDS the use of the False Start
mechanism when clients send application data first. mechanism when clients send application data first.
24. Privacy Considerations 22. Privacy Considerations
The DTLS handshake exchange conveys various identifiers, which can be The DTLS handshake exchange conveys various identifiers, which can be
observed by an on-path eavesdropper. For example, the DTLS PSK observed by an on-path eavesdropper. For example, the DTLS PSK
exchange reveals the PSK identity, the supported extensions, the exchange reveals the PSK identity, the supported extensions, the
session id, algorithm parameters, etc. When session resumption is session id, algorithm parameters, etc. When session resumption is
used then individual TLS sessions can be correlated by an on-path used then individual TLS sessions can be correlated by an on-path
adversary. With many IoT deployments it is likely that keying adversary. With many IoT deployments it is likely that keying
material and their identifiers are persistent over a longer period of material and their identifiers are persistent over a longer period of
time due to the cost of updating software on these devices. time due to the cost of updating software on these devices.
skipping to change at page 45, line 25 skipping to change at page 45, line 22
may initiate messaging when a person enters a building. While TLS/ may initiate messaging when a person enters a building. While TLS/
DTLS would offer confidentiality protection of the transmitted DTLS would offer confidentiality protection of the transmitted
information it does not help to conceal all communication patterns. information it does not help to conceal all communication patterns.
Furthermore, the IP header, which is not protected by TLS/DTLS, Furthermore, the IP header, which is not protected by TLS/DTLS,
additionally reveals information about the other communication additionally reveals information about the other communication
endpoint. For applications where such privacy concerns exist endpoint. For applications where such privacy concerns exist
additional safeguards are required, such as injecting dummy traffic additional safeguards are required, such as injecting dummy traffic
and onion routing. A detailed treatment of such solutions is outside and onion routing. A detailed treatment of such solutions is outside
the scope of this document and requires a system-level view. the scope of this document and requires a system-level view.
25. Security Considerations 23. Security Considerations
This entire document is about security. This entire document is about security.
We would also like to point out that designing a software update We would also like to point out that designing a software update
mechanism into an IoT system is crucial to ensure that both mechanism into an IoT system is crucial to ensure that both
functionality can be enhanced and that potential vulnerabilities can functionality can be enhanced and that potential vulnerabilities can
be fixed. This software update mechanism is important for changing be fixed. This software update mechanism is important for changing
configuration information, for example, trust anchors and other configuration information, for example, trust anchors and other
keying related information. Such a suitable software update keying related information. Such a suitable software update
mechanism is available with the Lightweight Machine-to-Machine mechanism is available with the Lightweight Machine-to-Machine
(LWM2M) protocol published by the Open Mobile Alliance (OMA) [LWM2M]. (LWM2M) protocol published by the Open Mobile Alliance (OMA) [LWM2M].
26. IANA Considerations 24. IANA Considerations
This document includes no request to IANA. This document includes no request to IANA.
27. Acknowledgments 25. Acknowledgments
Thanks to Derek Atkins, Olaf Bergmann, Paul Bakker, Robert Cragie, Thanks to Derek Atkins, Olaf Bergmann, Paul Bakker, Carsten Bormann,
Russ Housley, Rene Hummen, Jayaraghavendran K, Matthias Kovatsch, Brian Carpenter, Robert Cragie, Russ Housley, Rene Hummen,
Sandeep Kumar, Sye Loong Keoh, Simon Lemay, Alexey Melnikov, Manuel Jayaraghavendran K, Matthias Kovatsch, Sandeep Kumar, Sye Loong Keoh,
Pegourie-Gonnard, Akbar Rahman, Eric Rescorla, Michael Richardson, Simon Lemay, Alexey Melnikov, Gabriel Montenegro, Manuel Pegourie-
Ludwig Seitz, Zach Shelby, Michael StJohns, Rene Struik, and Sean Gonnard, Akbar Rahman, Eric Rescorla, Michael Richardson, Ludwig
Turner for their helpful comments and discussions that have shaped Seitz, Zach Shelby, Michael StJohns, Rene Struik, Sean Turner, and
Tina Tsou for their helpful comments and discussions that have shaped
the document. the document.
Big thanks also to Klaus Hartke, who wrote the initial version of Big thanks also to Klaus Hartke, who wrote the initial version of
this document. this document.
Finally, we would like to thank our area director (Stephen Farrell) Finally, we would like to thank our area director (Stephen Farrell)
and our working group chairs (Zach Shelby and Dorothy Gellert) for and our working group chairs (Zach Shelby and Dorothy Gellert) for
their support. their support.
28. References 26. References
28.1. Normative References 26.1. Normative References
[EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64)
REGISTRATION AUTHORITY", April 2010, REGISTRATION AUTHORITY", URL:
<https://standards.ieee.org/regauth/oui/tutorials/ https://standards.ieee.org/regauth/oui/tutorials/
EUI64.html>. EUI64.html, April 2010.
[GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation [GSM-SMS] ETSI, "3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation
Partnership Project; Technical Specification Group Core Partnership Project; Technical Specification Group Core
Network and Terminals; Technical realization of the Short Network and Terminals; Technical realization of the Short
Message Service (SMS) (Release 7)", March 2007. Message Service (SMS) (Release 7)", March 2007.
[I-D.ietf-tls-cached-info] [I-D.ietf-tls-cached-info]
Santesson, S. and H. Tschofenig, "Transport Layer Security Santesson, S. and H. Tschofenig, "Transport Layer Security
(TLS) Cached Information Extension", draft-ietf-tls- (TLS) Cached Information Extension", draft-ietf-tls-
cached-info-19 (work in progress), March 2015. cached-info-19 (work in progress), March 2015.
skipping to change at page 47, line 46 skipping to change at page 47, line 41
June 2014, <http://www.rfc-editor.org/info/rfc7250>. June 2014, <http://www.rfc-editor.org/info/rfc7250>.
[RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- [RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES-
CCM Elliptic Curve Cryptography (ECC) Cipher Suites for CCM Elliptic Curve Cryptography (ECC) Cipher Suites for
TLS", RFC 7251, DOI 10.17487/RFC7251, June 2014, TLS", RFC 7251, DOI 10.17487/RFC7251, June 2014,
<http://www.rfc-editor.org/info/rfc7251>. <http://www.rfc-editor.org/info/rfc7251>.
[WAP-WDP] Wireless Application Protocol Forum, "Wireless Datagram [WAP-WDP] Wireless Application Protocol Forum, "Wireless Datagram
Protocol", June 2001. Protocol", June 2001.
28.2. Informative References 26.2. Informative References
[ACE-WG] IETF, "Authentication and Authorization for Constrained [ACE-WG] IETF, "Authentication and Authorization for Constrained
Environments (ace) Working Group", URL: Environments (ace) Working Group", URL:
https://datatracker.ietf.org/wg/ace/charter/, Jan 2015. https://datatracker.ietf.org/wg/ace/charter/, Jan 2015.
[AES] National Institute of Standards and Technology, "FIPS PUB [AES] National Institute of Standards and Technology, "FIPS PUB
197, Advanced Encryption Standard (AES)", 197, Advanced Encryption Standard (AES)", URL:
https://www.iana.org/assignments/tls-parameters/tls- http://csrc.nist.gov/publications/fips/fips197/
parameters.xhtml#tls-parameters-4, November 2001. fips-197.pdf, November 2001.
[CCM] National Institute of Standards and Technology, "Special [CCM] National Institute of Standards and Technology, "Special
Publication 800-38C, Recommendation for Block Cipher Modes Publication 800-38C, Recommendation for Block Cipher Modes
of Operation: The CCM Mode for Authentication and of Operation: The CCM Mode for Authentication and
Confidentiality", http://csrc.nist.gov/publications/ Confidentiality", http://csrc.nist.gov/publications/
nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf, May nistpubs/800-38C/SP800-38C_updated-July20_2007.pdf, May
2004. 2004.
[CRIME] Wikipedia, "CRIME Security Exploit", HTML
https://en.wikipedia.org/wiki/CRIME, June 2001.
[ENISA-Report2013] [ENISA-Report2013]
ENISA, "Algorithms, Key Sizes and Parameters Report - ENISA, "Algorithms, Key Sizes and Parameters Report -
2013", https://www.enisa.europa.eu/activities/identity- 2013", URL: https://www.enisa.europa.eu/activities/
and-trust/library/deliverables/algorithms-key-sizes-and- identity-and-trust/library/deliverables/algorithms-key-
parameters-report, October 2013. sizes-and-parameters-report, October 2013.
[HomeGateway] [HomeGateway]
Eggert, L., "An experimental study of home gateway Eggert, L., "An experimental study of home gateway
characteristics, In Proceedings of the '10th annual characteristics, In Proceedings of the '10th annual
conference on Internet measurement'", 2010. conference on Internet measurement'", PDF
https://eggert.org/papers/2010-imc-hgw-study.pdf, 2010.
[I-D.ietf-core-resource-directory] [I-D.ietf-core-resource-directory]
Shelby, Z., Koster, M., Bormann, C., and P. Stok, "CoRE Shelby, Z., Koster, M., Bormann, C., and P. Stok, "CoRE
Resource Directory", draft-ietf-core-resource-directory-04 Resource Directory", draft-ietf-core-resource-directory-04
(work in progress), July 2015. (work in progress), July 2015.
[I-D.ietf-tls-falsestart] [I-D.ietf-tls-falsestart]
Langley, A., Modadugu, N., and B. Moeller, "Transport Langley, A., Modadugu, N., and B. Moeller, "Transport
Layer Security (TLS) False Start", draft-ietf-tls- Layer Security (TLS) False Start", draft-ietf-tls-
falsestart-00 (work in progress), May 2015. falsestart-00 (work in progress), May 2015.
[I-D.ietf-tls-negotiated-dl-dhe] [I-D.ietf-tls-negotiated-dl-dhe]
Gillmor, D., "Negotiated Discrete Log Diffie-Hellman Gillmor, D., "Negotiated Discrete Log Diffie-Hellman
Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- Ephemeral Parameters for TLS", draft-ietf-tls-negotiated-
dl-dhe-00 (work in progress), July 2014. dl-dhe-00 (work in progress), July 2014.
[I-D.ietf-tls-sslv3-diediedie]
Barnes, R., Thomson, M., Pironti, A., and A. Langley,
"Deprecating Secure Sockets Layer Version 3.0", draft-
ietf-tls-sslv3-diediedie-03 (work in progress), April
2015.
[I-D.irtf-cfrg-curves] [I-D.irtf-cfrg-curves]
Langley, A. and R. Salz, "Elliptic Curves for Security", Langley, A. and M. Hamburg, "Elliptic Curves for
draft-irtf-cfrg-curves-02 (work in progress), March 2015. Security", draft-irtf-cfrg-curves-08 (work in progress),
September 2015.
[I-D.schmertmann-dice-ccm-psk-pfs] [I-D.schmertmann-dice-ccm-psk-pfs]
Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher
Suites with Forward Secrecy for Transport Layer Security Suites with Forward Secrecy for Transport Layer Security
(TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in (TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in
progress), August 2014. progress), August 2014.
[I-D.tschofenig-core-coap-tcp-tls]
Bormann, C., Lemay, S., Technologies, Z., and H.
Tschofenig, "A TCP and TLS Transport for the Constrained
Application Protocol (CoAP)", draft-tschofenig-core-coap-
tcp-tls-04 (work in progress), June 2015.
[IANA-TLS] [IANA-TLS]
IANA, "TLS Cipher Suite Registry", IANA, "TLS Cipher Suite Registry", URL:
https://www.iana.org/assignments/tls-parameters/tls- https://www.iana.org/assignments/tls-parameters/tls-
parameters.xhtml#tls-parameters-4, 2014. parameters.xhtml#tls-parameters-4, 2014.
[ImprintingSurvey] [ImprintingSurvey]
Chilton, E., "A Brief Survey of Imprinting Options for Chilton, E., "A Brief Survey of Imprinting Options for
Constrained Devices", URL: http://www.lix.polytechnique.fr Constrained Devices", URL: http://www.lix.polytechnique.fr
/hipercom/SmartObjectSecurity/papers/EricRescorla.pdf, /hipercom/SmartObjectSecurity/papers/EricRescorla.pdf,
March 2012. March 2012.
[Keylength] [Keylength]
Giry, D., "Cryptographic Key Length Recommendations", Giry, D., "Cryptographic Key Length Recommendations", URL:
http://www.keylength.com, November 2014. http://www.keylength.com, November 2014.
[LWM2M] Open Mobile Alliance, "Lightweight Machine-to-Machine, [LWM2M] Open Mobile Alliance, "Lightweight Machine-to-Machine,
Technical Specification, Candidate Version 1.0", December Technical Specification, Candidate Version 1.0", HTML
2013. http://openmobilealliance.org/about-oma/work-program/
m2m-enablers/, December 2013.
[RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery [RFC1981] McCann, J., Deering, S., and J. Mogul, "Path MTU Discovery
for IP version 6", RFC 1981, DOI 10.17487/RFC1981, August for IP version 6", RFC 1981, DOI 10.17487/RFC1981, August
1996, <http://www.rfc-editor.org/info/rfc1981>. 1996, <http://www.rfc-editor.org/info/rfc1981>.
[RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed- [RFC2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC: Keyed-
Hashing for Message Authentication", RFC 2104, DOI Hashing for Message Authentication", RFC 2104, DOI
10.17487/RFC2104, February 1997, 10.17487/RFC2104, February 1997,
<http://www.rfc-editor.org/info/rfc2104>. <http://www.rfc-editor.org/info/rfc2104>.
skipping to change at page 53, line 20 skipping to change at page 53, line 20
[RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre, [RFC7525] Sheffer, Y., Holz, R., and P. Saint-Andre,
"Recommendations for Secure Use of Transport Layer "Recommendations for Secure Use of Transport Layer
Security (TLS) and Datagram Transport Layer Security Security (TLS) and Datagram Transport Layer Security
(DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
2015, <http://www.rfc-editor.org/info/rfc7525>. 2015, <http://www.rfc-editor.org/info/rfc7525>.
[RFC7539] Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF [RFC7539] Nir, Y. and A. Langley, "ChaCha20 and Poly1305 for IETF
Protocols", RFC 7539, DOI 10.17487/RFC7539, May 2015, Protocols", RFC 7539, DOI 10.17487/RFC7539, May 2015,
<http://www.rfc-editor.org/info/rfc7539>. <http://www.rfc-editor.org/info/rfc7539>.
[RFC7568] Barnes, R., Thomson, M., Pironti, A., and A. Langley,
"Deprecating Secure Sockets Layer Version 3.0", RFC 7568,
DOI 10.17487/RFC7568, June 2015,
<http://www.rfc-editor.org/info/rfc7568>.
[SP800-107-rev1] [SP800-107-rev1]
NIST, "NIST Special Publication 800-107, Revision 1, NIST, "NIST Special Publication 800-107, Revision 1,
Recommendation for Applications Using Approved Hash Recommendation for Applications Using Approved Hash
Algorithms", http://csrc.nist.gov/publications/ Algorithms", URL: http://csrc.nist.gov/publications/
nistpubs/800-107-rev1/sp800-107-rev1.pdf, August 2012. nistpubs/800-107-rev1/sp800-107-rev1.pdf, August 2012.
[SP800-22b] [SP800-22b]
National Institute of Standards and Technology, "Special National Institute of Standards and Technology, "Special
Publication 800-22, Revision 1a, A Statistical Test Suite Publication 800-22, Revision 1a, A Statistical Test Suite
for Random and Pseudorandom Number Generators for for Random and Pseudorandom Number Generators for
Cryptographic Applications", Cryptographic Applications", URL:
http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/ http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/
SP800-22rev1a.pdf, April 2010. SP800-22rev1a.pdf, April 2010.
[SP800-90A] [SP800-90A]
NIST, "DRAFT Special Publication 800-90a, Revision 1, NIST, "DRAFT Special Publication 800-90a, Revision 1,
Recommendation for Random Number Generation Using Recommendation for Random Number Generation Using
Deterministic Random Bit Generators", Deterministic Random Bit Generators", URL:
http://csrc.nist.gov/publications/drafts/800-90/ http://csrc.nist.gov/publications/drafts/800-90/
sp800-90a_r1_draft_november2014_ver.pdf, November 2014. sp800-90a_r1_draft_november2014_ver.pdf, November 2014.
[Triple-HS] [Triple-HS]
Bhargavan, K., Delignat-Lavaud, C., Pironti, A., and P. Bhargavan, K., Delignat-Lavaud, C., Pironti, A., and P.
Strub, "Triple Handshakes and Cookie Cutters: Breaking and Strub, "Triple Handshakes and Cookie Cutters: Breaking and
Fixing Authentication over TLS", IEEE Symposium on Fixing Authentication over TLS", IEEE Symposium on
Security and Privacy, pages 98-113, 2014. Security and Privacy, pages 98-113, 2014.
Appendix A. Conveying DTLS over SMS Appendix A. Conveying DTLS over SMS
This section is normative for the use of DTLS over SMS. Timer This section is normative for the use of DTLS over SMS. Timer
recommendations are already outlined in Section 13 and also recommendations are already outlined in Section 11 and also
applicable to the transport of DTLS over SMS. applicable to the transport of DTLS over SMS.
This section requires readers to be familiar with the terminology and This section requires readers to be familiar with the terminology and
concepts described in [GSM-SMS], and [WAP-WDP]. concepts described in [GSM-SMS], and [WAP-WDP].
The remainder of this section assumes Mobile Stations are capable of The remainder of this section assumes Mobile Stations are capable of
producing and consuming 8-bit binary data encoded Transport Protocol producing and consuming 8-bit binary data encoded Transport Protocol
Data Units (TPDU). Data Units (TPDU).
A.1. Overview A.1. Overview
 End of changes. 104 change blocks. 
181 lines changed or deleted 193 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/