One document matched: draft-ietf-dice-profile-01.xml
<?xml version="1.0" encoding="us-ascii"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY RFC2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC3552 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3552.xml">
<!ENTITY RFC4086 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4086.xml">
<!ENTITY RFC4279 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4279.xml">
<!ENTITY RFC5289 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5289.xml">
<!ENTITY RFC4492 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4492.xml">
<!ENTITY RFC6125 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6125.xml">
<!ENTITY RFC5934 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5934.xml">
<!ENTITY RFC5077 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5077.xml">
<!ENTITY RFC5246 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5246.xml">
<!ENTITY RFC5746 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5746.xml">
<!ENTITY RFC6066 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6066.xml">
<!ENTITY RFC6347 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6347.xml">
<!ENTITY RFC5280 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5280.xml">
<!ENTITY RFC6520 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6520.xml">
<!ENTITY RFC6961 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6961.xml">
<!ENTITY RFC6090 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6090.xml">
<!ENTITY RFC6973 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6973.xml">
<!ENTITY RFC6655 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6655.xml">
<!ENTITY RFC5116 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5116.xml">
<!ENTITY I-D.ietf-core-coap SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-core-coap.xml">
<!ENTITY I-D.mcgrew-tls-aes-ccm-ecc SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.mcgrew-tls-aes-ccm-ecc.xml">
<!ENTITY I-D.ietf-lwig-guidance SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-lwig-guidance.xml">
<!ENTITY I-D.ietf-lwig-terminology SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-lwig-terminology.xml">
<!ENTITY I-D.ietf-lwig-tls-minimal SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-lwig-tls-minimal.xml">
<!ENTITY I-D.ietf-tls-applayerprotoneg SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-applayerprotoneg.xml">
<!ENTITY I-D.ietf-tls-cached-info SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-cached-info.xml">
<!ENTITY I-D.ietf-tls-oob-pubkey SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-oob-pubkey.xml">
<!ENTITY I-D.bmoeller-tls-downgrade-scsv SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.bmoeller-tls-downgrade-scsv.xml">
<!ENTITY I-D.campagna-suitee SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.campagna-suitee.xml">
<!ENTITY I-D.cooper-ietf-privacy-requirements SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.cooper-ietf-privacy-requirements.xml">
<!ENTITY I-D.greevenbosch-tls-ocsp-lite SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.greevenbosch-tls-ocsp-lite.xml">
<!ENTITY I-D.gutmann-tls-encrypt-then-mac SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.gutmann-tls-encrypt-then-mac.xml">
<!ENTITY I-D.hummen-dtls-extended-session-resumption SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.hummen-dtls-extended-session-resumption.xml">
<!ENTITY I-D.pettersen-tls-version-rollback-removal SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.pettersen-tls-version-rollback-removal.xml">
<!ENTITY I-D.sheffer-tls-bcp SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.sheffer-tls-bcp.xml">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt"?>
<?rfc strict="yes"?>
<?rfc toc="yes"?>
<?rfc tocdepth="2"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="info" docName="draft-ietf-dice-profile-01.txt" ipr="trust200902">
<front>
<title abbrev="DTLS 1.2 Profile for IoT">A DTLS 1.2 Profile for the Internet of Things</title>
<author initials="K." surname="Hartke" fullname="Klaus Hartke">
<organization>Universitaet Bremen TZI</organization>
<address>
<postal>
<street>Postfach 330440</street>
<city>Bremen</city>
<code>D-28359</code>
<country>Germany</country>
</postal>
<phone>+49-421-218-63905</phone>
<email>hartke@tzi.org</email>
</address>
</author>
<author initials="H.T." surname="Tschofenig" fullname="Hannes Tschofenig ">
<organization>ARM Ltd.</organization>
<address>
<postal>
<street>110 Fulbourn Rd</street>
<city>Cambridge</city>
<code>CB1 9NJ</code>
<country>Great Britain</country>
</postal>
<email>Hannes.tschofenig@gmx.net </email>
<uri>http://www.tschofenig.priv.at</uri>
</address>
</author>
<date/>
<area>Security</area>
<workgroup>dice</workgroup>
<abstract>
<t>This document defines a DTLS profile that is suitable for Internet
of Things applications and is reasonably implementable on many
constrained devices.</t>
</abstract>
</front>
<middle>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Introduction" anchor="introduction">
<t>This document defines a <xref target="RFC6347">DTLS 1.2</xref>
profile that offers communication security for Internet of Things (IoT) applications and is reasonably implementable on
many constrained devices. It aims to meet the following goals:
<list style="symbols">
<t>Serve as a one-stop shop for implementers to know which pieces of the specification jungle contain relevant details.</t>
<t>Not alter the DTLS specification.</t>
<t>Not introduce any new extensions.</t>
<t>Align with the DTLS security modes of the <xref target="I-D.ietf-core-coap">Constrained Application Protocol (CoAP)</xref>.</t>
</list></t>
<t>DTLS is used to secure a number of applications run over an unreliable datagram transport. CoAP <xref target="I-D.ietf-core-coap"/> is one such protocol and has been designed specifically for use in IoT environments. CoAP can be secured a number of different ways, also called security modes. These security modes are as follows, see <xref target="psk"/>, <xref target="raw"/>, <xref target="certs"/> for additional details:
<list style="hanging">
<t hangText="No Security Protection at the Transport Layer:">No DTLS is used but instead application layer security functionality is assumed.</t>
<t hangText="Shared Secret-based DTLS Authentication:">DTLS supports the use of shared secrets <xref target="RFC4279"/>. This mode is useful if the number of communication relationships between the IoT device and servers is small and for very constrained devices. Shared secret-based authentication mechanisms offer good performance and require a minimum of data to be exchanged.</t>
<t hangText="DTLS Authentication using Asymmetric Cryptography:">TLS supports client and server authentication using asymmetric cryptography. Two approaches for validating these public keys are available. First, <xref target="I-D.ietf-tls-oob-pubkey"/> allows raw public keys to be used in TLS without the overhead of certificates. This approach requires out-of-band validation of the public key. Second, the use of X.509 certificates <xref target="RFC5280"/> with TLS is common on the Web today (at least for server-side authentication) and certain IoT environments may also re-use those capabilities. Certificates bind an identifier to the public key signed by a certification authority (CA). A trust anchor store has to be provisioned on the device to indicate what CAs are trusted. Furthermore, the certificate may contain a wealth of other information used to make authorization decisions.</t>
</list>
</t>
<t>As described in <xref target="I-D.ietf-lwig-tls-minimal"/>, an application designer
developing an IoT device needs to consider the security threats
and the security services that can be used to mitigate the threats. Enabling devices to upload data and retrieve configuration information,
inevitably requires that Internet-connected devices be able to
authenticate themselves to servers and vice versa as well as to ensure
that the data and information exchanged is integrity and confidentiality
protected. While these security services can be provided at different layers in the protocol stack the use of communication security, as offered by DTLS, has been very popular on the Internet and it is likely to be useful for IoT scenarios as well. In case the communication security features offered by DTLS meet the security requirements of your application the remainder of the document might offer useful guidance.</t>
<t>Not every IoT deployment will use CoAP but the discussion regarding choice of credentials and cryptographic algorithms will be very similar. As such, the discussions in this document are applicable beyond the use of the CoAP protocol.</t>
<t>The design of DTLS is intentionally very similar to TLS. Since DTLS operates on top of an unreliable datagram transport a few enhancements to the TLS structure are, however necessary. RFC 6347 explains these differences in great detail. As a short summary, for those not familiar with DTLS the differences
are:
<list style="symbols">
<t>An explicit sequence number and an epoch field is included in the TLS Record Layer. Section 4.1 of RFC 6347 explains the processing rules for these two new fields. The value used to compute the MAC is the 64-bit value formed by concatenating the epoch and the sequence number. </t>
<t>Stream ciphers must not be used with DTLS. The only stream cipher defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it is not recommended anymore even for use with TLS.</t>
<t>The TLS Handshake Protocol has been enhanced to include a stateless cookie exchange for Denial of Service (DoS) resistance. Furthermore, the header has been extended to deal with message loss, reordering, and fragmentation. Retransmission timers have been included to deal with message loss. For DoS protection a new handshake message, the HelloVerifyRequest, was added to DTLS. This handshake message is sent by the server and includes a stateless cookie, which is returned in a ClientHello message back to the server. This type of DoS protection mechanism has also been incorporated into the design of IKEv2. Although the exchange is optional for the server to execute, a client implementation has to be prepared to respond to it. </t>
</list>
</t>
</section>
<!-- **************************************************************** -->
<section title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref target="RFC2119"/>.
</t>
<t>Note that "Client" and "Server" in this document refer to TLS roles,
where the Client initiates the TLS handshake. This does not restrict the
interaction pattern of the protocols carried inside TLS as the record layer
allows bi-directional communication. In the case of CoAP the "Client" can
act as a CoAP Server or Client.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="arch" title="The Communication Model">
<t>This document describes a profile of DTLS 1.2 and, to be useful, it has to make assumptions about the envisioned communication architecture.</t>
<!-- Two communication architectures (and consequently two profiles of DTLS) are described in this document.
<section title="Constrained DTLS Client">
-->
<t>The communication architecture shown in <xref target="model"/> assumes a uni-cast communication interaction with an IoT device utilizing a DTLS client and that client interacts with one or multiple DTLS servers. <!-- Which server to contact is based on pre-configuration onto the client (e.g., as part of the firmware). This configuration information also includes information about the PSK identity and the corresponding secret to be used with that specific server. For asymmetric cryptography mutual authentication is assumed in this profile. For raw public keys the public key or the hash of the public key is assumed to be available to both parties. For certificate-based authentication the client may have a trust anchor store pre-populated, which allows the client to perform path validation for the certificate obtained during the handshake with the server. The client also needs to know which certificate or raw public key it has to use with a specific server.--> </t>
<t> Clients are preconfigured with the address or addresses of
servers (e.g., as part of the firmware) they will communicate with
as well as authentication information:</t>
<t><list style="symbols">
<t> For PSK-based authentication (see <xref target="psk"/>), this includes the
paired "PSK identity" and shared secret to be used with each server.</t>
<t> For raw public key-based authentication (see <xref target="raw"/>), this
includes either the server's public key or the hash of the server's
public key.</t>
<t> For certificate-based authentication (see <xref target="certs"/>), this may
include a pre-populated trust anchor store that allows the client
to perform path validation for the certificate obtained during the
handshake with the server.</t>
</list>
</t>
<t>This document only focuses on the description of the DTLS client-side functionality. </t>
<t><figure title="Constrained DTLS Client Profile." anchor="model">
<artwork>
<![CDATA[
+////////////////////////////////////+
| Configuration |
|////////////////////////////////////|
| Server A --> PSK Identity, PSK |
| Server B --> Public Key (Server B),|
| Public Key (Client) |
| Server C --> Public Key (Client), |
| Trust Anchor Store |
+------------------------------------+
oo
oooooo
o
+------+
|Client|---
+------+ \
\ ,-------.
,' `. +------+
/ IP-based \ |Server|
( Network ) | A |
\ / +------+
`. ,'
'---+---' +------+
| |Server|
| | B |
| +------+
|
| +------+
+----------------->|Server|
| C |
+------+
]]>
</artwork>
</figure>
</t>
<!--
</section>
<section title="Constrained DTLS Server">
<t>TBD: Text here describes the communication model for a constrained DTLS server.</t>
</section>
-->
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="The Ciphersuite Concept">
<t>TLS (and consequently DTLS) has the concept of ciphersuites
and an IANA registry <xref target="IANA-TLS"/> was created to register the suites. A ciphersuite (and the specification that defines it) contains the following information:
<list style="symbols">
<t>Authentication and Key Exchange Algorithm (e.g., PSK)</t>
<t>Cipher and Key Length (e.g., AES with 128 bit keys)</t>
<t>Mode of operation (e.g., CBC)</t>
<t>Hash Algorithm for Integrity Protection (e.g., SHA in combination with HMAC)</t>
<t>Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC with the SHA-256) </t>
<t>Misc information (e.g., length of authentication tags)</t>
<t>Information whether the ciphersuite is suitable for DTLS or only for TLS</t>
</list>
</t>
<t>The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a pre-shared authentication and key exchange algorithm. RFC 6655 <xref target="RFC6655"/> defines this ciphersuite. It uses the Advanced Encryption Standard (AES) encryption algorithm, which is a block cipher. Since the AES algorithm supports different key lengths (such as 128, 192 and 256 bits) this information has to be specified as well and the selected ciphersuite supports 128 bit keys. A block cipher encrypts plaintext in fixed-size blocks and AES operates on fixed block size of 128 bits. For messages exceeding 128 bits, the message is partitioned into 128-bit blocks and the AES cipher is applied to these input blocks with appropriate chaining, which is called mode of operation.</t>
<t>TLS 1.2 introduced Authenticated Encryption with Associated Data (AEAD) ciphersuites <xref target="RFC5116"/>. AEAD is a class of block cipher modes which encrypt (parts of) the message and authenticate the message simultaneously. Examples of such modes include the Counter with CBC-MAC (CCM) mode, and the Galois/Counter Mode (GCM).</t>
<t>Some AEAD ciphersuites have shorter
authentication tags and are therefore more suitable for networks with low bandwidth where small message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite that ends in "_8" has an 8-octet authentication tag, while the regular CCM ciphersuites have 16-octet
authentication tags.</t>
<t>TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in the TLS pseudo random function (PRF) with cipher-suite-specified PRFs. For this reason authors of more recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC algorithm and the hash functions used with the TLS PRF.</t>
<t>This document references the CoAP recommended ciphersuite choices, which have been selected based on implementation and deployment experience from the IoT community. Over time the preference for certain algorithms will, however, change. Not all components of a ciphersuite change at the same speed. Changes are more likely to expect for ciphers, the mode of operation, and the hash algorithms. Some deployment environments will also be impacted by local regulation, which might dictate a certain and less likely for public key algorithms (such as RSA vs. ECC).</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="psk" title="Pre-Shared Secret Authentication with DTLS">
<t>The use of pre-shared secret credentials is one of the most basic techniques for DTLS since it is both computational efficient and bandwidth conserving. Pre-shared secret based authentication was introduced to TLS with RFC 4279 <xref target="RFC4279"/>. The exchange shown in <xref target="dtls-psk"/> illustrates the DTLS exchange including the cookie exchange. While the server is not required to initiate a cookie exchange with every handshake, the client is required to implement and to react on it when challenged.</t>
<t><figure title="DTLS PSK Authentication including the Cookie Exchange." anchor="dtls-psk">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
<-------- HelloVerifyRequest
(contains cookie)
ClientHello -------->
(with cookie)
ServerHello
*ServerKeyExchange
<-------- ServerHelloDone
ClientKeyExchange
ChangeCipherSpec
Finished -------->
ChangeCipherSpec
<-------- Finished
Application Data <-------> Application Data
Legend:
* indicates an optional message payload
]]>
</artwork>
</figure>
</t>
<t><xref target="RFC4279"/> does not mandate the use of any particular type of identity. Hence, the TLS client and server clearly have to agree on the identities and keys to be used.
The mandated encoding of identities in Section 5.1 of RFC 4279 aims to improve interoperability for those cases where the identity is configured by a person using some management interface. Many IoT devices do, however, not have a user interface and most of their credentials are bound to the device rather than the user. Furthermore, credentials are provisioned into trusted hardware modules or in the firmware by the developers. As such, the encoding considerations are not applicable to this usage environment. For use with this profile the PSK identities SHOULD NOT assume a structured format (as domain names, Distinguished Names, or IP addresses have) and a bit-by-bit comparison operation can then be used by the server-side infrastructure.</t>
<t>As described in <xref target="arch"/> clients may have pre-shared keys with several different servers. The client indicates which key it uses by including a "PSK identity" in the ClientKeyExchange message. To help the client in selecting which PSK identity / PSK pair to use, the server can provide a "PSK identity hint" in the ServerKeyExchange message. For IoT environments a simplifying assumption is made that the hint for PSK key selection is based on the domain name of the server. Hence, servers SHOULD NOT send the "PSK identity hint" in the ServerKeyExchange message and client MUST ignore the message. This approach is inline with RFC 4279 <xref target="RFC4279"/>.</t>
<t>RFC 4279 requires TLS implementations supporting PSK ciphersuites to support arbitrary PSK identities up to 128 octets in length, and arbitrary PSKs up to 64 octets in length. This is a useful assumption for TLS stacks used in the desktop and mobile environment where management interfaces are used to provision identities and keys. For the IoT environment, however, many devices are not equipped with displays and input devices (e.g., keyboards). Hence, keys are distributed as part of hardware modules or are embedded into the firmware. As such, these restrictions are not applicable to this profile.</t>
<t><xref target="I-D.ietf-core-coap">Constrained Application Protocol (CoAP)</xref> currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite for use with shared secrets. This ciphersuite uses the AES algorithm with 128 bit keys and CCM as the mode of operation. The label "_8" indicates that an 8-octet authentication tag is used. This ciphersuite makes use of the default TLS 1.2 Pseudorandom Function (PRF), which uses HMAC with the SHA-256 hash function.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="raw" title="Raw Public Key Use with DTLS">
<t>The use of raw public keys with DTLS, as defined in <xref target="I-D.ietf-tls-oob-pubkey"/>, is the first entry point into public key cryptography without having to pay the price of certificates and a PKI. The specification re-uses the existing Certificate message to convey the raw public key encoded in the SubjectPublicKeyInfo structure. To indicate support two new TLS extensions had been defined, as shown in <xref target="dtls-raw"/>, namely the server_certificate_type and the client_certificate_type. To operate this mechanism securely it is necessary to authenticate and authorize the public keys out-of-band. This document therefore assumes that a client implementation comes with one or multiple raw public keys of servers, it has to communicate with, pre-provisioned. Additionally, a device will have its own raw public key. To replace, delete, or add raw public key to this list requires a software update, for example using a firmware update mechanism.</t>
<t>
<figure title="DTLS Raw Public Key Exchange including the Cookie Exchange." anchor="dtls-raw">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
client_certificate_type
server_certificate_type
<------- HelloVerifyRequest
ClientHello -------->
client_certificate_type
server_certificate_type
ServerHello
client_certificate_type
server_certificate_type
Certificate
ServerKeyExchange
CertificateRequest
<-------- ServerHelloDone
Certificate
ClientKeyExchange
CertificateVerify
[ChangeCipherSpec]
Finished -------->
[ChangeCipherSpec]
<-------- Finished
]]>
</artwork>
</figure>
</t>
<t>The CoAP recommended ciphersuite for use with this credential type is TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 <xref target="I-D.mcgrew-tls-aes-ccm-ecc"/>. This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite uses the Elliptic Curve Diffie Hellman (ECDHE) as the key establishment mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) for authentication. This ciphersuite make use of the AEAD capability in DTLS 1.2 and utilizes an eight-octet authentication tag. Based on the Diffie-Hellman it provides perfect forward secrecy (PFS). More details about the PFS can be found in <xref target="pfs"/>.</t>
<t>RFC 6090 <xref target="RFC6090"/> provides valuable information for implementing Elliptic Curve Cryptography algorithms.</t>
<t>Since many IoT devices will either have limited ways to log error or no ability at all, any error will lead to implementations attempting to re-try the exchange.</t>
<!-- <t>QUESTION: <xref target="I-D.sheffer-tls-bcp"/> recommends a different ciphersuite, namely TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 <xref target="RFC5289"/> or alternatively TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (with a 2048-bit or 1024 DH parameters as second and third priority, respectively). Is TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 a good choice?</t> -->
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="certs" title="Certificate Use with DTLS">
<t>The use of mutual certificate-based authentication is shown in <xref target="dtls-cert"/>, which makes use of the cached info extension <xref target="I-D.ietf-tls-cached-info"/>. Support of the cached info extension is required. Caching certificate chains allows the client to reduce the communication overhead significantly since otherwise the server would provide the end entity certificate, and the certificate chain. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority is omitted from the chain. Client implementations MUST be provisioned with a trust anchor store that contains the root certificates. The use of the Trust Anchor Management Protocol (TAMP) <xref target="RFC5934"/> is, however, not envisioned. Instead IoT devices using this profile MUST rely a software update mechanism to provision these trust anchors.</t>
<t>When DTLS is used to secure CoAP messages then the server provided certificates MUST contain the fully qualified DNS domain name or "FQDN". The coaps URI scheme is described in Section 6.2 of <xref target="I-D.ietf-core-coap"/>. This FQDN is stored in the SubjectAltName or in the CN, as explained in Section 9.1.3.3 of <xref target="I-D.ietf-core-coap"/>, and used by the client to match it against the FQDN used during the look-up process, as described in RFC 6125 <xref target="RFC6125"/>. For the profile in this specification does not assume dynamic discovery of local servers.</t>
<t>For client certificates the identifier used in the SubjectAltName or in the CN MUST be an EUI-64 <xref target="EUI64"/>, as mandated in Section 9.1.3.3 of <xref target="I-D.ietf-core-coap"/>.</t>
<t>For certificate revocation neither the Online Certificate Status Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. Instead, this profile relies on a software update mechanism. While multiple OCSP stapling <xref target="RFC6961"/> has recently been introduced as a mechanism to piggyback OCSP request/responses inside the DTLS/TLS handshake to avoid the cost of a separate protocol handshake further investigations are needed to determine its suitability for the IoT environment.</t>
<t><figure title="DTLS Mutual Certificate-based Authentication." anchor="dtls-cert">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
cached_information
<------- HelloVerifyRequest
ClientHello -------->
cached_information
ServerHello
cached_information
Certificate
ServerKeyExchange
CertificateRequest
<-------- ServerHelloDone
Certificate
ClientKeyExchange
CertificateVerify
[ChangeCipherSpec]
Finished -------->
[ChangeCipherSpec]
<-------- Finished
]]>
</artwork>
</figure>
</t>
<t>Regarding the ciphersuite choice the discussion in <xref target="raw"/> applies. Further details about X.509 certificates can be found in Section 9.1.3.3 of <xref target="I-D.ietf-core-coap"/>.</t>
<t>QUESTION: What restrictions regarding the depth of the certificate chain should be made? Is one level enough?</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Error Handling">
<t>DTLS uses the Alert protocol to convey error messages and specifies a longer list of errors. However, not all error messages defined in the TLS specification are applicable to this profile.
All error messages marked as RESERVED are only supported for backwards compatibility with SSL and are therefore not applicable to this profile. Those include decryption_failed_RESERVED, no_certificate_RESERVE, and export_restriction_RESERVED.
A number of the error messages are applicable only for certificate-based authentication ciphersuites. Hence, for PSK and raw public key use the following error messages are not applicable:
bad_certificate,
unsupported_certificate,
certificate_revoked,
certificate_expired,
certificate_unknown,
unknown_ca, and
access_denied.
</t>
<t>Since this profile does not make use of compression at the TLS layer the decompression_failure error message is not applicable either. </t>
<t>RFC 4279 introduced a new alert message unknown_psk_identity for PSK ciphersuites. As stated in Section 2 of RFC 4279 the decryption_error error message may also be used instead.
For this profile the TLS server MUST return the decryption_error error message instead of the unknown_psk_identity.</t>
<t>Furthermore, the following errors should not occur based on the description in this specification:
<list style="hanging">
<t hangText="protocol_version:">This document only focuses on one version of the DTLS protocol.</t>
<t hangText="insufficient_security:">This error message indicates that the server requires ciphers to be more secure. This document does, however, specify the only acceptable ciphersuites and client implementations must support them.</t>
<t hangText="user_canceled:">The IoT devices in focus of this specification are assumed to be unattended. </t>
</list>
</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Session Resumption">
<t>Session resumption is a feature of DTLS that allows a client to continue with an earlier established session state. The resulting exchange is shown in <xref target="resumption"/>. In addition, the server may choose not to do a cookie exchange when a session is resumed. Still, clients have to be prepared to do a cookie exchange with every handshake.</t>
<t>
<figure title="DTLS Session Resumption." anchor="resumption">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
ServerHello
[ChangeCipherSpec]
<-------- Finished
[ChangeCipherSpec]
Finished -------->
Application Data <-------> Application Data
]]>
</artwork>
</figure>
</t>
<t>Clients MUST implement session resumption to improve the performance of the handshake (in terms of reduced number of message exchanges, lower computational overhead, and less bandwidth conserved).</t>
<t>Since the communication model described in <xref target="arch"/> does not assume that the server is constrained. RFC 5077 <xref target="RFC5077"/> describing TLS session resumption without server-side state is not utilized by this profile.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="TLS Compression">
<t><xref target="I-D.sheffer-tls-bcp"/> recommends to always disable DTLS-level compression due to attacks. For IoT applications compression at the DTLS is not needed since application layer protocols are highly optimized and the compression algorithms at the DTLS layer increase code size and complexity. Hence, for use with this profile compression at the DTLS layer SHOULD NOT be implemented by the DTLS client.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="pfs" title="Perfect Forward Secrecy">
<t>Perfect forward secrecy is designed to prevent the compromise of a long-term secret key from affecting the confidentiality of past conversations. The PSK ciphersuite recommended in the CoAP specification <xref target="I-D.ietf-core-coap"/> does not offer this property. <xref target="I-D.sheffer-tls-bcp"/> on the other hand recommends using ciphersuites offering this security property.</t>
<t>QUESTION: Should the PSK ciphersuite offer PFS?</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Keep-Alive">
<t>RFC 6520 <xref target="RFC6520"/> defines a heartbeat mechanism to test whether the other peer is still alive. The same mechanism can also be used to perform path MTU discovery.</t>
<t>QUESTION: Do IoT deployments make use of this extension?</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Negotiation and Downgrading Attacks">
<t>CoAP demands version 1.2 of DTLS to be used and the earlier version of DTLS is not supported. As such, there is no risk of downgrading to an older version of DTLS. The work described in <xref target="I-D.bmoeller-tls-downgrade-scsv"/> is therefore also not applicable to this environment since there is no legacy server infrastructure to worry about.</t>
<t>QUESTION: Should we say something for non-CoAP use of DTLS?</t>
<t>To prevent the TLS renegotiation attack <xref target="RFC5746"/> clients MUST respond to server-initiated renegotiation attempts with an Alert message (no_renegotiation) and clients MUST NOT initiate them. TLS and DTLS allows a client and a server who already have a TLS connection to negotiate new parameters, generate new keys, etc by initiating a TLS handshake using a ClientHello message. Renegotiation happens in the existing TLS connection, with the new handshake packets being encrypted along with application data.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Privacy Considerations" anchor="privacy">
<t>The DTLS handshake exchange conveys various identifiers, which can be observed by an on-path eavesdropper. For example,
the DTLS PSK exchange reveals the PSK identity, the supported extensions, the session id, algorithm parameters, etc.
When session resumption is used then individual TLS sessions can be correlated by an on-path adversary.
With many IoT deployments it is likely that keying material and their identifiers
are persistent over a longer period of time due to the cost of updating software on these devices.</t>
<t>User participation with many IoT deployments poses a challenge since many of the IoT devices operate unattended, even though they will initially be enabled by a human.
The ability to control data sharing and to configure preference will have to be provided at a system level rather than at the level of a DTLS profile, which is the scope
of this document. Quite naturally, the use of DTLS with mutual authentication will allow a TLS server to collect authentication information about the IoT device (potentially over a long period of time). While this strong form of authentication will prevent mis-attribution it also allows strong identification. This device-related data collection (e.g., sensor recordings) will be associated with other data to be truly useful and this extra data might include personal data about the owner of the device or data about the environment it senses. Consequently, the data stored on the server-side will be vulnerable to stored data compromise. For the communication between the client and the server this specification prevents eavesdroppers to gain access to the communication content. While the PSK-based ciphersuite does not provide PFS the asymmetric version does. No explicit techniques, such as extra padding, have been provided to make traffic analysis more difficult.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Security Considerations" anchor="security">
<t>This entire document is about security.</t>
<t>The TLS protocol requires random numbers to be available during the protocol run. For example, during the ClientHello and the ServerHello exchange the client and the server exchange random numbers. Also, the use of the Diffie Hellman exchange requires random numbers during the key pair generation. Special care has to be paid when generating random numbers in embedded systems as many entropy sources available on desktop operating systems or mobile devices might be missing, as described in <xref target="Heninger"/>. Consequently, if not enough time is given during system start time to fill the entropy pool then the output might be predictable and repeatable, for example leading to the same keys generated again and again. Guidelines and requirements for random number generation can be found in RFC 4086 <xref target="RFC4086"/>.</t>
<t>We would also like to point out that designing a software update mechanism into an IoT system is crucial to ensure that both functionality can be enhanced and that potential vulnerabilities can be fixed. This software update mechanism is also useful for changing configuration information, for example, trust anchors and other keying related information.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="IANA Considerations" anchor="iana">
<t>This document includes no request to IANA.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Acknowledgements" anchor="acknowledgements">
<t>Thanks to
Rene Hummen,
Sye Loong Keoh,
Sandeep Kumar,
Eric Rescorla,
Zach Shelby, and
Sean Turner
for helpful comments and discussions that have shaped the document.</t>
</section>
</middle>
<back>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<references title="Normative References">
&RFC5246; <!-- TLS 1.2 -->
&RFC5746; <!-- Renegotiation Indication Extension -->
&RFC6066; <!-- Extension Definitions -->
&RFC6347; <!-- DTLS 1.2 -->
&RFC6520; <!-- Heartbeat Extension -->
&RFC4279; <!-- TLS PSK -->
&RFC6125; <!-- Server ID Check -->
&RFC2119; <!-- Requirements Terminology -->
&I-D.ietf-tls-cached-info;
&I-D.ietf-tls-oob-pubkey;
&I-D.mcgrew-tls-aes-ccm-ecc;
<reference anchor="EUI64" target="http://standards.ieee.org/regauth/oui/tutorials/EUI64.html">
<front>
<title>GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) REGISTRATION AUTHORITY</title>
<author><organization/></author><date month='April' day='23' year='2010' />
</front>
</reference>
</references>
<references title="Informative References">
&RFC4492;
&RFC5077;
&I-D.ietf-core-coap;
<reference anchor="IANA-TLS">
<front>
<title>TLS Cipher Suite Registry</title>
<author>
<organization>IANA</organization>
</author>
<date year="2014"/>
</front>
<seriesInfo name="" value="http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4"/>
</reference>
&I-D.ietf-tls-applayerprotoneg;
&RFC5289; <!-- TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM) -->
&RFC3552; <!-- Guidelines for Writing RFC Text on Security Considerations -->
&RFC4086; <!-- Randomness Requirements for Security -->
&RFC6973; <!-- Privacy Considerations for Internet Protocols -->
&RFC6090; <!-- Fundamental Elliptic Curve Cryptography Algorithms -->
&RFC5934; <!-- Trust Anchor Management Protocol (TAMP) -->
&RFC5280; <!-- Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile -->
&RFC6961; <!-- The Transport Layer Security (TLS) Multiple Certificate Status Request Extension -->
&RFC5116; <!-- An Interface and Algorithms for Authenticated Encryption -->
&RFC6655; <!-- AES-CCM Cipher Suites for Transport Layer Security (TLS)-->
&I-D.ietf-lwig-guidance;
&I-D.ietf-lwig-terminology;
&I-D.ietf-lwig-tls-minimal;
&I-D.bmoeller-tls-downgrade-scsv;
&I-D.campagna-suitee;
&I-D.cooper-ietf-privacy-requirements;
&I-D.greevenbosch-tls-ocsp-lite;
&I-D.gutmann-tls-encrypt-then-mac;
&I-D.hummen-dtls-extended-session-resumption;
&I-D.pettersen-tls-version-rollback-removal;
&I-D.sheffer-tls-bcp;
<reference anchor="Heninger">
<front>
<title>Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices</title>
<author initials="N" surname="Heninger" fullname="Nadia Heninger">
<organization/>
</author>
<author initials="Z" surname="Durumeric" fullname="Zakir Durumeric">
<organization/>
</author>
<author initials="E" surname="Wustrow" fullname="Eric Wustrow">
<organization/>
</author>
<author initials="A" surname="Halderman" fullname="Alex Halderman">
<organization/>
</author>
<date year="2012"/>
</front>
<seriesInfo name="" value="21st USENIX Security Symposium, https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/heninger"/>
</reference>
</references>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-22 20:53:04 |