One document matched: draft-ietf-dice-profile-09.xml
<?xml version="1.0" encoding="us-ascii"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY RFC1191 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.1191.xml">
<!ENTITY RFC1981 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.1981.xml">
<!ENTITY RFC2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!-- <!ENTITY RFC3552 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3552.xml"> -->
<!ENTITY RFC4086 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4086.xml">
<!ENTITY RFC4279 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4279.xml">
<!ENTITY RFC5758 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5758.xml">
<!-- <!ENTITY RFC5289 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5289.xml"> -->
<!ENTITY RFC4492 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4492.xml">
<!ENTITY RFC6125 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6125.xml">
<!ENTITY RFC5934 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5934.xml">
<!ENTITY RFC5077 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5077.xml">
<!ENTITY RFC5246 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5246.xml">
<!ENTITY RFC5746 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5746.xml">
<!ENTITY RFC6066 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6066.xml">
<!ENTITY RFC6347 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6347.xml">
<!ENTITY RFC5280 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5280.xml">
<!ENTITY RFC6520 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6520.xml">
<!ENTITY RFC6961 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6961.xml">
<!ENTITY RFC7400 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7400.xml">
<!ENTITY RFC6090 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6090.xml">
<!-- <!ENTITY RFC6973 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6973.xml"> -->
<!ENTITY RFC6655 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6655.xml">
<!ENTITY RFC5116 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5116.xml">
<!ENTITY RFC7252 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7252.xml">
<!ENTITY RFC7251 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7251.xml">
<!ENTITY RFC7228 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7228.xml">
<!ENTITY RFC4634 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4634.xml">
<!ENTITY RFC3610 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3610.xml">
<!ENTITY RFC5288 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5288.xml">
<!ENTITY RFC2104 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2104.xml">
<!ENTITY RFC4919 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4919.xml">
<!ENTITY RFC5247 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5247.xml">
<!ENTITY RFC5216 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5216.xml">
<!ENTITY RFC7397 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7397.xml">
<!ENTITY RFC7390 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7390.xml">
<!ENTITY RFC6690 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.6690.xml">
<!ENTITY I-D.iab-smart-object-architecture SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.iab-smart-object-architecture.xml">
<!ENTITY I-D.ietf-core-resource-directory SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-core-resource-directory.xml">
<!ENTITY I-D.ietf-tls-sslv3-diediedie SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-sslv3-diediedie.xml">
<!ENTITY I-D.bormann-core-cocoa SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.bormann-core-cocoa.xml">
<!ENTITY I-D.irtf-cfrg-chacha20-poly1305 SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.irtf-cfrg-chacha20-poly1305.xml">
<!ENTITY I-D.bmoeller-tls-falsestart SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.bmoeller-tls-falsestart.xml">
<!ENTITY I-D.ietf-tls-session-hash SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-session-hash.xml">
<!ENTITY I-D.ietf-tls-prohibiting-rc4 SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-prohibiting-rc4.xml">
<!ENTITY I-D.mathewson-no-gmtunixtime SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.mathewson-no-gmtunixtime.xml">
<!ENTITY RFC7366 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7366.xml">
<!ENTITY I-D.ietf-tls-negotiated-dl-dhe SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-negotiated-dl-dhe.xml">
<!ENTITY I-D.ietf-lwig-tls-minimal SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-lwig-tls-minimal.xml">
<!-- <!ENTITY I-D.ietf-tls-applayerprotoneg SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-applayerprotoneg.xml"> -->
<!ENTITY I-D.ietf-tls-cached-info SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-cached-info.xml">
<!ENTITY RFC7250 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7250.xml">
<!ENTITY I-D.ietf-tls-downgrade-scsv SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-tls-downgrade-scsv.xml">
<!-- <!ENTITY I-D.campagna-suitee SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.campagna-suitee.xml">
<!ENTITY I-D.cooper-ietf-privacy-requirements SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.cooper-ietf-privacy-requirements.xml">
<!ENTITY I-D.greevenbosch-tls-ocsp-lite SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.greevenbosch-tls-ocsp-lite.xml">
<!ENTITY I-D.hummen-dtls-extended-session-resumption SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.hummen-dtls-extended-session-resumption.xml">
<!ENTITY I-D.pettersen-tls-version-rollback-removal SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.pettersen-tls-version-rollback-removal.xml">-->
<!ENTITY I-D.ietf-uta-tls-bcp SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-uta-tls-bcp.xml">
<!ENTITY I-D.schmertmann-dice-ccm-psk-pfs SYSTEM "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.schmertmann-dice-ccm-psk-pfs.xml">
<!ENTITY RFC7258 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.7258.xml">
]>
<?xml-stylesheet type="text/xsl" href="rfc2629.xslt"?>
<?rfc strict="yes"?>
<?rfc toc="yes"?>
<?rfc tocdepth="2"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>
<rfc category="std" docName="draft-ietf-dice-profile-09.txt" ipr="trust200902">
<front>
<title abbrev="TLS/DTLS 1.2 IoT Profile">A TLS/DTLS 1.2 Profile for the Internet of Things</title>
<author role="editor" initials="H." surname="Tschofenig" fullname="Hannes Tschofenig ">
<organization>ARM Ltd.</organization>
<address>
<postal>
<street>110 Fulbourn Rd</street>
<city>Cambridge</city>
<code>CB1 9NJ</code>
<country>Great Britain</country>
</postal>
<email>Hannes.tschofenig@gmx.net </email>
<uri>http://www.tschofenig.priv.at</uri>
</address>
</author>
<author fullname="Thomas Fossati" initials="T." surname="Fossati">
<organization>Alcatel-Lucent</organization>
<address>
<postal>
<street>3 Ely Road</street>
<city>Milton, Cambridge</city>
<code>CB24 6DD</code>
<country>UK</country>
</postal>
<email>thomas.fossati@alcatel-lucent.com</email>
</address>
</author>
<date/>
<area>Security</area>
<workgroup>dice</workgroup>
<abstract>
<t>A common design pattern in Internet of Things (IoT) deployments is the use of a
constrained device (typically providing sensor data) that makes data
available for home automation, industrial control systems, smart
cities and other IoT deployments.</t>
<t>This document defines a Transport Layer Security (TLS) and Datagram TLS 1.2
profile that offers communications security for this data exchange thereby
preventing eavesdropping, tampering, and message forgery.</t>
</abstract>
</front>
<middle>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Introduction" anchor="introduction">
<t>An engineer developing an Internet of Things (IoT) device needs to
investigate the security threats and decide about the security services that can be
used to mitigate these threats.</t>
<t>Enabling IoT devices to make data available often requires
authentication of the two endpoints and the ability to provide
integrity- and confidentiality-protection of exchanged data. While
these security services can be provided at different layers in the
protocol stack the use of Transport Layer Security (TLS)/Datagram TLS
(DTLS) has been very popular with many application protocols and it
is likely to be useful for IoT scenarios as well.</t>
<t>To make Internet protocols fit constrained devices can be difficult
but thanks to the standardization efforts new profiles and protocols
are available, such as the Constrained Application Protocol (CoAP)
<xref target="RFC7252"/>. UDP is mainly used to carry CoAP messages but
other transports can be utilized, such as SMS or even TCP. </t>
<t>While this document is inspired by the desire to protect CoAP
messages using DTLS 1.2 <xref target="RFC6347"/> the guidance in this
document is not limited to CoAP nor to DTLS itself.</t>
<t>Instead, this document defines a profile of DTLS 1.2 <xref target="RFC6347"/>
and TLS 1.2 <xref target="RFC5246"/> that offers communication security
for IoT applications and is reasonably implementable on many constrained
devices. Profile thereby means that available configuration options
and protocol extensions are utilized to best support the IoT
environment. This document does not alter TLS/DTLS specifications and
does not introduce any new TLS/DTLS extensions.</t>
<t>The main target audience for this document is the embedded system
developer configuring and using a TLS/DTLS stack. This document may, however,
also help those developing or selecting a suitable TLS/DTLS stack for an
Internet of Things product development.</t>
</section>
<!-- **************************************************************** -->
<section title="Terminology">
<t>The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <xref target="RFC2119"/>.
</t>
<t>Note that "Client" and "Server" in this document refer to TLS/DTLS roles,
where the Client initiates the TLS/DTLS handshake. This does not restrict the
interaction pattern of the protocols on top of TLS/DTLS since the record layer
allows bi-directional communication. This aspect is further described in <xref target="arch"/>.</t>
<t>RFC 7228 <xref target="RFC7228"/> introduces the notion of constrained-node
networks, which are small devices with severe constraints on power, memory, and
processing resources. The terms constrained devices, and Internet of Things (IoT)
devices are used interchangeably.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="TLS/DTLS Protocol Overview">
<t>The TLS protocol <xref target="RFC5246"/> provides authenticated, confidentiality- and integrity-protected communication between two endpoints. The protocol is composed of two layers: the Record Protocol and the Handshake Protocol. At the lowest level, layered on top of a reliable transport protocol (e.g., TCP), is the Record Protocol. It provides connection security by using symmetric cryptography for confidentiality, data origin authentication, and integrity protection. The Record Protocol is used for encapsulation of various higher-level protocols. One such encapsulated protocol, the Handshake Protocol, allows the server and client to authenticate each other and to negotiate an encryption algorithm and cryptographic keys before the application protocol transmits or receives data.</t>
<t>The design of DTLS <xref target="RFC6347"/> is intentionally very similar to TLS. Since DTLS operates on top of an unreliable datagram transport a few enhancements to the TLS structure are, however necessary. RFC 6347 explains these differences in great detail. As a short summary, for those not familiar with DTLS the differences
are:
<list style="symbols">
<t>An explicit sequence number and an epoch field is included in the Record Protocol. Section 4.1 of RFC 6347 explains the processing rules for these two new fields. The value used to compute the MAC is the 64-bit value formed by concatenating the epoch and the sequence number. </t>
<t>Stream ciphers must not be used with DTLS. The only stream cipher defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it is not recommended anymore even for use with TLS <xref target="I-D.ietf-tls-prohibiting-rc4"/>. Note that the term 'stream cipher' is a technical term in the TLS specification. Section 4.7 of RFC 5246 defines stream ciphers in TLS as follows. In stream cipher encryption, the plaintext is exclusive-ORed with an dentical amount of output generated from a cryptographically secure keyed pseudorandom number generator.</t>
<t>The TLS Handshake Protocol has been enhanced to include a stateless cookie exchange for Denial of Service (DoS) resistance. For this purpose a new handshake message, the HelloVerifyRequest, was added to DTLS. This handshake message is sent by the server and includes a stateless cookie, which is returned in a ClientHello message back to the server. Although the exchange is optional for the server to execute, a client implementation has to be prepared to respond to it. Furthermore, the handshake message format has been extended to deal with message loss, reordering, and fragmentation. Retransmission timers have been included to deal with message loss. </t>
</list>
</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="arch" title="Communication Models">
<t>This document describes a profile of TLS/DTLS 1.2 and, to be useful, it has to make assumptions about the envisioned communication architecture.</t>
<t>Two communication architectures (and consequently two profiles) are described in this document.</t>
<section anchor="c-clients" title="Constrained TLS/DTLS Clients">
<t>The communication architecture shown in <xref target="model"/> assumes a unicast communication interaction with an IoT device utilizing a constrained TLS/DTLS client interacting with one or multiple TLS/DTLS servers. <!-- Which server to contact is based on pre-configuration onto the client (e.g., as part of the firmware). This configuration information also includes information about the PSK identity and the corresponding secret to be used with that specific server. For asymmetric cryptography mutual authentication is assumed in this profile. For raw public keys the public key or the hash of the public key is assumed to be available to both parties. For certificate-based authentication the client may have a trust anchor store pre-populated, which allows the client to perform path validation for the certificate obtained during the handshake with the server. The client also needs to know which certificate or raw public key it has to use with a specific server.--> </t>
<t>Before a client can initiate the TLS/DTLS handshake it needs to know the IP address of that server and what credentials to use. Application layer protocols, such as CoAP, conveyed on top of DTLS may need additional information, such information about URLs of the endpoints the CoAP needs to register and publish information to. This configuration information (including credentials) may be conveyed to clients as part of a firmware/software package or via a configuration protocol. The following credential types are supported by this profile:</t>
<t><list style="symbols">
<t> For PSK-based authentication (see <xref target="psk"/>), this includes the
paired "PSK identity" and shared secret to be used with each server.</t>
<t> For raw public key-based authentication (see <xref target="raw"/>), this
includes either the server's public key or the hash of the server's
public key.</t>
<t> For certificate-based authentication (see <xref target="certs"/>), this
includes a pre-populated trust anchor store that allows the DTLS stack
to perform path validation for the certificate obtained during the
handshake with the server.</t>
</list>
</t>
<t>This document focuses on the description of the DTLS client-side functionality but, quite naturally,
the equivalent server-side support has to be available. </t>
<t><figure title="Constrained Client Profile." anchor="model">
<artwork>
<![CDATA[
+////////////////////////////////////+
| Configuration |
|////////////////////////////////////|
| Server A --> PSK Identity, PSK |
| Server B --> Public Key (Server B),|
| Public Key (Client) |
| Server C --> Public Key (Client), |
| Trust Anchor Store |
+------------------------------------+
oo
oooooo
o
+-----------+
|Constrained|
|TLS/DTLS |
|Client |-
+-----------+ \
\ ,-------.
,' `. +------+
/ IP-based \ |Server|
( Network ) | A |
\ / +------+
`. ,'
'---+---' +------+
| |Server|
| | B |
| +------+
|
| +------+
+----------------->|Server|
| C |
+------+
]]>
</artwork>
</figure>
</t>
<section title="Examples of Constrained Client Exchanges">
<section title="Network Access Authentication Example">
<t>Re-use is a recurring theme when considering constrained environments and is behind a lot of the directions taken in developments for constrained environments. The corollary of re-use is to not add functionality if it can be avoided. An example relevant to the use of TLS is network access authentication, which takes place when a device connects to a network and needs to go through an authentication and access control procedure before it is allowed to communicate with other devices or connect to the Internet.</t>
<t><xref target="network-access"/> shows the network access architecture with the IoT device initiating the communication to an access point in the network using the procedures defined for a specific physical layer. Since credentials may be managed and stored centrally, in the Authentication, Authorization, and Accounting (AAA) server, the security protocol exchange may need to be relayed via the Authenticator, i.e., functionality running on the access point, to the AAA server. The authentication and key exchange protocol itself is encapsulated within a container, the Extensible Authentication Protocol (EAP), and messages are conveyed back and forth between the EAP endpoints, namely the EAP peer located on the IoT device and the EAP server located on the AAA server or the access point. To route EAP messages from the access point, acting as a AAA client, to the AAA server requires an adequate protocol mechanism, name RADIUS or Diameter. </t>
<t>More details about the concepts and a description about the terminology can be found in RFC 5247 <xref target="RFC5247"/>.</t>
<t><figure title="Network Access Architecture.." anchor="network-access">
<artwork>
<![CDATA[
+--------------+
|Authentication|
|Authorization |
|Accounting |
|Server |
|(EAP Server) |
| |
+-^----------^-+
* EAP o RADIUS/
* o Diameter
--v----------v--
/// \\\
// \\
| Federation |
| Substrate |
\\ //
\\\ ///
--^----------^--
* EAP o RADIUS/
* o Diameter
+-------------+ +-v----------v--+
| | EAP/EAP Method | |
| Internet of |<***************************>| Access Point |
| Things | |(Authenticator)|
| Device | EAP Lower Layer and |(AAA Client) |
| (EAP Peer) | Secure Association Protocol | |
| |<--------------------------->| |
| | | |
| | Physical Layer | |
| |<===========================>| |
+-------------+ +---------------+
Legend:
<****>: Device-to-AAA Server Exchange
<---->: Device-to-Authenticator Exchange
<oooo>: AAA Client-to-AAA Server Exchange
<====>: Phyiscal layer like IEEE 802.11/802.15.4
]]>
</artwork>
</figure>
</t>
<t>One standardized EAP method is EAP-TLS, defined in RFC 5216 <xref target="RFC5216"/>, which re-uses the TLS-based protocol exchange and encapsulates it inside the EAP payload. In terms of re-use this allows many components of the TLS protocol to be shared between the network access security functionality and the TLS functionality needed for securing application layer traffic. The EAP-TLS exchange is shown in <xref target="eap-tls"/> where it is worthwhile to point out that in EAP the client / server roles are reversed but with the use of EAP-TLS the IoT device acts as a TLS client.</t>
<t><figure title="EAP-TLS Exchange." anchor="eap-tls">
<artwork>
<![CDATA[
Authenticating Peer Authenticator
------------------- -------------
<- EAP-Request/
Identity
EAP-Response/
Identity (MyID) ->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS Start)
EAP-Response/
EAP-Type=EAP-TLS
(TLS client_hello)->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS server_hello,
TLS certificate,
[TLS server_key_exchange,]
TLS certificate_request,
TLS server_hello_done)
EAP-Response/
EAP-Type=EAP-TLS
(TLS certificate,
TLS client_key_exchange,
TLS certificate_verify,
TLS change_cipher_spec,
TLS finished) ->
<- EAP-Request/
EAP-Type=EAP-TLS
(TLS change_cipher_spec,
TLS finished)
EAP-Response/
EAP-Type=EAP-TLS ->
<- EAP-Success
]]>
</artwork>
</figure>
</t>
<t>The guidance in this document also applies to the use of EAP-TLS for network access authentication. An IoT device using a network access authentication solution based on TLS can re-use most parts of the code for the use of DTLS/TLS at the application layer thereby saving a significant amount of flash memory. Note, however, that the credentials used for network access authentication and those used for application layer security are very likely different.</t>
</section>
<section title="CoAP-based Data Exchange Example">
<t>When a constrained client uploads sensor data to a server infrastructure it may use CoAP by pushing the data via a POST message to a pre-configured endpoint on the server. In certain circumstances this might be too limiting and additional functionality is needed, as shown in <xref target="coap-rd"/>, where the IoT device itself runs a CoAP server hosting the resource that is made accessible to other entities. Despite running a CoaP server on the IoT device it is still the DTLS client on the IoT device that initiates the interaction with the non-constrained resource server in our scenario. </t>
<t><xref target="coap-rd"/> shows a sensor starting with a DTLS exchange with a resource directory to register available resources. <xref target="I-D.ietf-core-resource-directory"/> defines the resource directory as a web entity that stores information about web resources and implements the REST interfaces defined in <xref target="I-D.ietf-core-resource-directory"/> for registration and lookup of those resources.</t>
<t>The initial DTLS interaction between the sensor, acting as a DTLS client, and the resource directory, acting as a DTLS server, will be a full DTLS handshake. Once this handshake is complete both parties have established the DTLS record layer. Subsequently, the CoAP client can securely register at the resource directory. Details about the capabilities of the resource directory can be found in <xref target="I-D.ietf-core-resource-directory"/>.</t>
<t>After some time (assuming that the client regularly refreshes its registration) the resource directory receives a request (not shown in the figure) from an application to retrieve the temperature information from the sensor. This request is relayed by the resource directory to the sensor using a GET message exchange. The already established DTLS record layer can be used to secure the message exchange.</t>
<t><figure title="DTLS/CoAP exchange using Resource Directory." anchor="coap-rd">
<artwork>
<![CDATA[
Resource
Sensor Directory
------ ---------
+---
|
| ClientHello -------->
| client_certificate_type
F| server_certificate_type
U|
L| <------- HelloVerifyRequest
L|
| ClientHello -------->
D| client_certificate_type
T| server_certificate_type
L|
S| ServerHello
| client_certificate_type
H| server_certificate_type
A| Certificate
N| ServerKeyExchange
D| CertificateRequest
S| <-------- ServerHelloDone
H|
A| Certificate
K| ClientKeyExchange
E| CertificateVerify
| [ChangeCipherSpec]
| Finished -------->
|
| [ChangeCipherSpec]
| <-------- Finished
+---
+--- ///+
C| \ D
O| Req: POST coap://rd.example.com/rd?ep=node1 \ T
A| Payload: \ L
P| </temp>;ct=41; \ S
| rt="temperature-c";if="sensor", \
R| </light>;ct=41; \ R
D| rt="light-lux";if="sensor" \ E
| --------> \ C
R| \ O
E| \ R
G| Res: 2.01 Created \ D
.| <-------- Location: /rd/4521 \
| \ L
+--- \ A
\ Y
* \ E
* (time passes) \ R
* \
+--- \ P
C| \ R
O| Req: GET coaps://sensor.example.com/temp \ O
A| <-------- \ T
P| \ E
| Res: 2.05 Content \ C
G| Payload: \ T
E| 25.5 --------> \ E
T| \ D
+--- ///+
]]>
</artwork>
</figure>
</t>
</section> <!-- Constrained CoAP Servers Example -->
</section> <!-- Examples of Constrained Client Exchanges -->
</section> <!-- Constrained Clients -->
<section anchor="c-servers" title="Constrained TLS/DTLS Servers">
<t><xref target="c-clients"/> illustrates a deployment model where the TLS/DTLS client is constrained and efforts need to be taken to improve memory utilization, bandwidth consumption, reduce performance impacts, etc. In this section we look at cases where constrained devices run TLS/DTLS servers to secure access to application layer services running on top of CoAP, HTTP or other protocols. Running server functionality on a constrained node is typically more demanding since servers have to wait for incoming requests. Therefore, they will have fewer possibilities to enter sleep-cycles. Nevertheless, there are legitimate reasons for deploying servers as constrained devices. <xref target="model2"/> illustrates a possible deployment whereby a number of constrained servers are waiting for regular clients to access their resources. The entire process is likely to be controlled by a third party, the authentication and authorization server. This authentication and authorization server is responsible for holding authorization policies (in the form of access control policies) that govern the access to resources and distribution of keying material.</t>
<t><figure title="Constrained Server Profile." anchor="model2">
<artwork>
<![CDATA[
+////////////////////////////////////+
| Configuration |
|////////////////////////////////////|
| Credentials |
| Client A -> Public Key |
| Server S1 -> Symmetric Key ,|
| Server S2 -> Certificate |
| Server S3 -> Public Key |
| Trust Anchor Store |
| Access Control Lists |
| Resource X: Client A / GET |
| Resource Y: Client A / PUT |
+------------------------------------+
oo
oooooo
o
+---------------+ +-----------+
|Authentication | +-------->|TLS/DTLS |
|& Authorization| | |Client A |
|Server | | +-----------+
+---------------+ ++
^ | +-----------+
\ | |Constrained|
\ ,-------. | Server S1 |
,' `. +-----------+
/ Local \
( Network )
\ / +-----------+
`. ,' |Constrained|
'---+---' | Server S2 |
| +-----------+
|
| +-----------+
+-----------------> |Constrained|
| Server S3 |
+-----------+
]]>
</artwork>
</figure>
</t>
<t><xref target="local-discovery"/> shows an example interaction whereby a device, a thermostat in our case, searches in the local network for discoverable resources and accesses those. The thermostat starts the procedure using a link-local discovery message using the "All CoAP Nodes" multicast address by utilizing the RFC 6690 <xref target="RFC6690"/> link format. The IPv6 multicast address used for site-local discovery is FF02::FD. As a result, a temperature sensor and a fan respond. These responses allow the thermostat to subsequently read temperature information from the temperature sensor with a CoAP GET request issued to the previously learned endpoint. In this hypothetical example we assume that this temperature sensor provides this information to every party and no access control mechanism is enforced. However, when the thermostat subsequently uses the obtained temperature reading to control a fan, the fan requires authentication and authorization of the entity requesting changes and TLS is used to authenticate both endpointas and to secure the communication.</t>
<t><figure title="Local Discovery and Resouce Access." anchor="local-discovery">
<artwork>
<![CDATA[
Temperature
Thermostat Sensor Fan
---------- --------- ---
Discovery
-------------------->
GET coap://[FF02::FD]/.well-known/core
CoAP 2.05 Content
<-------------------------------
</3303/0/5700>;rt="temperature";
if="sensor"
CoAP 2.05 Content
<--------------------------------------------------
</fan>;rt="fan";if="actuation"
Read Sensor Data (unauthenticated)
------------------------------->
GET /3303/0/5700
CoAP 2.05 Content
<-------------------------------
22.5 C
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
\ /
\ Protocol steps to obtain authorization token / client /
\ credentials for access to the fan-provided resources. /
\ /
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
Configure Actuator (with authorization credentials)
--------------------------------------------------
PUT /fan?on-off=true
CoAP 2.04 Changed
<-------------------------------------------------
]]>
</artwork>
</figure>
</t>
<t>A deployment with constrained servers has to overcome several challenges. Below we explain how these challenges have been solved with CoAP, as an example. Other protocols may offer similar capabilities.
While the requirements for the TLS/DTLS protocol profile change only slightly when run on a constrained server (in comparison to running it on a constrained client) several other eco-system factor will impact deployment.</t>
<t>The challenges are:
<list style="hanging">
<t hangText="Discovery and Reachability:">
<vspace blankLines="1"/>
Before initiating a connection to a constrained server a client first needs to discover that server and, once discovered, it needs to maintain reachability with that device.
<vspace blankLines="1"/>
In CoAP the discovery of resources offered by servers is accomplished by sending a unicast or multicast CoAP GET to a well-known URI. The CORE Link format specification <xref target="RFC6690"/> describes the use case (see Section 1.2.1), and reserves the URI (see Section 7.1). Section 7 of the CoAP specification <xref target="RFC7252"/> describes the discovery procedure. RFC 7390 <xref target="RFC7390"/> describes use case for discovering CoAP servers using multicast (see Section 3.3), and specifies the protocol processing rules for CoAP group communications (see Section 2.7).</t>
<t hangText="Authentication:">
<vspace blankLines="1"/>
The next challenge concerns the provisioning of authentication credentials to the clients as well as servers. In <xref target="c-clients"/> we assumed that credentials (and other configuration information) are provisioned to the device and that those can be used with the authorization servers. Of course, this leads to a very static relationship between the clients and their server-side infrastructure but poses fewer challenges from a deployment point of view, as described in Section 2 of <xref target="I-D.iab-smart-object-architecture"/> these different communication patterns. In any case, engineers and product designers have to determine how the relevant credentials are distributed to the respective parties. For example, shared secrets may need to be provisioned to clients and the constrained servers for subsequent use of TLS/DTLS PSK. In other deployments, certificates, private keys, and trust anchors for use with certificate-based authentication may need to be utilized.
<vspace blankLines="1"/>
Practical solutions either use pairing (also called imprinting) or a trusted third party. With pairing two devices execute a special protocol exchange that is unauthenticated to establish an shared key (for example using an unauthenticated Diffie-Hellman exchange) key. To avoid man-in-the-middle attacks an out-of-band channel is used to verify that nobody has tampered with the exchanged protocol messages. This out-of-band channel can come in many forms, including:
<list style="symbols">
<t>Human involvement by comparing hashed keys, entering passkeys, scanning QR codes</t>
<t>The use of alternative wireless communication channels (e.g., infra-red communication in addition to WiFi)</t>
<t>Proximity-based information</t>
</list>
More details about these different pairing/imprinting techniques can be found in the smart object security workshop report <xref target="RFC7397"/> and various position papers submitted to that topic, such as <xref target="ImprintingSurvey"/>. The use of a trusted third party follows a different approach and is subject to ongoing standardization efforts in the 'Authentication and Authorization for Constrained Environments (ACE)' working group <xref target="ACE-WG"/>.
</t>
<t hangText="Authorization">
<vspace blankLines="1"/>
The last challenge is the ability for the constrained server to make an authorization decision when clients access protected resources. Pre-provisioning access control information to constrained servers may be one option but works only in a small scale, less dynamic environment. For a more fine-grained and dynamic access control the reader is referred to the ongoing work in the ACE working group.</t>
</list>
</t>
</section> <!-- Constrained TLS/DTLS Servers -->
</section> <!-- Communication Models-->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="The TLS/DTLS Ciphersuite Concept">
<t>TLS (and consequently DTLS) has the concept of ciphersuites
and an IANA registry <xref target="IANA-TLS"/> was created to register the suites. A ciphersuite (and the specification that defines it) contains the following information:
<list style="symbols">
<t>Authentication and key exchange algorithm (e.g., PSK)</t>
<t>Cipher and key length (e.g., Advanced Encryption Standard (AES) with 128 bit keys <xref target="AES"/>)</t>
<t>Mode of operation (e.g., Counter with Cipher Block Chaining - Message Authentication
Code (CBC-MAC) Mode (CCM) for AES) <xref target="RFC3610"/></t>
<t>Hash algorithm for integrity protection, such as the Secure Hash Algorithm (SHA) in combination with Keyed-Hashing for Message Authentication (HMAC) (see <xref target="RFC2104"/> and <xref target="RFC4634"/>)</t>
<t>Hash algorithm for use with the pseudorandom function (e.g., HMAC with the SHA-256) </t>
<t>Misc information (e.g., length of authentication tags)</t>
<t>Information whether the ciphersuite is suitable for DTLS or only for TLS</t>
</list>
</t>
<t>The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a pre-shared authentication and key exchange algorithm. RFC 6655 <xref target="RFC6655"/> defines this ciphersuite. It uses the Advanced Encryption Standard (AES) encryption algorithm, which is a block cipher. Since the AES algorithm supports different key lengths (such as 128, 192 and 256 bits) this information has to be specified as well and the selected ciphersuite supports 128 bit keys. A block cipher encrypts plaintext in fixed-size blocks and AES operates on fixed block size of 128 bits. For messages exceeding 128 bits, the message is partitioned into 128-bit blocks and the AES cipher is applied to these input blocks with appropriate chaining, which is called mode of operation.</t>
<t>TLS 1.2 introduced Authenticated Encryption with Associated Data (AEAD) ciphersuites (see <xref target="RFC5116"/> and <xref target="RFC6655"/>). AEAD is a class of block cipher modes which encrypt (parts of) the message and authenticate the message simultaneously. Examples of such modes include the Counter with Cipher Block Chaining - Message Authentication Code (CBC-MAC) Mode (CCM) mode, and the Galois/Counter Mode (GCM) (see <xref target="RFC5288"/> and <xref target="RFC7251"/>).</t>
<t>Some AEAD ciphersuites have shorter authentication tags and are therefore more suitable for networks with low bandwidth where small message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite that ends in "_8" has an 8-octet authentication tag, while the regular CCM ciphersuites have, at the time of writing, 16-octet authentication tags.</t>
<t>TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in the TLS pseudo random function (PRF) used in earlier versions of TLS with cipher-suite-specified PRFs. For this reason authors of more recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC algorithm and the hash functions used with the TLS PRF.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="credentials" title="Credential Types">
<section anchor="psk" title="Pre-Shared Secret">
<t>The use of pre-shared secret credentials is one of the most basic techniques for TLS/DTLS since it is both computational efficient and bandwidth conserving. Pre-shared secret based authentication was introduced to TLS with RFC 4279 <xref target="RFC4279"/>. The exchange shown in <xref target="dtls-psk"/> illustrates the DTLS exchange including the cookie exchange. While the server is not required to initiate a cookie exchange with every handshake, the client is required to implement and to react on it when challenged. The cookie exchange allows the server to react to flooding attacks.</t>
<t><figure title="DTLS PSK Authentication including the Cookie Exchange." anchor="dtls-psk">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
<-------- HelloVerifyRequest
(contains cookie)
ClientHello -------->
(with cookie)
ServerHello
*ServerKeyExchange
<-------- ServerHelloDone
ClientKeyExchange
ChangeCipherSpec
Finished -------->
ChangeCipherSpec
<-------- Finished
Application Data <-------> Application Data
Legend:
* indicates an optional message payload
]]>
</artwork>
</figure>
</t>
<t><xref target="RFC4279"/> does not mandate the use of any particular type of client identity and the client and server have to agree on the identities and keys to be used.
The mandated encoding of identities in Section 5.1 of RFC 4279 aims to improve interoperability for those cases where the identity is configured by a person using some management interface. Many IoT devices do, however, not have a user interface and most of their credentials are bound to the device rather than the user. Furthermore, credentials are often provisioned into trusted hardware modules or in the firmware by developers. As such, the encoding considerations are not applicable to this usage environment. For use with this profile the PSK identities SHOULD NOT assume a structured format (as domain names, Distinguished Names, or IP addresses have) and a bit-by-bit comparison operation can then be used by the server-side infrastructure.</t>
<t>The client indicates which key it uses by including a "PSK identity" in the ClientKeyExchange message. As described in <xref target="arch"/> clients may have multiple pre-shared keys with a single server and to help the client in selecting which PSK identity / PSK pair to use, the server can provide a "PSK identity hint" in the ServerKeyExchange message.
If the hint for PSK key selection is based on the domain name of the server then servers SHOULD NOT send the "PSK identity hint" in
the ServerKeyExchange message. In general, servers SHOULD NOT send the "PSK identity hint" in the ServerKeyExchange message and client MUST ignore the message. This approach is inline with RFC 4279 <xref target="RFC4279"/>. Note: The TLS Server Name Indication (SNI) extension allows the client to tell a server the name of the server it is contacting, which is relevant for hosting environments. A server using the identity hint needs to guide the selection based on a received SNI value from the client.</t>
<t>RFC 4279 requires TLS implementations supporting PSK ciphersuites to support arbitrary PSK identities up to 128 octets in length, and arbitrary PSKs up to 64 octets in length. This is a useful assumption for TLS stacks used in the desktop and mobile environments where management interfaces are used to provision identities and keys. For the IoT environment, keys are distributed as part of hardware modules or are embedded into the firmware. Implementations in compliance with this profile MAY use PSK identities up to 128 octets in length, and arbitrary PSKs up to 64 octets in length. The use of shorter PSK identities and shorter PSKs is RECOMMENDED.</t>
<t><xref target="RFC7252">Constrained Application Protocol (CoAP)</xref> currently specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite for use with shared secrets. This ciphersuite uses the AES algorithm with 128 bit keys and CCM as the mode of operation. The label "_8" indicates that an 8-octet authentication tag is used. This ciphersuite makes use of the default TLS 1.2 Pseudorandom Function (PRF), which uses an HMAC with the SHA-256 hash function. (Note that all IoT implementations will need a SHA-256 implementation due to the construction of the pseudo-random number function in DTLS/TLS 1.2.)</t>
<t>A device compliant with the profile in this section MUST implement TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="raw" title="Raw Public Key">
<t>The use of raw public keys with TLS/DTLS, as defined in <xref target="RFC7250"/>, is the first entry point into public key cryptography without having to pay the price of certificates and a public key infrastructure (PKI). The specification re-uses the existing Certificate message to convey the raw public key encoded in the SubjectPublicKeyInfo structure. To indicate support two new extensions had been defined, as shown in <xref target="dtls-raw"/>, namely the server_certificate_type*' and the client_certificate_type. To operate this mechanism securely it is necessary to authenticate and authorize the public keys out-of-band. This document therefore assumes that a client implementation comes with one or multiple raw public keys of servers, it has to communicate with, pre-provisioned. Additionally, a device will have its own raw public key. To replace, delete, or add raw public key to this list requires a software update, for example using a firmware update mechanism.</t>
<t>
<figure title="DTLS Raw Public Key Exchange including the Cookie Exchange." anchor="dtls-raw">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
*client_certificate_type*
*server_certificate_type*
ServerHello
*client_certificate_type*
*server_certificate_type*
Certificate
ServerKeyExchange
CertificateRequest
<-------- ServerHelloDone
Certificate
ClientKeyExchange
CertificateVerify
[ChangeCipherSpec]
Finished -------->
[ChangeCipherSpec]
<-------- Finished
Note: Extensions marked with '*' were introduced with
RFC 7250.
]]>
</artwork>
</figure>
</t>
<t>The CoAP recommended ciphersuite for use with this credential type is TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 <xref target="RFC7251"/>. This elliptic curve cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) for authentication. Due to the use of Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman groups <xref target="I-D.ietf-tls-negotiated-dl-dhe"/> are not applicable to this profile. This ciphersuite make use of the AEAD capability in DTLS 1.2 and utilizes an eight-octet authentication tag. The use of a Diffie-Hellman key exchange provides perfect forward secrecy (PFS). More details about PFS can be found in <xref target="pfs"/>.</t>
<t>RFC 6090 <xref target="RFC6090"/> provides valuable information for implementing Elliptic Curve Cryptography algorithms, particularly for choosing methods that have been available in the literature for a long time (i.e., 20 years and more).</t>
<!-- <t>QUESTION: <xref target="I-D.ietf-uta-tls-bcp"/> recommends a different ciphersuite, namely TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 <xref target="RFC5289"/> or alternatively TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (with a 2048-bit or 1024 DH parameters as second and third priority, respectively). Is TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 a good choice?</t> -->
<t>A device compliant with the profile in this section MUST implement TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this section.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="certs" title="Certificates">
<t>The use of mutual certificate-based authentication is shown in <xref target="dtls-cert"/>, which makes use of the cached info extension <xref target="I-D.ietf-tls-cached-info"/>. Support of the cached info extension is REQUIRED. Caching certificate chains allows the client to reduce the communication overhead significantly since otherwise the server would provide the end entity certificate, and the certificate chain. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority is omitted from the chain. Client implementations MUST be provisioned with a trust anchor store that contains the root certificates. The use of the Trust Anchor Management Protocol (TAMP) <xref target="RFC5934"/> is, however, not envisioned. Instead IoT devices using this profile MUST use a software update mechanism to populate the trust anchor store.</t>
<t><figure title="DTLS Mutual Certificate-based Authentication." anchor="dtls-cert">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
*cached_info*
ServerHello
*cached_info*
Certificate
ServerKeyExchange
CertificateRequest
<-------- ServerHelloDone
Certificate
ClientKeyExchange
CertificateVerify
[ChangeCipherSpec]
Finished -------->
[ChangeCipherSpec]
<-------- Finished
Note: Extensions marked with '*' were introduced with
[I-D.ietf-tls-cached-info].
]]>
</artwork>
</figure>
</t>
<t>Server certificates MUST contain the fully qualified DNS domain name or "FQDN" as dNSName. For CoAP, the coaps URI scheme is described in Section 6.2 of <xref target="RFC7252"/>. This FQDN is stored in the SubjectAltName or in the leftmost CN component of subject name, as explained in Section 9.1.3.3 of <xref target="RFC7252"/>, and used by the client to match it against the FQDN used during the look-up process, as described in RFC 6125 <xref target="RFC6125"/>. For other protocols, the appropriate URI scheme specification has to be consulted.</t>
<t>When constrained servers are used, for example in context of locally discoverable services as shown in <xref target="local-discovery"/>, then the rules of client certificates are applicable since these constrained servers are less likely to have an FQDN configured. Note that the Service Name Indication (SNI) extension cannot be used in this case since SNI does not offer the ability to convey EUI-64 identifiers.</t>
<t>For client certificates the identifier used in the SubjectAltName or in the leftmost CN component of subject name MUST be an EUI-64 <xref target="EUI64"/>, as mandated in Section 9.1.3.3 of <xref target="RFC7252"/>.</t>
<t>For certificate revocation neither the Online Certificate Status Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. Instead, this profile relies on a software update mechanism. While multiple OCSP stapling <xref target="RFC6961"/> has recently been introduced as a mechanism to piggyback OCSP request/responses inside the DTLS/TLS handshake to avoid the cost of a separate protocol handshake further investigations are needed to determine its suitability for the IoT environment.</t>
<t>Regarding the ciphersuite choice the discussion in <xref target="raw"/> applies. Further details about X.509 certificates can be found in Section 9.1.3.3 of <xref target="RFC7252"/>. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 ciphersuite description in <xref target="raw"/> is also applicable to this section.</t>
<t>When using certificates, IoT devices MUST provide support for a server certificate chain of at least 3 not including the trust anchor and MAY reject connections from servers offering chains longer than 3. IoT devices MAY have client certificate chains of any length. Obviously, longer chains require more digital signature verification operations to perform and lead to larger certificate messages in the TLS handshake.</t>
<t><xref target="table_ex"/> provides a summary of the elements in a certificate for use with this profile.</t>
<texttable anchor="table_ex" title="Certificate Content.">
<ttcol align='center'>Element</ttcol>
<ttcol align='center'>Notes</ttcol>
<c>Version</c>
<c>This profile uses the X.509 v3 certificate <xref target="RFC5280"/>.</c>
<c></c>
<c></c>
<c>Serial Number</c>
<c>Positive integer unique per certificate.</c>
<c></c>
<c></c>
<c>Issuer Signature Algorithms</c>
<c>This profile uses ecdsa-with-SHA256 or stronger <xref target="RFC5758"/>.</c>
<c></c>
<c></c>
<c>Issuer Distinguished Name</c>
<c>Contains the DN of the issuing CA.</c>
<c></c>
<c></c>
<c>Validity Period</c>
<c>Values expressed as UTC time. No validity period mandated.</c>
<c></c>
<c></c>
<c>Subject Distinguished Name</c>
<c>See rules outlined in this section.</c>
<c></c>
<c></c>
<c>Subject Public Key Information</c>
<c>This element contains the ECDSA signature certificate. The algorithm field in the SubjectPublicKeyInfo structure indicates the algorithm and any associated parameters for the ECC public key. This profile uses the id-ecPublicKey algorithm identifier.</c>
<c></c>
<c></c>
<c>Issuer's Signature</c>
<c>Includes the ECDSA signature with ecdsa-with-SHA256 or stronger.</c>
<c></c>
<c></c>
<c>Extension: Subject Alternative Name</c>
<c>See rules outlined in this section.</c>
<c></c>
<c></c>
<c>Extension: Basic Constraints</c>
<c>Indicates whether the subject of the certificate is a CA. This extension is used for CA certs only and then the value is set to TRUE. The default is FALSE.</c>
<c></c>
<c></c>
<c>Extension: Key Usage</c>
<c>digitalSignature or keyAgreement, keyCertSign for verifying signatures on public key certificates.</c>
<c></c>
<c></c>
<c>Extension: Extended Key Usage</c>
<c>id-kp-serverAuth for server authentication, id-kp-clientAuth for client authentication, id-kp-codeSigning for code signing (for software update mechanism), id-kp-OCSPSigning for future OCSP usage in TLS.</c>
</texttable>
<t>All certificate elements listed in <xref target="table_ex"/> are mandatory-to-implement. No other certificate elements are used by this specification.</t>
<t>A device compliant with the profile in this section MUST implement TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this section.</t>
<section title="Client Certificate URLs">
<t>RFC 6066 <xref target="RFC6066"/> allows to avoid sending client-side certificates and uses URLs instead. This reduces the over-the-air transmission. Note that the TLS cached info extension does not provide any help with caching client certificates.</t>
<t>TLS/DTLS clients MUST implement support for client certificate URLs for those environments where client-side certificates are used and the server-side is not constrained. For constrained servers this functionality is NOT RECOMMENDED since it forces the server to execute an additional protocol exchange, potentially using a protocol it does not even support. The use of this extension also increases the risk of a denial of service attack against the constrained server due to the additional workload.</t>
</section>
<section title="Trusted CA Indication">
<t>RFC 6066 <xref target="RFC6066"/> allows clients to indicate what trust anchor they
support. With certificate-based authentication a DTLS server conveys its
end entity certificate to the client during the DTLS exchange provides.
Since the server does not necessarily know what trust anchors
the client has stored it includes intermediate CA certs in the certificate
payload as well to facilitate with certification path construction and path
validation.</t>
<t>Today, in most IoT deployments there is a fairly static relationship
between the IoT device (and the software running on them) and the server-side
infrastructure. For these deployments where IoT devices interact with a fixed, pre-configured
set of servers this extension is NOT RECOMMENDED.</t>
<t>In cases where client interact with
dynamically discovered TLS/DTLS servers, for example in the use cases described in <xref target="c-servers"/>, the use of this extension is RECOMMENDED.</t>
</section>
</section>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Signature Algorithm Extension">
<t>The "signature_algorithms" extension, defined in Section 7.4.1.4.1 of RFC 5246 <xref target="RFC5246"/>, allows the client to indicate to the server which signature/hash algorithm pairs may be used in digital signatures. The client MUST send this extension to select the use of SHA-256 since otherwise absent this extension RFC 5246 defaults to SHA-1 / ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms.</t>
<t>The "signature_algorithms" extension is not applicable to the PSK-based ciphersuite described in <xref target="psk"/>.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Error Handling">
<t>TLS/DTLS uses the Alert protocol to convey error messages and specifies a longer list of errors. However, not all error messages defined in the TLS/DTLS specification are applicable to this profile. In general, there are two categories of errors (as defined in Section 7.2 of RFC 5246), namely fatal errors and warnings. Alert messages with a level of fatal result in the immediate termination of the connection. If possible, developers should try to develop strategies to react to those fatal errors, such as re-starting the handshake or informing the user using the (often limited) user interface. Warnings may be ignored by the application since many IoT devices will either have limited ways to log errors or no ability at all. In any case, implementers have to carefully evaluate the impact of errors and ways to remedy the situation since a commonly used approach for delegating decision making to users is difficult (or impossible) to accomplish in a timely fashion.</t>
<t>All error messages marked as RESERVED are only supported for backwards compatibility with SSL and are therefore not applicable to this profile. Those include decryption_failed_RESERVED, no_certificate_RESERVE, and export_restriction_RESERVED.</t>
<t>A number of the error messages are applicable only for certificate-based authentication ciphersuites. Hence, for PSK and raw public key use the following error messages are not applicable:</t>
<t><list style="symbols">
<t>bad_certificate,</t>
<t>unsupported_certificate,</t>
<t>certificate_revoked,</t>
<t>certificate_expired,</t>
<t>certificate_unknown,</t>
<t>unknown_ca, and</t>
<t>access_denied.</t>
</list>
</t>
<t>Since this profile does not make use of compression at the TLS layer the decompression_failure error message is not applicable either. </t>
<t>RFC 4279 introduced a new alert message unknown_psk_identity for PSK ciphersuites. As stated in Section 2 of RFC 4279 the decryption_error error message may also be used instead.
For this profile the TLS server MUST return the decryption_error error message instead of the unknown_psk_identity since the two mechanisms exist and provide the same functionality.</t>
<t>Furthermore, the following errors should not occur with devices and servers supporting this specification but implementations MUST be prepared to process these errors to deal with servers that are not compliant to the profiles in this document:
<list style="hanging">
<t hangText="protocol_version:">While this document focuses only on one version of the TLS/DTLS protocol, namely version 1.2, ongoing work on TLS/DTLS 1.3 is in progress at the time of writing.</t>
<t hangText="insufficient_security:">This error message indicates that the server requires ciphers to be more secure. This document specifies only one ciphersuite per profile but it is likely that additional ciphtersuites get added over time.</t>
<t hangText="user_canceled:">Many IoT devices are unattended and hence this error message is unlikely to occur. </t>
</list>
</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Session Resumption">
<t>Session resumption is a feature of the core TLS/DTLS specifications that allows a client to continue with an earlier established session state. The resulting exchange is shown in <xref target="resumption"/>. In addition, the server may choose not to do a cookie exchange when a session is resumed. Still, clients have to be prepared to do a cookie exchange with every handshake. The cookie exchange is not shown in the figure.</t>
<t>
<figure title="DTLS Session Resumption." anchor="resumption">
<artwork>
<![CDATA[
Client Server
------ ------
ClientHello -------->
ServerHello
[ChangeCipherSpec]
<-------- Finished
[ChangeCipherSpec]
Finished -------->
Application Data <-------> Application Data
]]>
</artwork>
</figure>
</t>
<t>Constrained clients MUST implement session resumption to improve the performance of the handshake. This will lead to a reduced number of message exchanges, lower computational overhead (since only symmetric cryptography is used during a session resumption exchange), and session resumption requires less bandwidth.</t>
<t>For cases where the server is constrained (but not the client) the client MUST implement RFC 5077 <xref target="RFC5077"/>. RFC 5077 specifies a version of TLS/DTLS session resumption that does not require per-session state information to be maintained by the constrained server. This is accomplished by using a ticket-based approach.</t>
<t>If both the client and the server are constrained devices both devices SHOULD implement RFC 5077 and MUST implement basic session resumption.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Compression">
<t>Section 3.3 of <xref target="I-D.ietf-uta-tls-bcp"/> recommends to disable TLS/DTLS-level compression due to attacks, such as CRIME. For IoT applications compression at the TLS/DTLS layer is not needed since application layer protocols are highly optimized and the compression algorithms at the DTLS layer increases code size and complexity.</t>
<t>This TLS/DTLS profile MUST NOT implement TLS/DTLS layer compression.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="pfs" title="Perfect Forward Secrecy">
<t>Perfect forward secrecy (PFS) is a property that preserves the confidentiality of past conversations even in situations where the long-term secret is compromised.</t>
<t>The PSK ciphersuite recommended in <xref target="psk"/> does not offer this property since it does not utilize a Diffie-Hellman exchange. New ciphersuites that support PFS for PSK-based authentication, such as proposed in <xref target="I-D.schmertmann-dice-ccm-psk-pfs"/>, might become available as standardized ciphersuite in the (near) future. The recommended PSK-based ciphersuite offers excellent performance, a very small memory footprint, and has the lowest on the wire overhead at the expense of not using any public cryptography. For deployments where public key cryptography is acceptable the raw public might offer an acceptable middleground between the PSK ciphersuite in terms of out-of-band validation and the functionality offered by asymmetric cryptography.</t>
<t>The use of PFS is a trade-off decision since on one hand the compromise of long-term secrets of embedded devices is more likely than with many other Internet hosts but on the other hand a Diffie-Hellman exchange requires ephemeral key pairs to be generated, which is demanding from a performance point of view. For performance reasons some implementations re-use key pairs over multiple exchanges (rather than generating new keys for each exchange) for the obvious performance improvement. Note, however, that such key re-use over long periods voids the benefits of forward secrecy when an attack gains access to this DH key pair.</t>
<t>The impact of the disclosure of past conversations and the desire to increase the cost for pervasive monitoring (as demanded by <xref target="RFC7258"/>) has to be taken into account when making a deployment decision.</t>
<t>Client implementations claiming support of this profile MUST implement the ciphersuites listed in <xref target="credentials"/> according to the selected credential type.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Keep-Alive">
<t>RFC 6520 <xref target="RFC6520"/> defines a heartbeat mechanism to test whether the other peer is still alive. The same mechanism can also be used to perform Path Maximum Transmission Unit (MTU) Discovery.</t>
<t>A recommendation about the use of RFC 6520 depends on the type of message exchange an IoT device performs. There are three types of exchanges that need to be analysed:</t>
<t><list style="hanging">
<t hangText="Client-Initiated, One-Shot Messages"><vspace blankLines="1"/>
This is a common communication pattern where IoT devices upload data to
a server on the Internet on an irregular basis. The communication may be
triggered by specific events, such as opening a door.
<vspace blankLines="1"/>
Since the upload happens on an irregular and unpredictable basis and due
to renumbering and Network Address Translation (NAT) the DTLS handshake may need to be re-started (ideally using session resumption, if possible).
<vspace blankLines="1"/>
In this case there is no use for a keep-alive extension for this scenario.
</t>
<t hangText="Client-Initiated, Regular Data Uploads"><vspace blankLines="1"/>
This is a variation of the previous case whereby data gets uploaded on a
regular basis, for example, based on frequent temperature readings.
If neither NAT bindings nor IP
address changes occurred then the record layer will not notice any
changes. For the case where the IP address and port number changes, it is necessary
to re-create the record layer using session resumption.
<vspace blankLines="1"/>
In this scenario there is no use for a keep-alive extension. It is also very
likely that the device will enter a sleep cycle in between data transmissions
to keep power consumption low.</t>
<t hangText="Server-Initiated Messages"><vspace blankLines="1"/>
In the two previous scenarios the client initiated the protocol interaction but in
this case we consider server-initiated messages. Since messages to the
client may get blocked by intermediaries, such as NATs (including IPv4/IPv6 protocol translators) and stateful packet
filtering firewalls, the initial connection setup is triggered by the client
and then kept alive. Since state at middleboxes expires fairly quickly (according to measurements described in <xref target="HomeGateway"/>),
regular heartbeats are necessary whereby these keep-alive messages may be
exchanged at the application layer or within DTLS itself.
<vspace blankLines="1"/>
For this message exchange pattern the use of DTLS heartbeat messages is
quite useful but may interfere with registrations kept at the application layer (for example when the CoAP resource directory is used). The MTU discovery mechanism, which is also part of <xref target="RFC6520"/>, is less
likely to be relevant since for many IoT deployments the most constrained
link is the wireless interface between the IoT device and the network itself (rather than
some links along the end-to-end path). Only in more complex network topologies, such as multi-hop mesh networks, path MTU discovery might be appropriate. It also has to be noted that DTLS itself already provides a basic path discovery mechanism (see Section 4.1.1.1 of RFC 6347 by using the fragmentation capability of the handshake protocol).</t>
</list>
</t>
<t>For server-initiated messages the heartbeat extension is RECOMMENDED.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="timeouts" title="Timeouts">
<t>To connect to the Internet a variety of wired and wireless technologies are available. Many of the low power radio technologies, such as IEEE 802.15.4 or Bluetooth Smart, only support small frame sizes (e.g., 127 bytes in case of IEEE 802.15.4 as explained in RFC 4919 <xref target="RFC4919"/>). Other radio technologies, such as the Global System for Mobile Communications (GSM) using the short messaging service (SMS) have similar constraints in terms of payload sizes, such as 140 bytes without the optional segmentation and reassembly scheme known as Concatenated SMS, but show higher latency.
</t>
<t>The DTLS handshake protocol adds a fragmentation and reassembly mechanism to the TLS handshake protocol since each DTLS record must fit within a single transport layer datagram, as described in Section 4.2.3 of <xref target="RFC6347"/>. Since handshake messages are potentially bigger than the maximum record size, the mechanism fragments a handshake message over a number of DTLS records, each of which can be transmitted separately.</t>
<t>To deal with the unreliable message delivery provided by UDP, DTLS adds timeouts and re-transmissions, as described in Section 4.2.4 of <xref target="RFC6347"/>. Although the timeout values are implementation specific, recommendations are provided in Section 4.2.4.1 of <xref target="RFC6347"/>, with an initial timer value of 1 second and twice the value at each retransmission up to no less than 60 seconds. Due to the nature of some radio technologies, these values are too aggressive and lead to spurious failures when messages in flight need longer.</t>
<t>Note: If a round-trip time estimator (such as proposed in <xref target="I-D.bormann-core-cocoa"/>) is available in the protocol stack of the device, it could be used to dynamically update the setting of the retransmit timeout.</t>
<t>Choosing appropriate timeout values is difficult with infrequent data transmissions, changing network conditions, and large variance in latency. This specification therefore RECOMMENDS an initial timer value of 10 seconds with exponential back off up to no less then 60 seconds. <xref target="DTLSoSMS"/> provides additional normative text for carrying DTLS over SMS. </t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Random Number Generation">
<t>The TLS/DTLS protocol requires random numbers to be available during the protocol run. For example, during the ClientHello and the ServerHello exchange the client and the server exchange random numbers. Also, the use of the Diffie-Hellman exchange requires random numbers during the key pair generation. Special care has to be paid when generating random numbers in embedded systems as many entropy sources available on desktop operating systems or mobile devices might be missing, as described in <xref target="Heninger"/>. Consequently, if not enough time is given during system start time to fill the entropy pool then the output might be predictable and repeatable, for example leading to the same keys generated again and again.</t>
<t>It is important to note that sources contributing to the randomness pool on laptops, or desktop PCs are not available on many IoT device, such as mouse movement, timing of keystrokes, air turbulence on the movement of hard drive heads, etc. Other sources have to be found or dedicated hardware has to be added.</t>
<t>The ClientHello and the ServerHello messages contains the 'Random' structure, which has two components: gmt_unix_time and a random sequence of 28 random bytes. gmt_unix_time holds the current time and date in standard UNIX 32-bit format (seconds since the midnight starting Jan 1, 1970, GMT). <xref target="I-D.mathewson-no-gmtunixtime"/> argues that the entire ClientHello.Random value (including gmt_unix_time) should be set to a cryptographically random sequence because of privacy concerns regarding device fingerprinting. Since many IoT devices do not have access to a real-time clock this recommendation it is RECOMMENDED to follow the guidance outlined in <xref target="I-D.mathewson-no-gmtunixtime"/> regarding the content of the ClientHello.Random field. However, for the ServerHello.Random structure it is RECOMMENDED to maintain the existing structure with gmt_unix_time followed by a random sequence of 28 random bytes since the client can use the received time information to securely obtain time information. For constrained servers it cannot be assumed that they maintain accurate time information; these devices MUST include time information in the Server.Random structure when they actually obtain accurate time information that can be utilized by clients. Clients MUST only use time information obtained from servers they trust.</t>
<t>IoT devices using TLS/DTLS MUST offer ways to generate quality random numbers. Note that these hardware-based random number generators do not necessarily need to be implemented inside the microcontroller itself but could be made available in dedicated crypto-chips as well. Guidelines and requirements for random number generation can be found in RFC 4086 <xref target="RFC4086"/> and in the NIST Special Publication 800-90a <xref target="SP800-90A"/>.</t>
<t>Chip manufacturers are highly encouraged to provide sufficient documentation of their design for random number generators so that customers can have confidence about the quality of the generated random numbers. The confidence can be increased by providing information about the procedures that have been used to verify the randomness of numbers generated by the hardware modules. For example, NIST Special Publication 800-22b <xref target="SP800-22b"/> describes statistical tests that can be used to verify random random number generators.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Truncated MAC and Encrypt-then-MAC Extension">
<t>The truncated MAC extension was introduced with RFC 6066 <xref target="RFC6066"/> with the goal to reduce
the size of the MAC used at the Record Layer. This extension was developed for TLS
ciphersuites that used older modes of operation where the MAC and the encryption
operation was performed independently.</t>
<t>The recommended ciphersuites in this document use the newer Authenticated
Encryption with Associated Data (AEAD) construct, namely the CBC-MAC mode (CCM)
with eight-octet authentication tags, and are therefore not appliable to the truncated MAC extension.</t>
<t>RFC 7366 <xref target="RFC7366"/> introduced the encrypt-then-MAC extension (instead of the previously used MAC-then-encrypt) since the MAC-then-encrypt mechanism has
been the subject of a number of security vulnerabilities. RFC 7366 is, however, also not applicable to the AEAD ciphers recommended in this document.</t>
<t>Implementations conformant to this specification MUST use AEAD ciphers and RFC 7366 and RFC 6066 MUST NOT be implemented. </t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Server Name Indication (SNI)">
<t>The Server Name Indication extension defined in <xref target="RFC6066"/> defines a mechanism for a client to tell a TLS/DTLS server the name of the server it wants to contact. This is a useful extension for many hosting environments where multiple virtual servers are run on single IP address.</t>
<t>This specification RECOMMENDs the implementation of RFC 6066 unless it is known that a TLS/DTLS client does not interact with a server
in a hosting environment.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Maximum Fragment Length Negotiation">
<t>This RFC 6066 extension lowers the maximum fragment length support needed for the
Record Layer from 2^14 bytes to 2^9 bytes.</t>
<t>This is a very useful extension that allows the client to indicate to the
server how much maximum memory buffers it uses for incoming messages.
Ultimately, the main benefit of this extension is it to allows client
implementations to lower their RAM requirements since the client does not
need to accept packets of large size (such as 16k packets as
required by plain TLS/DTLS).</t>
<t>Client implementations MUST support this extension.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Session Hash">
<t>In order to begin connection protection, the Record Protocol requires specification
of a suite of algorithms, a master secret, and the client and server random values. The algorithm for computing the master secret is defined in Section 8.1 of RFC 5246 but only includes a small number of parameters exchanged during the handshake and does not include parameters like the client and server identities. This can be utilized by an attacker to mount a man-in-the-middle
attack since the master secret is not guaranteed to be unique across sessions, as discovered in the 'Triple Handshake' attack <xref target="Tripple-HS"/>.</t>
<t><xref target="I-D.ietf-tls-session-hash"/> defines a TLS extension that binds the master secret
to a log of the full handshake that computes it, thus preventing such attacks. </t>
<t>Client implementations SHOULD implement this extension
even though the ciphersuites recommended by this profile are not vulnerable to this attack. For
Diffie-Hellman-based ciphersuites the keying material is contributed by both parties and in
case of the pre-shared secret key ciphersuite both parties need to be in possession of the
shared secret to ensure that the handshake completes successfully. It is, however, possible
that some application layer protocols will tunnel other authentication protocols on top of
DTLS making this attack relevant again.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Re-Negotiation Attacks">
<t>TLS/DTLS allows a client and a server who already have a TLS/DTLS connection to negotiate new parameters, generate new keys, etc by using the re-negotiation feature. Renegotiation happens in the existing connection, with the new handshake packets being encrypted along with application data. Upon completion of the re-negotiation procedure the new channel replaces the old channel.</t>
<t>As described in RFC 5746 <xref target="RFC5746"/> there is no cryptographic binding between the two handshakes, although the new handshake is carried out
using the cryptographic parameters established by the original handshake.</t>
<t>To prevent the re-negotiation attack <xref target="RFC5746"/> this specification RECOMMENDS to disable the TLS renegotigation feature. Clients MUST respond to server-initiated re-negotiation attempts with an alert message (no_renegotiation) and clients MUST NOT initiate them. </t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Downgrading Attacks">
<t>When a client sends a ClientHello with a version higher than the highest version known to the server, the server is supposed to reply with ServerHello.version equal to the highest version known to the server and the handshake can proceed. This behaviour is known as version tolerance. Version-intolerance is when the server (or a middlebox) breaks the handshake when it sees a ClientHello.version higher than what it knows about. This is the behaviour that leads some clients to re-run the handshake with lower version. As a result, a potential security vulnerability is introduced when a system is running an old TLS/SSL version (e.g., because of the need to integrate with legacy systems). In the worst case, this allows an attacker to downgrade the protocol handshake to SSL 3.0. SSL 3.0 is so broken that there is no secure cipher available for it (see <xref target="I-D.ietf-tls-sslv3-diediedie"/>).</t>
<t>The above-described downgrade vulnerability is solved by the TLS Fallback Signaling Cipher Suite Value (SCSV) <xref target="I-D.ietf-tls-downgrade-scsv"/> extension. However, the solution is not appliable to implementations conforming to this profile since the version negotiation MUST use TLS/DTLS version 1.2 (or higher). More specifically, this implies: <list style="symbols">
<t>Clients MUST NOT send a TLS/DTLS version lower than version 1.2 in the ClientHello.</t>
<t>Clients MUST NOT retry a failed negotiation offering a TLS/DTLS version lower than 1.2.</t>
<t>Servers MUST fail the handshake by sending a protocol_version fatal alert if a TLS/DTLS version >= 1.2 cannot be negotiated. Note that the aborted connection is non-resumable.</t>
</list>
</t>
<t>If at some time in the future the TLS/DTLS 1.2 profile reaches the quality of SSL 3.0 a software update mechanism is needed since constrained devices are unlikely to run multiple TLS/DTLS versions due to memory size restrictions.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Crypto Agility">
<t>This document recommends software and chip manufacturers to implement AES and the CCM mode of operation. This document references the CoAP recommended ciphersuite choices, which have been selected based on implementation and deployment experience from the IoT community. Over time the preference for algorithms will, however, change. Not all components of a ciphersuite are likely to change at the same speed. Changes are more likely expected for ciphers, the mode of operation, and the hash algorithms. The recommended key lengths have to be adjusted over time. Some deployment environments will also be impacted by local regulation, which might dictate a certain cipher and key size. Ongoing discussions regarding the choice of specific ECC curves will also likely to impact implementations.</t>
<t>The following recommendations can be made to chip manufacturers:<list style="symbols">
<t>Make any AES hardware-based crypto implementation accessible to developers working on security implementations at higher layers. Sometimes hardware implementatios are added to microcontrollers to offer support for functionality needed at the link layer and are only available to the on-chip link layer protocol implementation. </t>
<t>Provide flexibility for the use of the crypto function with future extensibility in mind. For example, making an AES-CCM implementation available to developers is a first step but such an implementation may not be usable due to parameter differences between an AES-CCM implementations. AES-CCM in IEEE 802.15.4 and Bluetooth Smart uses a nonce length of 13-octets while DTLS uses a nonce length of 12-octets. Hardware implementations of AES-CCM for IEEE 802.15.4 and Bluetooth Smart are therefore not re-usable by a DTLS stack. </t>
<t>Offer access to building blocks in addition (or as an alternative) to the complete functionality. For example, a chip manufacturer who gives developers access to an the AES crypto function can use it in functions to build an efficient AES-GCM implementations. Another example is to make a special instruction available that increases the speed of speed-up carryless multiplications.</t>
</list>
</t>
<t>As a recommendation for developers and product architects we recommend that sufficient headroom is provided to allow an upgrade to a newer cryptographic algorithms over the lifetime of the product. As an example, while AES-CCM is recommended thoughout this specification future products might use the ChaCha20 cipher in combination with the Poly1305 authenticator <xref target="I-D.irtf-cfrg-chacha20-poly1305"/>. The assumption is made that a robust software update mechanism is offered.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Key Length Recommendations">
<t>RFC 4492 <xref target="RFC4492"/> gives approximate comparable key sizes for symmetric- and asymmetric-key cryptosystems based on the best-known algorithms for attacking them. While other publications suggest slightly different numbers, such as <xref target="Keylength"/>, the approximate relationship still holds true. <xref target="kl-table"/> illustrates the comparable key sizes in bits.</t>
<t>At the time of writing the key size recommendations for use with TLS-based ciphers found in <xref target="I-D.ietf-uta-tls-bcp"/> recommend DH key lengths of at least 2048 bit, which corresponds to a 112-bit symmetric key and a 233 bit ECC keys. These recommendations are inline with those from other organizations, such as National Institute of Standards and Technology (NIST) or European Network and Information Security Agency (ENISA). The authors of <xref target="ENISA-Report2013"/> add that a symmetric 80-bit security level is sufficient for legacy applications for the coming years, but a 128-bit security level is the minimum requirement for new systems being deployed. The authors further note that one needs to also take into account the length of time data needs to be kept secure for. The use 80-bit encryption for transactional data may be acceptable for the near future while one has to insist on 128-bit encryption for long lived data.</t>
<t>
<figure title="Comparable Key Sizes (in bits)." anchor="kl-table">
<artwork>
<![CDATA[
Symmetric | ECC | DH/DSA/RSA
------------+---------+-------------
80 | 163 | 1024
112 | 233 | 2048
128 | 283 | 3072
192 | 409 | 7680
256 | 571 | 15360
]]>
</artwork>
</figure>
</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="False Start">
<t>A full TLS handshake as specified in <xref target="RFC5246"/> requires two full protocol rounds (four flights) before the handshake is complete and the protocol parties may begin to send application data.</t>
<t>An abbreviated handshake (resuming an earlier TLS session) is complete after three flights, thus adding just one round-trip time if the client sends application data first.</t>
<t>If the conditions outlined in <xref target="I-D.bmoeller-tls-falsestart"/> are met, application data can be transmitted when the sender has sent its own "ChangeCipherSpec" and "Finished" messages. This achieves an improvement of one round-trip time for full handshakes if the client sends application data first, and for abbreviated handshakes if the server sends application data first.</t>
<t>The conditions for using the TLS False Start mechanism are met by the public-key-based ciphersuites in this document. In summary, the conditions are
<list style="symbols">
<t>Modern symmetric ciphers with an effective key length of 128 bits, such as AES-128-CCM</t>
<t>Client certificate types, such as ecdsa_sign</t>
<t>Key exchange methods, such as ECDHE_ECDSA</t>
</list>
</t>
<t>Based on the improvement over a full roundtrip for the full TLS/DTLS exchange this specification RECOMMENDS the use of the False Start mechanism when clients send application data first.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Privacy Considerations" anchor="privacy">
<t>The DTLS handshake exchange conveys various identifiers, which can be observed by an on-path eavesdropper. For example,
the DTLS PSK exchange reveals the PSK identity, the supported extensions, the session id, algorithm parameters, etc.
When session resumption is used then individual TLS sessions can be correlated by an on-path adversary.
With many IoT deployments it is likely that keying material and their identifiers
are persistent over a longer period of time due to the cost of updating software on these devices.</t>
<t>User participation with many IoT deployments poses a challenge since many of the IoT devices operate unattended, even though they will initially be provisioned by a human.
The ability to control data sharing and to configure preference will have to be provided at a system level rather than at the level of the DTLS exchange itself, which is the scope
of this document. Quite naturally, the use of DTLS with mutual authentication will allow a TLS server to collect authentication information about the IoT device (likely over a long period of time). While this strong form of authentication will prevent mis-attribution it also allows strong identification. Device-related data collection (e.g., sensor recordings) will be associated with other data to be truly useful and this extra data might include personal data about the owner of the device or data about the environment it senses. Consequently, the data stored on the server-side will be vulnerable to stored data compromise. For the communication between the client and the server this specification prevents eavesdroppers to gain access to the communication content. While the PSK-based ciphersuite does not provide PFS the asymmetric versions do. This prevents an adversary from obtaining past communication content when access to a long-term secret has been gained. Note that no extra effort to make traffic analysis more difficult is provided by the recommendations made in this document.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Security Considerations" anchor="security">
<t>This entire document is about security.</t>
<t>We would also like to point out that designing a software update mechanism into an IoT system is crucial to ensure that both functionality can be enhanced and that potential vulnerabilities can be fixed. This software update mechanism is important for changing configuration information, for example, trust anchors and other keying related information. Such a suitable software update mechanism is available with the Lightweight Machine-to-Machine (LWM2M) protocol published by the Open Mobile Alliance (OMA) <xref target="LWM2M"/>.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="IANA Considerations" anchor="iana">
<t>This document includes no request to IANA.</t>
</section>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section title="Acknowledgements" anchor="acknowledgements">
<t>Thanks to
Paul Bakker,
Robert Cragie,
Russ Housley,
Rene Hummen,
Matthias Kovatsch,
Sandeep Kumar,
Sye Loong Keoh,
Alexey Melnikov,
Manuel Pegourie-Gonnard,
Akbar Rahman,
Eric Rescorla,
Michael Richardson,
Zach Shelby,
Michael StJohns,
Rene Struik, and
Sean Turner
for their helpful comments and discussions that have shaped the document.</t>
<t>Big thanks also to Klaus Hartke, who wrote the initial version of this document.</t>
<t>Finally, we would like to thank our area director (Stephen Farrell) and our working group chairs (Zach Shelby and Dorothy Gellert) for their support.</t>
</section>
</middle>
<back>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<references title="Normative References">
&RFC5246; <!-- TLS 1.2 -->
&RFC5746; <!-- Renegotiation Indication Extension -->
&RFC6066; <!-- Extension Definitions -->
&RFC6347; <!-- DTLS 1.2 -->
&RFC6520; <!-- Heartbeat Extension -->
&RFC4279; <!-- TLS PSK -->
&RFC6125; <!-- Server ID Check -->
&RFC2119; <!-- Requirements Terminology -->
&I-D.ietf-tls-cached-info;
&I-D.ietf-tls-session-hash;
&RFC7250; <!-- Using Raw Public Keys in DTLS -->
&RFC7251; <!-- AES-CCM Elliptic Curve Cryptography (ECC) Cipher Suites for TLS -->
<reference anchor="EUI64" target="http://standards.ieee.org/regauth/oui/tutorials/EUI64.html">
<front>
<title>GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) REGISTRATION AUTHORITY</title>
<author><organization/></author><date month='April' day='23' year='2010' />
</front>
</reference>
<reference anchor="WAP-WDP">
<front>
<title>Wireless Datagram Protocol</title>
<author>
<organization>Wireless Application Protocol Forum</organization>
</author>
<date month="June" year="2001" />
</front>
</reference>
<reference anchor="GSM-SMS">
<front>
<title>3GPP TS 23.040 V7.0.1 (2007-03): 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Technical realization of the Short Message Service (SMS) (Release 7)</title>
<author>
<organization>ETSI</organization>
</author>
<date month="March" year="2007" />
</front>
</reference>
</references> <!-- Normative Refs -->
<references title="Informative References">
&RFC1191; <!-- PMTU discovery for IPv4 -->
&RFC1981; <!-- PMTU discovery for IPv6 -->
&RFC4492; <!-- ECC Cipher Suites for TLS -->
&RFC5077; <!-- Session Resumption without Server-Side State -->
&RFC7252; <!-- Constrained Application Protocol (CoAP) -->
<reference anchor="IANA-TLS">
<front>
<title>TLS Cipher Suite Registry</title>
<author>
<organization>IANA</organization>
</author>
<date year="2014"/>
</front>
<seriesInfo name="" value="http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4"/>
</reference>
<reference anchor="LWM2M">
<front>
<title>Lightweight Machine-to-Machine, Technical Specification, Candidate Version 1.0</title>
<author>
<organization>Open Mobile Alliance</organization>
</author>
<date month="December" year="2013" />
</front>
<format type='HTML'
target='http://openmobilealliance.org/about-oma/work-program/m2m-enablers/' />
</reference>
<reference anchor="HomeGateway">
<front>
<title>An experimental study of home gateway characteristics, In Proceedings of the '10th annual conference on Internet measurement'</title>
<author initials="L." surname="Eggert" fullname="Lars Eggert">
<organization/>
</author>
<date year="2010"/>
</front>
<format type='PDF'
target='http://eggert.org/papers/2010-imc-hgw-study.pdf' />
</reference>
<!-- &I-D.ietf-tls-applayerprotoneg; -->
<!-- &RFC5289; TLS Elliptic Curve Cipher Suites with SHA-256/384 and AES Galois Counter Mode (GCM) -->
<!-- &RFC3552; Guidelines for Writing RFC Text on Security Considerations -->
&RFC4086; <!-- Randomness Requirements for Security -->
<!-- &RFC6973; Privacy Considerations for Internet Protocols -->
&RFC6090; <!-- Fundamental Elliptic Curve Cryptography Algorithms -->
&RFC5934; <!-- Trust Anchor Management Protocol (TAMP) -->
&RFC5280; <!-- Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile -->
&RFC6961; <!-- The Transport Layer Security (TLS) Multiple Certificate Status Request Extension -->
&RFC5116; <!-- An Interface and Algorithms for Authenticated Encryption -->
&RFC5758; <!-- Internet X.509 Public Key Infrastructure: Additional Algorithms and Identifiers for DSA and ECDSA-->
&RFC6655; <!-- AES-CCM Cipher Suites for Transport Layer Security (TLS)-->
&I-D.schmertmann-dice-ccm-psk-pfs; <!-- PSK ciphersuite supporting PFS-->
&RFC7258; <!-- Pervasive Monitoring Is an Attack -->
&I-D.ietf-lwig-tls-minimal;
&I-D.ietf-tls-negotiated-dl-dhe;
&I-D.ietf-tls-downgrade-scsv;
&I-D.ietf-tls-prohibiting-rc4;
&I-D.mathewson-no-gmtunixtime;
&I-D.iab-smart-object-architecture;
&I-D.bmoeller-tls-falsestart;
&RFC7366; <!-- Encrypt-then-MAC -->
&RFC7228; <!-- Terminology for Constrained-Node Networks -->
&RFC4919; <!-- 6LoWPANs Overview, Assumptions, Problem Statement, and Goals -->
&I-D.bormann-core-cocoa;
&RFC2104; <!-- HMAC -->
&RFC4634; <!-- SHA -->
&RFC3610; <!-- Counter with CBC-MAC (CCM) -->
&RFC5288; <!-- AES Galois Counter Mode (GCM) Cipher Suites for TLS -->
&RFC7400; <!-- Generic Header Compression -->
&RFC5247; <!-- EAP Keying Framework -->
&RFC5216; <!-- EAP TLS -->
&RFC7397; <!-- Report from the Smart Object Security Workshop -->
&RFC7390; <!-- Group Communication for the Constrained Application Protocol (CoAP) -->
&RFC6690; <!-- Constrained RESTful Environments (CoRE) Link Format -->
&I-D.ietf-core-resource-directory;
<reference anchor="AES">
<front>
<title>FIPS PUB 197, Advanced Encryption Standard (AES)</title>
<author>
<organization>NIST</organization>
</author>
<date month="November" year="2001"/>
</front>
<seriesInfo name="" value="http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4"/>
</reference>
<reference anchor="SP800-22b">
<front>
<title>Special Publication 800-22, Revision 1a, A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications</title>
<author>
<organization>NIST</organization>
</author>
<date month="April" year="2010"/>
</front>
<seriesInfo name="" value="http://csrc.nist.gov/publications/nistpubs/800-22-rev1a/SP800-22rev1a.pdf"/>
</reference>
<reference anchor="SP800-90A">
<front>
<title>DRAFT Special Publication 800-90a, Revision 1, Recommendation for Random Number Generation Using Deterministic Random Bit Generators</title>
<author>
<organization>NIST</organization>
</author>
<date month="November" year="2014"/>
</front>
<seriesInfo name="" value="http://csrc.nist.gov/publications/drafts/800-90/sp800-90a_r1_draft_november2014_ver.pdf"/>
</reference>
&I-D.irtf-cfrg-chacha20-poly1305;
&I-D.ietf-tls-sslv3-diediedie;
<!-- &I-D.campagna-suitee;
&I-D.cooper-ietf-privacy-requirements;
&I-D.greevenbosch-tls-ocsp-lite;
&I-D.hummen-dtls-extended-session-resumption;
&I-D.pettersen-tls-version-rollback-removal;
-->
&I-D.ietf-uta-tls-bcp;
<reference anchor="Keylength">
<front>
<title>Cryptographic Key Length Recommendations</title>
<author initials="D." surname="Giry" fullname="D. Giry">
<organization/>
</author>
<date month="November" year="2014"/>
</front>
<seriesInfo name="" value="http://www.keylength.com"/>
</reference>
<reference anchor="ENISA-Report2013">
<front>
<title>Algorithms, Key Sizes and Parameters Report - 2013</title>
<author>
<organization>ENISA</organization>
</author>
<date month="October" year="2013"/>
</front>
<seriesInfo name="" value="http://www.enisa.europa.eu/activities/identity-and-trust/library/deliverables/algorithms-key-sizes-and-parameters-report"/>
</reference>
<reference anchor="Tripple-HS">
<front>
<title>Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS</title>
<author initials="K" surname="Bhargavan" fullname="K. Bhargavan">
<organization/>
</author>
<author initials="C" surname="Delignat-Lavaud" fullname="C. Delignat-Lavaud">
<organization/>
</author>
<author initials="A" surname="Pironti" fullname="A. Pironti">
<organization/>
</author>
<author initials="P" surname="Strub" fullname="P. Strub">
<organization/>
</author>
<date year="2014"/>
</front>
<seriesInfo name="" value="IEEE Symposium on Security and Privacy, pages 98-113"/>
</reference>
<reference anchor="ImprintingSurvey">
<front>
<title>A Brief Survey of Imprinting Options for Constrained Devices</title>
<author fullname="Eric Rescorla" initials="E" surname="Chilton">
</author>
<date month="March" year="2012"/>
</front>
<seriesInfo name=""
value="URL: http://www.lix.polytechnique.fr/hipercom/SmartObjectSecurity/papers/EricRescorla.pdf" />
<format target="http://www.lix.polytechnique.fr/hipercom/SmartObjectSecurity/papers/EricRescorla.pdf"
type="HTML" />
</reference>
<reference anchor="ACE-WG">
<front>
<title>Authentication and Authorization for Constrained Environments (ace) Working Group</title>
<author>
<organization>IETF</organization>
</author>
<date month="Jan" year="2015"/>
</front>
<seriesInfo name=""
value="URL: https://datatracker.ietf.org/wg/ace/charter/" />
<format target="https://datatracker.ietf.org/wg/ace/charter/"
type="HTML" />
</reference>
<reference anchor="Heninger">
<front>
<title>Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices</title>
<author initials="N" surname="Heninger" fullname="Nadia Heninger">
<organization/>
</author>
<author initials="Z" surname="Durumeric" fullname="Zakir Durumeric">
<organization/>
</author>
<author initials="E" surname="Wustrow" fullname="Eric Wustrow">
<organization/>
</author>
<author initials="A" surname="Halderman" fullname="Alex Halderman">
<organization/>
</author>
<date year="2012"/>
</front>
<seriesInfo name="" value="21st USENIX Security Symposium, https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/heninger"/>
</reference>
</references>
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<!-- **************************************************************** -->
<section anchor="DTLSoSMS" title="Conveying DTLS over SMS">
<t>This section is normative for the use of DTLS over SMS. Timer recommendations are already outlined in <xref target="timeouts"/> and also applicable to the transport of DTLS over SMS.</t>
<t>This section requires readers to be familiar with the terminology
and concepts described in <xref target="GSM-SMS"/>, and <xref target="WAP-WDP"/>.</t>
<t>The remainder of this section assumes Mobile Stations are
capable of producing and consuming 8-bit binary data encoded
Transport Protocol Data Units (TPDU).</t>
<section anchor="DTLSoSMSoverview" title="Overview">
<t>DTLS adds an additional roundtrip to the TLS <xref target="RFC5246"/> handshake to
serve as a return-routability test for protection against certain
types of DoS attacks. Thus a full blown DTLS handshake comprises up
to 6 "flights" (i.e., logical message exchanges), each of which is then mapped on to one or more DTLS records using the segmentation and reassembly (SaR) scheme described in Section 4.2.3 of <xref target="RFC6347"/>. The overhead for said scheme is 6 bytes per Handshake message which,
given a realistic 10+ messages handshake, would amount around 60
bytes across the whole handshake sequence.</t>
<t>Note that the DTLS SaR scheme is defined for handshake messages
only. In fact, DTLS records are never fragmented and MUST fit within a single transport layer datagram.</t>
<t>SMS provides an optional segmentation and reassembly scheme as well,
known as Concatenated short messages (see Section 9.2.3.24.1 of
<xref target="GSM-SMS"/>). However, since the SaR scheme in DTLS cannot be
circumvented, the Concatenated short messages mechanism SHOULD NOT be
used during handshake to avoid redundant overhead. Before starting
the handshake phase (either actively or passively), the DTLS
implementation MUST be explicitly configured with the PMTU of the SMS
transport in order to correctly instrument its SaR function. The
PMTU SHALL be 133 bytes if WDP-based multiplexing is used (see
<xref target="SAmux"/>), 140 bytes otherwise.</t>
<t>It is RECOMMENDED to use the established security context over the
longest possible period (possibly until a Closure Alert message is
received, or after a very long inactivity timeout) to avoid the
expensive re-establishment of the security association.</t>
</section>
<section title="Message Segmentation and Re-Assembly">
<t>The content of an SMS message is carried in the TP-UserData field,
and its size may be up to 140 bytes. As already mentioned in
<xref target="DTLSoSMSoverview"/>, longer (i.e., up to 34170 bytes) messages can be sent
using Concatenated SMS.</t>
<t>This scheme consumes 6-7 bytes (depending on whether the short or
long segmentation format is used) of the TP-UserData field, thus
reducing the space available for the actual content of the SMS
message to 133-134 bytes per TPDU.</t>
<t>Though in principle a PMTU value higher than 140 bytes could be used,
which may look like an appealing option given its more efficient use
of the transport, there are disadvantages to
consider. First, there is an additional overhead of 7 bytes per TPDU to be paid to
the SaR function (which is in addition to the overhead introduced by the DTLS
SaR mechanism. Second, some networks only partially support the Concatenated SMS function and
others do not support it at all.</t>
<t>For these reasons, the Concatenated short messages mechanism SHOULD
NOT be used, and it is RECOMMENDED to leave the same PMTU settings
used during the handshake phase, i.e., 133 bytes if WDP-
based multiplexing is enabled, 140 bytes otherwise.
</t>
<t>Note that, after DTLS handshake has completed, any fragmentation and
reassembly logic that pertains the application layer (e.g.,
segmenting CoAP messages into DTLS records and reassembling them
after the crypto operations have been successfully performed) needs
to be handled by the application that uses the established DTLS
tunnel.</t>
</section>
<section anchor="SAmux" title="Multiplexing Security Associations">
<t>Unlike IPsec ESP/AH, DTLS records do not contain any association
identifiers. Applications must arrange to multiplex between
associations on the same endpoint which, when using UDP/IP, is
usually done with the host/port number.</t>
<t>If the DTLS server allows more than one client to be active at any
given time, then the WAP User Datagram Protocol <xref target="WAP-WDP"/> can be used
to achieve multiplexing of the different security associations. (The
use of WDP provides the additional benefit that upper layer protocols
can operate independently of the underlying wireless network, hence
achieving application-agnostic transport handover.)</t>
<t>The total overhead cost for encoding the WDP source and destination
ports is 7 bytes out of the total available for the SMS content.</t>
<t>The receiving side of the communication gets the source address from
the originator address (TP-OA) field of the SMS-DELIVER TPDU. This
way an unique 4-tuple identifying the security association can be
reconstructed at both ends. (When replying to its DTLS peer, the
sender will swaps the TP-OA and TP-DA parameters and the source and
destination ports in the WDP.)</t>
</section>
<section title="Timeout">
<t>If SMS-STATUS-REPORT messages are enabled, their receipt is not to be
interpreted as the signal that the specific handshake message has
been acted upon by the receiving party. Therefore, it MUST NOT be
taken into account by the DTLS timeout and retransmission function.</t>
<t>Handshake messages MUST carry a validity period (TP-VP parameter in a
SMS-SUBMIT TPDU) that is not less than the current value of the
retransmission timeout. In order to avoid persisting messages in the
network that will be discarded by the receiving party, handshake
messages SHOULD carry a validity period that is the same as, or just
slightly higher than, the current value of the retransmission
timeout.</t>
</section>
</section>
<section title="DTLS Record Layer Per-Packet Overhead">
<t><xref target="Record-Layer-Overhead"/> shows the overhead for the DTLS record layer for protecting
data traffic when AES-128-CCM with an 8-octet Integrity Check Value (ICV) is used. </t>
<t>
<figure title="AES-128-CCM-8 DTLS Record Layer Per-Packet Overhead." anchor="Record-Layer-Overhead">
<artwork>
<![CDATA[
DTLS Record Layer Header................13 bytes
Nonce (Explicit).........................8 bytes
ICV..................................... 8 bytes
------------------------------------------------
Overhead................................29 bytes
------------------------------------------------
]]>
</artwork>
</figure>
</t>
<t>The DTLS record layer header has 13 octets and consists of
<list style="symbols">
<t>1 octet content type field,</t>
<t>2 octet version field,</t>
<t>2 octet epoch field,</t>
<t>6 octet sequence number,</t>
<t>2 octet length field.</t>
</list>
</t>
<t>The "nonce" input to the AEAD algorithm is exactly that of <xref target="RFC5288"/>,
i.e., 12 bytes long. It consists of a 4 octet salt and an 8 octet nonce.
The salt is the "implicit" part of the nonce and is not sent in the
packet. Since the nonce_explicit may be the 8 octet sequence number and,
in DTLS, it is the 8 octet epoch concatenated with the 6 octet sequence
number.</t>
<t>RFC 6655 <xref target="RFC6655"/> allows the nonce_explicit to be a sequence number
or something else. This document makes this use more restrictive for use with DTLS:
the 64-bit none_explicit MUST be the 16-bit epoch concatenated with the 48-bit seq_num.
The sequence number component of the nonce_explicit field at the AES-CCM
layer is an exact copy of the sequence number in the record layer header
field. This leads to a duplication of 8-bytes per record.</t>
<t>To avoid this 8-byte duplication RFC 7400 <xref target="RFC7400"/>
provides help with the use of the generic header compression technique
for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs).
Note that this header compression technique is not available when DTLS
is exchanged over transports that do not use IPv6 or 6LoWPAN, such as
the SMS transport described in <xref target="DTLSoSMS"/>. </t>
</section>
<section title="DTLS Fragmentation">
<t>[Editor's Note: Proposed text that requires discussion. ]</t>
<t>Section 4.2.3 of <xref target="RFC6347"/> advises DTLS implementations to not produce overlapping fragments, but requires receivers to be able to cope with them. The need for the latter requisite is explained in Section 4.1.1.1 of <xref target="RFC6347"/>: accurate path MTU (PMTU) estimation may be traded for shorter handshake completion time. This approach may be beneficial in unconstrained networks where a PMTU of 1280 bytes can be pretty much universally assumed. However, when the handshake is carried over a narrow-band radio technology, such as IEEE 802.15.4 or GSM-SMS, and the client is lacking reliable PMTU data to inform fragmentation (e.g., using <xref target="RFC1981"/> or <xref target="RFC1191"/>) can put a cost on the constrained implementation in terms of memory (due to re-buffering) and latency (due to re-transmission) much higher than the benefit that it would get from a shorter handshake.</t>
<t> In order to reduce the likelihood of producing different fragment sizes (and consequent overlaps) within the same handshake, this document RECOMMENDs:
<list style="symbols">
<t>for clients (handshake initiators), to perform PMTU discovery towards the server before handshake starts, and not rely on any guesses (unless the network path characteristics are reliably known from another source);</t>
<t>for servers, to mirror the fragment size selected by their clients.</t>
</list>
</t>
</section>
</back>
</rfc>
| PAFTECH AB 2003-2026 | 2026-04-23 05:27:21 |