idnits 2.17.1 draft-mattsson-tls-cbor-cert-compress-00.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- -- The draft header indicates that this document updates draft-ietf-tls-certificate-, but the abstract doesn't seem to mention this, which it should. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == The document doesn't use any RFC 2119 keywords, yet seems to have RFC 2119 boilerplate text. -- The document date (March 09, 2020) is 1507 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Outdated reference: A later version (-43) exists of draft-ietf-tls-dtls13-34 == Outdated reference: A later version (-04) exists of draft-raza-ace-cbor-certificates-03 ** Obsolete normative reference: RFC 7049 (Obsoleted by RFC 8949) == Outdated reference: A later version (-08) exists of draft-ietf-emu-eaptlscert-01 == Outdated reference: A later version (-04) exists of draft-ietf-lake-reqs-01 Summary: 1 error (**), 0 flaws (~~), 6 warnings (==), 2 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 Network Working Group J. Preuss Mattsson 3 Internet-Draft G. Selander 4 Updates: draft-ietf-tls-certificate- Ericsson AB 5 compression (if approved) S. Raza 6 Intended status: Standards Track J. Hoeglund 7 Expires: September 10, 2020 RISE AB 8 M. Furuhed 9 Nexus Group 10 March 09, 2020 12 CBOR Certificate Algorithm for TLS Certificate Compression 13 draft-mattsson-tls-cbor-cert-compress-00 15 Abstract 17 Certificate chains often take up the majority of the bytes 18 transmitted in TLS handshakes. Large handshakes can cause problems, 19 particularly in constrained IoT environments. RFC 7925 defines a TLS 20 certificate profile for constrained IoT. General purpose compression 21 algorithms can in many cases not compress RFC 7925 profiled 22 certificates at all. By using the fact that the certificates are 23 profiled, the CBOR certificate compression algorithms can in many 24 cases compress RFC 7925 profiled certificates with over 50%. This 25 document specifies the CBOR certificate compression algorithm for use 26 with TLS Certificate Compression in TLS 1.3 and DTLS 1.3. 28 Status of This Memo 30 This Internet-Draft is submitted in full conformance with the 31 provisions of BCP 78 and BCP 79. 33 Internet-Drafts are working documents of the Internet Engineering 34 Task Force (IETF). Note that other groups may also distribute 35 working documents as Internet-Drafts. The list of current Internet- 36 Drafts is at https://datatracker.ietf.org/drafts/current/. 38 Internet-Drafts are draft documents valid for a maximum of six months 39 and may be updated, replaced, or obsoleted by other documents at any 40 time. It is inappropriate to use Internet-Drafts as reference 41 material or to cite them other than as "work in progress." 43 This Internet-Draft will expire on September 10, 2020. 45 Copyright Notice 47 Copyright (c) 2020 IETF Trust and the persons identified as the 48 document authors. All rights reserved. 50 This document is subject to BCP 78 and the IETF Trust's Legal 51 Provisions Relating to IETF Documents 52 (https://trustee.ietf.org/license-info) in effect on the date of 53 publication of this document. Please review these documents 54 carefully, as they describe your rights and restrictions with respect 55 to this document. Code Components extracted from this document must 56 include Simplified BSD License text as described in Section 4.e of 57 the Trust Legal Provisions and are provided without warranty as 58 described in the Simplified BSD License. 60 Table of Contents 62 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 63 2. Notational Conventions . . . . . . . . . . . . . . . . . . . 3 64 3. CBOR Certificate Compression Algorithm . . . . . . . . . . . 3 65 4. Security Considerations . . . . . . . . . . . . . . . . . . . 4 66 5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4 67 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 4 68 6.1. Normative References . . . . . . . . . . . . . . . . . . 4 69 6.2. Informative References . . . . . . . . . . . . . . . . . 5 70 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 5 71 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 5 73 1. Introduction 75 As stated in [I-D.ietf-tls-certificate-compression], certificate 76 chains often take up the majority of the bytes transmitted in TLS 77 handshakes. Large handshakes negatively affect latency, but can also 78 result in that the handshake cannot be completed 79 [I-D.ietf-emu-eaptlscert]. To reduce handshake sizes, 80 [I-D.ietf-tls-certificate-compression] specifies a mechanism for 81 lossless compression of certificate chains in TLS 1.3 and defines 82 three general purpose compression algorithms. 84 Large handshakes is particularly a problem for constrained IoT 85 environments [RFC7228] [I-D.ietf-lake-reqs]. [RFC7925] defines a 86 X.509 certificate profile for constrained IoT. The certificate 87 profile in [RFC7925] is defined for TLS/DTLS 1.2 but works also for 88 TLS 1.3 [RFC8446] and DTLS 1.3 [I-D.ietf-tls-dtls13]. For such 89 profiled IoT certificates, general purpose compression algorithms 90 such as zlib are however far from optimal and the general purpose 91 compression algorithms defined in 92 [I-D.ietf-tls-certificate-compression] can in many cases not compress 93 RFC 7925 profiled certificates at all. 94 [I-D.raza-ace-cbor-certificates] therefore defines a CBOR [RFC7049] 95 compression algorithm for RFC 7925 profiled certificates. The 96 algorithm works for all RFC 7925 profiled certificates and provide 97 significant reduction in size, in many cases over 50%. 99 This document specifies the CBOR certificate compression algorithm 100 [I-D.raza-ace-cbor-certificates] for use with TLS Certificate 101 Compression [I-D.ietf-tls-certificate-compression]. TLS Certificate 102 Compression can be used in TLS 1.3 [RFC8446] and DTLS 1.3 103 [I-D.ietf-tls-dtls13]. 105 2. Notational Conventions 107 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 108 "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and 109 "OPTIONAL" in this document are to be interpreted as described in BCP 110 14 [RFC2119] [RFC8174] when, and only when, they appear in all 111 capitals, as shown here. 113 3. CBOR Certificate Compression Algorithm 115 This document specifies the CBOR certificate compression algorithm 116 specified in Section 3 of [I-D.raza-ace-cbor-certificates] for use 117 with TLS Certificate Compression 118 [I-D.ietf-tls-certificate-compression]. TLS Certificate Compression 119 can be used in TLS 1.3 [RFC8446] and DTLS 1.3 [I-D.ietf-tls-dtls13]. 121 The CBOR Certificate compression algorithm takes as input a RFC 7925 122 profiled X.509 certificate. The output of the CBOR compression 123 algorithm is a CBOR Sequence [I-D.ietf-cbor-sequence], i.e. a 124 sequence of concatenated CBOR encoded CBOR data items [RFC7049]. 125 Compressed certificates can be analysed with any CBOR decoder and be 126 validated against the CDDL specification defined in Section 3 of 127 [I-D.raza-ace-cbor-certificates]. 129 The algorithm works for all RFC 7925 profiled certificates and 130 provide significant reduction in size, in many cases over 50%. An 131 example compression of a RFC 7925 profiled certificate is given 132 below. 134 +------------------+--------------+------------+--------------------+ 135 | | RFC 7925 | zlib | CBOR Certificate | 136 +------------------+---------------------------+--------------------+ 137 | Certificate Size | 314 | 295 | 136 | 138 +------------------+--------------+------------+--------------------+ 140 4. Security Considerations 142 The security considerations in [I-D.ietf-tls-certificate-compression] 143 and [I-D.raza-ace-cbor-certificates] apply. 145 5. IANA Considerations 147 This document registers the following entry in the "Certificate 148 Compression Algorithm IDs" registry under the "Transport Layer 149 Security (TLS) Extensions" heading. 151 +------------------+------------------------------+-----------------+ 152 | Algorithm Number | Description | Reference | 153 +------------------+------------------------------+-----------------+ 154 | TBD | CBOR Certificate | [this document] | 155 +------------------+------------------------------+-----------------+ 157 6. References 159 6.1. Normative References 161 [I-D.ietf-cbor-sequence] 162 Bormann, C., "Concise Binary Object Representation (CBOR) 163 Sequences", draft-ietf-cbor-sequence-02 (work in 164 progress), September 2019. 166 [I-D.ietf-tls-certificate-compression] 167 Ghedini, A. and V. Vasiliev, "TLS Certificate 168 Compression", draft-ietf-tls-certificate-compression-10 169 (work in progress), January 2020. 171 [I-D.ietf-tls-dtls13] 172 Rescorla, E., Tschofenig, H., and N. Modadugu, "The 173 Datagram Transport Layer Security (DTLS) Protocol Version 174 1.3", draft-ietf-tls-dtls13-34 (work in progress), 175 November 2019. 177 [I-D.raza-ace-cbor-certificates] 178 Raza, S., Hoglund, J., Selander, G., Mattsson, J., and M. 179 Furuhed, "CBOR Profile of X.509 Certificates", draft-raza- 180 ace-cbor-certificates-03 (work in progress), December 181 2019. 183 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 184 Requirement Levels", BCP 14, RFC 2119, 185 DOI 10.17487/RFC2119, March 1997, 186 . 188 [RFC7049] Bormann, C. and P. Hoffman, "Concise Binary Object 189 Representation (CBOR)", RFC 7049, DOI 10.17487/RFC7049, 190 October 2013, . 192 [RFC7925] Tschofenig, H., Ed. and T. Fossati, "Transport Layer 193 Security (TLS) / Datagram Transport Layer Security (DTLS) 194 Profiles for the Internet of Things", RFC 7925, 195 DOI 10.17487/RFC7925, July 2016, 196 . 198 [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 199 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, 200 May 2017, . 202 [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol 203 Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, 204 . 206 6.2. Informative References 208 [I-D.ietf-emu-eaptlscert] 209 Sethi, M., Mattsson, J., and S. Turner, "Handling Large 210 Certificates and Long Certificate Chains in TLS-based EAP 211 Methods", draft-ietf-emu-eaptlscert-01 (work in progress), 212 March 2020. 214 [I-D.ietf-lake-reqs] 215 Vucinic, M., Selander, G., Mattsson, J., and D. Garcia- 216 Carillo, "Requirements for a Lightweight AKE for OSCORE", 217 draft-ietf-lake-reqs-01 (work in progress), February 2020. 219 [RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for 220 Constrained-Node Networks", RFC 7228, 221 DOI 10.17487/RFC7228, May 2014, 222 . 224 Acknowledgments 226 The authors want to thank TBD for their valuable comments and 227 feedback. 229 Authors' Addresses 231 John Preuss Mattsson 232 Ericsson AB 234 Email: john.mattsson@ericsson.com 235 Goeran Selander 236 Ericsson AB 238 Email: goran.selander@ericsson.com 240 Shahid Raza 241 RISE AB 243 Email: shahid.raza@ri.se 245 Joel Hoeglund 246 RISE AB 248 Email: joel.hoglund@ri.se 250 Martin Furuhed 251 Nexus Group 253 Email: martin.furuhed@nexusgroup.com