idnits 2.17.00 (12 Aug 2021) /tmp/idnits38958/draft-ietf-dice-profile-02.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords -- however, there's a paragraph with a matching beginning. Boilerplate error? (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). == Couldn't figure out when the document was first submitted -- there may comments or warnings related to the use of a disclaimer for pre-RFC5378 work that could not be issued because of this. Please check the Legal Provisions document at https://trustee.ietf.org/license-info to determine if you need the pre-RFC5378 disclaimer. -- The document date (July 4, 2014) is 2877 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'ChangeCipherSpec' is mentioned on line 612, but not defined == Unused Reference: 'RFC5246' is defined on line 921, but no explicit reference was found in the text == Unused Reference: 'I-D.cooper-ietf-privacy-requirements' is defined on line 969, but no explicit reference was found in the text == Unused Reference: 'RFC3552' is defined on line 996, but no explicit reference was found in the text == Unused Reference: 'RFC4492' is defined on line 1003, but no explicit reference was found in the text == Unused Reference: 'RFC5289' is defined on line 1019, but no explicit reference was found in the text == Unused Reference: 'RFC6973' is defined on line 1036, but no explicit reference was found in the text -- Possible downref: Non-RFC (?) normative reference: ref. 'EUI64' == Outdated reference: draft-ietf-tls-cached-info has been published as RFC 7924 ** Obsolete normative reference: RFC 5246 (Obsoleted by RFC 8446) ** Obsolete normative reference: RFC 6347 (Obsoleted by RFC 9147) ** Downref: Normative reference to an Informational RFC: RFC 7251 -- No information found for draft-bmoeller-tls-downgrade-scsv - is the name correct? == Outdated reference: draft-ietf-uta-tls-bcp has been published as RFC 7525 == Outdated reference: A later version (-01) exists of draft-schmertmann-dice-ccm-psk-pfs-00 -- Obsolete informational reference (is this intentional?): RFC 4492 (Obsoleted by RFC 8422) -- Obsolete informational reference (is this intentional?): RFC 5077 (Obsoleted by RFC 8446) -- Obsolete informational reference (is this intentional?): RFC 6961 (Obsoleted by RFC 8446) Summary: 3 errors (**), 0 flaws (~~), 13 warnings (==), 6 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 dice H. Tschofenig, Ed. 3 Internet-Draft ARM Ltd. 4 Intended status: Standards Track July 4, 2014 5 Expires: January 5, 2015 7 A Datagram Transport Layer Security (DTLS) 1.2 Profile for the Internet 8 of Things 9 draft-ietf-dice-profile-02.txt 11 Abstract 13 This document defines a DTLS profile that is suitable for Internet of 14 Things applications and is reasonably implementable on many 15 constrained devices. 17 A common design pattern in IoT deployments is the use of a 18 constrained device (typically providing sensor data) that interacts 19 with the web infrastructure. This document focuses on this 20 particular pattern. 22 Status of This Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on January 5, 2015. 39 Copyright Notice 41 Copyright (c) 2014 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 57 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 58 3. The Communication Model . . . . . . . . . . . . . . . . . . . 5 59 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6 60 5. Pre-Shared Secret Authentication with DTLS . . . . . . . . . 8 61 6. Raw Public Key Use with DTLS . . . . . . . . . . . . . . . . 9 62 7. Certificate Use with DTLS . . . . . . . . . . . . . . . . . . 11 63 8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 12 64 9. Session Resumption . . . . . . . . . . . . . . . . . . . . . 14 65 10. TLS Compression . . . . . . . . . . . . . . . . . . . . . . . 14 66 11. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 14 67 12. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 15 68 13. Random Number Generation . . . . . . . . . . . . . . . . . . 16 69 14. Client Certificate URLs . . . . . . . . . . . . . . . . . . . 17 70 15. Trusted CA Indication . . . . . . . . . . . . . . . . . . . . 17 71 16. Truncated MAC Extension . . . . . . . . . . . . . . . . . . . 18 72 17. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 18 73 18. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 18 74 19. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 18 75 20. Privacy Considerations . . . . . . . . . . . . . . . . . . . 19 76 21. Security Considerations . . . . . . . . . . . . . . . . . . . 19 77 22. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 20 78 23. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 20 79 24. References . . . . . . . . . . . . . . . . . . . . . . . . . 20 80 24.1. Normative References . . . . . . . . . . . . . . . . . . 20 81 24.2. Informative References . . . . . . . . . . . . . . . . . 21 82 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 23 84 1. Introduction 86 This document defines a DTLS 1.2 [RFC6347] profile that offers 87 communication security for Internet of Things (IoT) applications and 88 is reasonably implementable on many constrained devices. It aims to 89 meet the following goals: 91 o Serves as a one-stop shop for implementers to know which pieces of 92 the specification jungle contain relevant details. 94 o Does not alter the DTLS 1.2 specification. 96 o Does not introduce any new extensions. 98 o Aligns with the DTLS security modes of the Constrained Application 99 Protocol (CoAP) [RFC7252]. 101 DTLS is used to secure a number of applications run over an 102 unreliable datagram transport. CoAP [RFC7252] is one such protocol 103 and has been designed specifically for use in IoT environments. CoAP 104 can be secured a number of different ways, also called security 105 modes. These security modes are as follows, see Section 5, 106 Section 6, Section 7 for additional details: 108 No Security Protection at the Transport Layer: No DTLS is used but 109 instead application layer security functionality is assumed. 111 Shared Secret-based DTLS Authentication: DTLS supports the use of 112 shared secrets [RFC4279]. This mode is useful if the number of 113 communication relationships between the IoT device and servers is 114 small and for very constrained devices. Shared secret-based 115 authentication mechanisms offer good performance and require a 116 minimum of data to be exchanged. 118 DTLS Authentication using Asymmetric Cryptography: TLS supports 119 client and server authentication using asymmetric cryptography. 120 Two approaches for validating these public keys are available. 121 First, [RFC7250] allows raw public keys to be used in TLS without 122 the overhead of certificates. This approach requires out-of-band 123 validation of the public key. Second, the use of X.509 124 certificates [RFC5280] with TLS is common on the Web today (at 125 least for server-side authentication) and certain IoT environments 126 may also re-use those capabilities. Certificates bind an 127 identifier to the public key signed by a certification authority 128 (CA). A trust anchor store has to be provisioned on the device to 129 indicate what CAs are trusted. Furthermore, the certificate may 130 contain a wealth of other information used to make authorization 131 decisions. 133 As described in [I-D.ietf-lwig-tls-minimal], an application designer 134 developing an IoT device needs to consider the security threats and 135 the security services that can be used to mitigate the threats. 136 Enabling devices to upload data and retrieve configuration 137 information, inevitably requires that Internet-connected devices be 138 able to authenticate themselves to servers and vice versa as well as 139 to ensure that the data and information exchanged is integrity and 140 confidentiality protected. While these security services can be 141 provided at different layers in the protocol stack the use of 142 communication security, as offered by DTLS, has been very popular on 143 the Internet and it is likely to be useful for IoT scenarios as well. 144 In case the communication security features offered by DTLS meet the 145 security requirements of your application the remainder of the 146 document might offer useful guidance. 148 Not every IoT deployment will use CoAP but the discussion regarding 149 choice of credentials and cryptographic algorithms will be very 150 similar. As such, the discussions in this document are applicable 151 beyond the use of the CoAP protocol. 153 The design of DTLS is intentionally very similar to TLS. Since DTLS 154 operates on top of an unreliable datagram transport a few 155 enhancements to the TLS structure are, however necessary. RFC 6347 156 explains these differences in great detail. As a short summary, for 157 those not familiar with DTLS the differences are: 159 o An explicit sequence number and an epoch field is included in the 160 TLS Record Layer. Section 4.1 of RFC 6347 explains the processing 161 rules for these two new fields. The value used to compute the MAC 162 is the 64-bit value formed by concatenating the epoch and the 163 sequence number. 165 o Stream ciphers must not be used with DTLS. The only stream cipher 166 defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it 167 is not recommended anymore even for use with TLS. 169 o The TLS Handshake Protocol has been enhanced to include a 170 stateless cookie exchange for Denial of Service (DoS) resistance. 171 Furthermore, the header has been extended to deal with message 172 loss, reordering, and fragmentation. Retransmission timers have 173 been included to deal with message loss. For DoS protection a new 174 handshake message, the HelloVerifyRequest, was added to DTLS. 175 This handshake message is sent by the server and includes a 176 stateless cookie, which is returned in a ClientHello message back 177 to the server. This type of DoS protection mechanism has also 178 been incorporated into the design of IKEv2. Although the exchange 179 is optional for the server to execute, a client implementation has 180 to be prepared to respond to it. 182 2. Terminology 184 The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", 185 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 186 document are to be interpreted as described in [RFC2119]. 188 Note that "Client" and "Server" in this document refer to TLS roles, 189 where the Client initiates the TLS handshake. This does not restrict 190 the interaction pattern of the protocols carried inside TLS as the 191 record layer allows bi-directional communication. In the case of 192 CoAP the "Client" can act as a CoAP Server or Client. 194 3. The Communication Model 196 This document describes a profile of DTLS 1.2 and, to be useful, it 197 has to make assumptions about the envisioned communication 198 architecture. 200 The communication architecture shown in Figure 1 assumes a uni-cast 201 communication interaction with an IoT device utilizing a DTLS client 202 and that client interacts with one or multiple DTLS servers. 204 Clients are preconfigured with the address or addresses of servers 205 (e.g., as part of the firmware) they will communicate with as well as 206 authentication information: 208 o For PSK-based authentication (see Section 5), this includes the 209 paired "PSK identity" and shared secret to be used with each 210 server. 212 o For raw public key-based authentication (see Section 6), this 213 includes either the server's public key or the hash of the 214 server's public key. 216 o For certificate-based authentication (see Section 7), this may 217 include a pre-populated trust anchor store that allows the client 218 to perform path validation for the certificate obtained during the 219 handshake with the server. 221 This document only focuses on the description of the DTLS client-side 222 functionality. 224 +////////////////////////////////////+ 225 | Configuration | 226 |////////////////////////////////////| 227 | Server A --> PSK Identity, PSK | 228 | Server B --> Public Key (Server B),| 229 | Public Key (Client) | 230 | Server C --> Public Key (Client), | 231 | Trust Anchor Store | 232 +------------------------------------+ 233 oo 234 oooooo 235 o 236 +------+ 237 |Client|--- 238 +------+ \ 239 \ ,-------. 240 ,' `. +------+ 241 / IP-based \ |Server| 242 ( Network ) | A | 243 \ / +------+ 244 `. ,' 245 '---+---' +------+ 246 | |Server| 247 | | B | 248 | +------+ 249 | 250 | +------+ 251 +----------------->|Server| 252 | C | 253 +------+ 255 Figure 1: Constrained DTLS Client Profile. 257 4. The Ciphersuite Concept 259 TLS (and consequently DTLS) has the concept of ciphersuites and an 260 IANA registry [IANA-TLS] was created to register the suites. A 261 ciphersuite (and the specification that defines it) contains the 262 following information: 264 o Authentication and Key Exchange Algorithm (e.g., PSK) 266 o Cipher and Key Length (e.g., AES with 128 bit keys) 268 o Mode of operation (e.g., CBC) 269 o Hash Algorithm for Integrity Protection (e.g., SHA in combination 270 with HMAC) 272 o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC 273 with the SHA-256) 275 o Misc information (e.g., length of authentication tags) 277 o Information whether the ciphersuite is suitable for DTLS or only 278 for TLS 280 The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a 281 pre-shared authentication and key exchange algorithm. RFC 6655 282 [RFC6655] defines this ciphersuite. It uses the Advanced Encryption 283 Standard (AES) encryption algorithm, which is a block cipher. Since 284 the AES algorithm supports different key lengths (such as 128, 192 285 and 256 bits) this information has to be specified as well and the 286 selected ciphersuite supports 128 bit keys. A block cipher encrypts 287 plaintext in fixed-size blocks and AES operates on fixed block size 288 of 128 bits. For messages exceeding 128 bits, the message is 289 partitioned into 128-bit blocks and the AES cipher is applied to 290 these input blocks with appropriate chaining, which is called mode of 291 operation. 293 TLS 1.2 introduced Authenticated Encryption with Associated Data 294 (AEAD) ciphersuites [RFC5116]. AEAD is a class of block cipher modes 295 which encrypt (parts of) the message and authenticate the message 296 simultaneously. Examples of such modes include the Counter with CBC- 297 MAC (CCM) mode, and the Galois/Counter Mode (GCM). 299 Some AEAD ciphersuites have shorter authentication tags and are 300 therefore more suitable for networks with low bandwidth where small 301 message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite 302 that ends in "_8" has an 8-octet authentication tag, while the 303 regular CCM ciphersuites have 16-octet authentication tags. 305 TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in 306 the TLS pseudo random function (PRF) with cipher-suite-specified 307 PRFs. For this reason authors of more recent TLS 1.2 ciphersuite 308 specifications explicitly indicate the MAC algorithm and the hash 309 functions used with the TLS PRF. 311 This document references the CoAP recommended ciphersuite choices, 312 which have been selected based on implementation and deployment 313 experience from the IoT community. Over time the preference for 314 certain algorithms will, however, change. Not all components of a 315 ciphersuite change at the same speed. Changes are more likely to 316 expect for ciphers, the mode of operation, and the hash algorithms. 318 Some deployment environments will also be impacted by local 319 regulation, which might dictate a certain and less likely for public 320 key algorithms (such as RSA vs. ECC). 322 5. Pre-Shared Secret Authentication with DTLS 324 The use of pre-shared secret credentials is one of the most basic 325 techniques for DTLS since it is both computational efficient and 326 bandwidth conserving. Pre-shared secret based authentication was 327 introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in 328 Figure 2 illustrates the DTLS exchange including the cookie exchange. 329 While the server is not required to initiate a cookie exchange with 330 every handshake, the client is required to implement and to react on 331 it when challenged. 333 Client Server 334 ------ ------ 335 ClientHello --------> 337 <-------- HelloVerifyRequest 338 (contains cookie) 340 ClientHello --------> 341 (with cookie) 342 ServerHello 343 *ServerKeyExchange 344 <-------- ServerHelloDone 345 ClientKeyExchange 346 ChangeCipherSpec 347 Finished --------> 348 ChangeCipherSpec 349 <-------- Finished 351 Application Data <-------> Application Data 353 Legend: 355 * indicates an optional message payload 357 Figure 2: DTLS PSK Authentication including the Cookie Exchange. 359 [RFC4279] does not mandate the use of any particular type of 360 identity. Hence, the TLS client and server clearly have to agree on 361 the identities and keys to be used. The mandated encoding of 362 identities in Section 5.1 of RFC 4279 aims to improve 363 interoperability for those cases where the identity is configured by 364 a person using some management interface. Many IoT devices do, 365 however, not have a user interface and most of their credentials are 366 bound to the device rather than the user. Furthermore, credentials 367 are provisioned into trusted hardware modules or in the firmware by 368 the developers. As such, the encoding considerations are not 369 applicable to this usage environment. For use with this profile the 370 PSK identities SHOULD NOT assume a structured format (as domain 371 names, Distinguished Names, or IP addresses have) and a bit-by-bit 372 comparison operation can then be used by the server-side 373 infrastructure. 375 As described in Section 3 clients may have pre-shared keys with 376 several different servers. The client indicates which key it uses by 377 including a "PSK identity" in the ClientKeyExchange message. To help 378 the client in selecting which PSK identity / PSK pair to use, the 379 server can provide a "PSK identity hint" in the ServerKeyExchange 380 message. For IoT environments a simplifying assumption is made that 381 the hint for PSK key selection is based on the domain name of the 382 server. Hence, servers SHOULD NOT send the "PSK identity hint" in 383 the ServerKeyExchange message and client MUST ignore the message. 384 This approach is inline with RFC 4279 [RFC4279]. 386 RFC 4279 requires TLS implementations supporting PSK ciphersuites to 387 support arbitrary PSK identities up to 128 octets in length, and 388 arbitrary PSKs up to 64 octets in length. This is a useful 389 assumption for TLS stacks used in the desktop and mobile environment 390 where management interfaces are used to provision identities and 391 keys. For the IoT environment, however, many devices are not 392 equipped with displays and input devices (e.g., keyboards). Hence, 393 keys are distributed as part of hardware modules or are embedded into 394 the firmware. As such, these restrictions are not applicable to this 395 profile. 397 Constrained Application Protocol (CoAP) [RFC7252] currently specifies 398 TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite 399 for use with shared secrets. This ciphersuite uses the AES algorithm 400 with 128 bit keys and CCM as the mode of operation. The label "_8" 401 indicates that an 8-octet authentication tag is used. This 402 ciphersuite makes use of the default TLS 1.2 Pseudorandom Function 403 (PRF), which uses HMAC with the SHA-256 hash function. 405 6. Raw Public Key Use with DTLS 407 The use of raw public keys with DTLS, as defined in [RFC7250], is the 408 first entry point into public key cryptography without having to pay 409 the price of certificates and a PKI. The specification re-uses the 410 existing Certificate message to convey the raw public key encoded in 411 the SubjectPublicKeyInfo structure. To indicate support two new TLS 412 extensions had been defined, as shown in Figure 3, namely the 413 server_certificate_type and the client_certificate_type. To operate 414 this mechanism securely it is necessary to authenticate and authorize 415 the public keys out-of-band. This document therefore assumes that a 416 client implementation comes with one or multiple raw public keys of 417 servers, it has to communicate with, pre-provisioned. Additionally, 418 a device will have its own raw public key. To replace, delete, or 419 add raw public key to this list requires a software update, for 420 example using a firmware update mechanism. 422 Client Server 423 ------ ------ 425 ClientHello --------> 426 client_certificate_type 427 server_certificate_type 429 <------- HelloVerifyRequest 431 ClientHello --------> 432 client_certificate_type 433 server_certificate_type 435 ServerHello 436 client_certificate_type 437 server_certificate_type 438 Certificate 439 ServerKeyExchange 440 CertificateRequest 441 <-------- ServerHelloDone 443 Certificate 444 ClientKeyExchange 445 CertificateVerify 446 [ChangeCipherSpec] 447 Finished --------> 449 [ChangeCipherSpec] 450 <-------- Finished 452 Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. 454 The CoAP recommended ciphersuite for use with this credential type is 455 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve 456 cryptography (ECC) based AES-CCM TLS ciphersuite uses the Elliptic 457 Curve Diffie Hellman (ECDHE) as the key establishment mechanism and 458 an Elliptic Curve Digital Signature Algorithm (ECDSA) for 459 authentication. This ciphersuite make use of the AEAD capability in 460 DTLS 1.2 and utilizes an eight-octet authentication tag. Based on 461 the Diffie-Hellman it provides perfect forward secrecy (PFS). More 462 details about the PFS can be found in Section 11. 464 RFC 6090 [RFC6090] provides valuable information for implementing 465 Elliptic Curve Cryptography algorithms. 467 Since many IoT devices will either have limited ways to log error or 468 no ability at all, any error will lead to implementations attempting 469 to re-try the exchange. 471 7. Certificate Use with DTLS 473 The use of mutual certificate-based authentication is shown in 474 Figure 4, which makes use of the cached info extension 475 [I-D.ietf-tls-cached-info]. Support of the cached info extension is 476 required. Caching certificate chains allows the client to reduce the 477 communication overhead significantly since otherwise the server would 478 provide the end entity certificate, and the certificate chain. 479 Because certificate validation requires that root keys be distributed 480 independently, the self-signed certificate that specifies the root 481 certificate authority is omitted from the chain. Client 482 implementations MUST be provisioned with a trust anchor store that 483 contains the root certificates. The use of the Trust Anchor 484 Management Protocol (TAMP) [RFC5934] is, however, not envisioned. 485 Instead IoT devices using this profile MUST rely a software update 486 mechanism to provision these trust anchors. 488 When DTLS is used to secure CoAP messages then the server provided 489 certificates MUST contain the fully qualified DNS domain name or 490 "FQDN". The coaps URI scheme is described in Section 6.2 of 491 [RFC7252]. This FQDN is stored in the SubjectAltName or in the CN, 492 as explained in Section 9.1.3.3 of [RFC7252], and used by the client 493 to match it against the FQDN used during the look-up process, as 494 described in RFC 6125 [RFC6125]. For the profile in this 495 specification does not assume dynamic discovery of local servers. 497 For client certificates the identifier used in the SubjectAltName or 498 in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 499 of [RFC7252]. 501 For certificate revocation neither the Online Certificate Status 502 Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. 503 Instead, this profile relies on a software update mechanism. While 504 multiple OCSP stapling [RFC6961] has recently been introduced as a 505 mechanism to piggyback OCSP request/responses inside the DTLS/TLS 506 handshake to avoid the cost of a separate protocol handshake further 507 investigations are needed to determine its suitability for the IoT 508 environment. 510 Client Server 511 ------ ------ 513 ClientHello --------> 514 cached_information 516 <------- HelloVerifyRequest 518 ClientHello --------> 519 cached_information 520 ServerHello 521 cached_information 522 Certificate 523 ServerKeyExchange 524 CertificateRequest 525 <-------- ServerHelloDone 527 Certificate 528 ClientKeyExchange 529 CertificateVerify 530 [ChangeCipherSpec] 531 Finished --------> 533 [ChangeCipherSpec] 534 <-------- Finished 536 Figure 4: DTLS Mutual Certificate-based Authentication. 538 Regarding the ciphersuite choice the discussion in Section 6 applies. 539 Further details about X.509 certificates can be found in 540 Section 9.1.3.3 of [RFC7252]. 542 QUESTION: What restrictions regarding the depth of the certificate 543 chain should be made? Is one level enough? 545 8. Error Handling 547 DTLS uses the Alert protocol to convey error messages and specifies a 548 longer list of errors. However, not all error messages defined in 549 the TLS specification are applicable to this profile. All error 550 messages marked as RESERVED are only supported for backwards 551 compatibility with SSL and are therefore not applicable to this 552 profile. Those include decryption_failed_RESERVED, 553 no_certificate_RESERVE, and export_restriction_RESERVED. 555 A number of the error messages are applicable only for certificate- 556 based authentication ciphersuites. Hence, for PSK and raw public key 557 use the following error messages are not applicable: 559 o bad_certificate, 561 o unsupported_certificate, 563 o certificate_revoked, 565 o certificate_expired, 567 o certificate_unknown, 569 o unknown_ca, and 571 o access_denied. 573 Since this profile does not make use of compression at the TLS layer 574 the decompression_failure error message is not applicable either. 576 RFC 4279 introduced a new alert message unknown_psk_identity for PSK 577 ciphersuites. As stated in Section 2 of RFC 4279 the 578 decryption_error error message may also be used instead. For this 579 profile the TLS server MUST return the decryption_error error message 580 instead of the unknown_psk_identity. 582 Furthermore, the following errors should not occur based on the 583 description in this specification: 585 protocol_version: This document only focuses on one version of the 586 DTLS protocol. 588 insufficient_security: This error message indicates that the server 589 requires ciphers to be more secure. This document does, however, 590 specify the only acceptable ciphersuites and client 591 implementations must support them. 593 user_canceled: The IoT devices in focus of this specification are 594 assumed to be unattended. 596 9. Session Resumption 598 Session resumption is a feature of DTLS that allows a client to 599 continue with an earlier established session state. The resulting 600 exchange is shown in Figure 5. In addition, the server may choose 601 not to do a cookie exchange when a session is resumed. Still, 602 clients have to be prepared to do a cookie exchange with every 603 handshake. 605 Client Server 606 ------ ------ 608 ClientHello --------> 609 ServerHello 610 [ChangeCipherSpec] 611 <-------- Finished 612 [ChangeCipherSpec] 613 Finished --------> 614 Application Data <-------> Application Data 616 Figure 5: DTLS Session Resumption. 618 Clients MUST implement session resumption to improve the performance 619 of the handshake (in terms of reduced number of message exchanges, 620 lower computational overhead, and less bandwidth conserved). 622 Since the communication model described in Section 3 does not assume 623 that the server is constrained. RFC 5077 [RFC5077] describing TLS 624 session resumption without server-side state is not utilized by this 625 profile. 627 10. TLS Compression 629 [I-D.ietf-uta-tls-bcp] recommends to always disable DTLS-level 630 compression due to attacks. For IoT applications compression at the 631 DTLS is not needed since application layer protocols are highly 632 optimized and the compression algorithms at the DTLS layer increase 633 code size and complexity. 635 This DTLS client profile does not include DTLS layer compression. 637 11. Perfect Forward Secrecy 639 Perfect forward secrecy (PFS) is designed to prevent the compromise 640 of a long-term secret key from affecting the confidentiality of past 641 conversations. The PSK ciphersuite recommended in the CoAP 642 specification [RFC7252] does not offer this property since it does 643 not utilize a Diffie-Hellman exchange. [I-D.ietf-uta-tls-bcp] on the 644 other hand recommends using ciphersuites offering this security 645 property and so do the public key-based ciphersuites recommended by 646 the CoAP specification. 648 The use of PFS is certainly a tradeoff decision since on one hand the 649 compromise of long-term secrets of embedded devices is more likely 650 than with many other Internet hosts but on the other hand a Diffie- 651 Hellman exchange requires emphemeral key pairs to be generated, which 652 can be demanding from a performance point of view. Finally, the 653 impact of the disclosure of past conversations and the desire to 654 increase the cost for pervasive monitoring (see [RFC7258]) has to be 655 taken into account. 657 Our recommendation is to stick with the ciphersuite suggested in the 658 CoAP specification. New ciphersuites support PFS for pre-shared 659 secret-based authentication, such as 660 [I-D.schmertmann-dice-ccm-psk-pfs], and might be available as a 661 standardized ciphersuite in the future. 663 12. Keep-Alive 665 RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the 666 other peer is still alive. The same mechanism can also be used to 667 perform Path Maximum Transmission Unit (MTU) Discovery. 669 A recommendation about the use of RFC 6520 depends on the type of 670 message exchange an IoT device performs. There are three types of 671 exchanges that need to be analysed: 673 Client-Initiated, One-Shot Messages 675 This is a common communication pattern where IoT devices upload 676 data to a server on the Internet on an irregular basis. The 677 communcation may be triggered by specific events, such as opening 678 a door. 680 Since the upload happens on an irregular and unpredicable basis 681 and due to renumbering and Network Address Translation (NAT) a new 682 DTLS session or DTLS session resumption can be used. 684 In this case there is no use for a keep-alive extension for this 685 scenario. 687 Client-Initiated, Regular Data Uploads 688 This is a variation of the previous case whereby data gets 689 uploaded on a regular basis, for example, based on frequent 690 temperature readings. With such regular exchange it can be 691 assumed that the DTLS context is still in kept at the IoT device. 692 If neither NAT bindings nor IP address changes occurred then the 693 DTLS record layer will not notice any changes. For the case where 694 IP and port changes happened it is necessary to re-create the DTLS 695 record layer using session resumption. 697 In this scenario there is no use for a keep-alive extension. It 698 is also very likely that the device will enter a sleep cycle in 699 between data transmissions to keep power consumption low. 701 Server-Initiated Messages 703 In the two previous scenarios the client initiated the protocol 704 interaction. In this case, we consider server-initiated messages. 705 Since messages to the client may get blocked by intermediaries, 706 such as NATs and stateful packet filtering firewalls, the initial 707 connection setup is triggered by the client and then kept alive. 708 Since state expires fairly quickly at middleboxes regular 709 heartbeats are necessary whereby these keep-alive messages may be 710 exchanged at the application layer or within DTLS itself. 712 For this message exchange pattern the use of DTLS heartbeat 713 messages is quite useful. The MTU discovery mechanism, on the 714 other hand, is less likely to be relevant since for many IoT 715 deployments the must constrained link is the wireless interface at 716 the IoT device itself rather than somewhere in the network. Only 717 in more complex network topologies the situation might be 718 different. 720 For server-initiated messages the heartbeat extension can be 721 recommended. 723 13. Random Number Generation 725 The DTLS protocol requires random numbers to be available during the 726 protocol run. For example, during the ClientHello and the 727 ServerHello exchange the client and the server exchange random 728 numbers. Also, the use of the Diffie Hellman exchange requires 729 random numbers during the key pair generation. Special care has to 730 be paid when generating random numbers in embedded systems as many 731 entropy sources available on desktop operating systems or mobile 732 devices might be missing, as described in [Heninger]. Consequently, 733 if not enough time is given during system start time to fill the 734 entropy pool then the output might be predictable and repeatable, for 735 example leading to the same keys generated again and again. 737 Recommendation: IoT devices using DTLS MUST offer ways to generate 738 quality random numbers. Guidelines and requirements for random 739 number generation can be found in RFC 4086 [RFC4086]. 741 It is important to note that sources contributing to the randomness 742 pool on laptops, or desktop pcs are not available on many IoT device, 743 such as mouse movement, timing of keystrokes, air turbulence on the 744 movement of hard drive heads, etc. Other sources have to be found or 745 dedicated hardware has to be added. 747 14. Client Certificate URLs 749 This RFC 6066 [RFC6066] extension allows to avoid sending client-side 750 certificates and URLs instead. This reduces the over-the-air 751 transmission. 753 This is certainly a useful extension when a certificate-based mode 754 for DTLS is used since the TLS cached info extension does not provide 755 any help with caching information on the server side. 757 Recommendation: Add support for client certificate URLs for those 758 environments where client-side certificates are used. 760 15. Trusted CA Indication 762 This RFC 6066 extension allows clients to indicate what trust anchor 763 they support. With certificate-based authentication a DTLS server 764 conveys its end entity certificate to the client during the DTLS 765 exchange provides. Since the server does not necessarily know what 766 trust anchors the client has stored it includes intermediate CA certs 767 in the certificate payload as well to facilitate with certification 768 path construction and path validation. 770 Today, in most IoT deployments there is a fairly static relationship 771 between the IoT device (and the software running on them) and the 772 server- side infrastructure and no such dynamic indication of trust 773 anchors is needed. 775 Recommendation: For IoT deployments where clients talk to a fixed, 776 pre-configured set of servers and where a software update mechanism 777 is available this extension is not recommended. Environments where 778 the client needs to interact with dynamically discovered DTLS servers 779 this extension may be useful to reduce the communication overhead. 780 Note, however, in that case the TLS cached info extension may help to 781 reduce the communication overhead for everything but the first 782 protocol interaction. 784 16. Truncated MAC Extension 786 This RFC 6066 extension was introduced to reduces the size of the MAC 787 used at the Record Layer. This extension was developed for TLS 788 ciphersuites that used older modes of operation where the MAC and the 789 encryption operation was performed independently. 791 For CoAP, however, the recommended ciphersuites use the newer 792 Authenticated Encryption with Associated Data (AEAD) construct, 793 namely the CBC-MAC mode (CCM) with eight-octet authentication tags. 795 Recommendation: Since this profile only supports AEAD ciphersuites 796 this extension is not applicable. 798 17. Server Name Indication (SNI) 800 This RFC 6066 extension defines a mechanism for a client to tell a 801 TLS server the name of the server it wants to contact. This is a 802 useful extension for many hosting environments where multiple virtual 803 servers are run on single IP address. 805 Recommendation: Unless it is known that a DTLS client does not 806 interact with a server in a hosting environment that requires such an 807 extension we advice to offer support for the SNI extension in this 808 profile. 810 18. Maximum Fragment Length Negotiation 812 This RFC 6066 extension lowers the maximum fragment length support 813 needed for the Record Layer from 2^14 bytes to 2^9 bytes. 815 This is a very useful extension that allows the client to indicate to 816 the server how much maximum memory buffers it uses for incoming 817 messages. Ultimately, the main benefit of this extension is it to 818 allows client implementations to lower their RAM requirements since 819 the client does not need to accept packets of large size (such as 16k 820 packets as required by plain TLS/DTLS). 822 Recommendation: Client implementations must support this extension. 824 19. Negotiation and Downgrading Attacks 826 CoAP demands version 1.2 of DTLS to be used and the earlier version 827 of DTLS is not supported. As such, there is no risk of downgrading 828 to an older version of DTLS. The work described in 829 [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to 830 this environment since there is no legacy server infrastructure to 831 worry about. 833 QUESTION: Should we say something for non-CoAP use of DTLS? 835 To prevent the TLS renegotiation attack [RFC5746] clients MUST 836 respond to server-initiated renegotiation attempts with an Alert 837 message (no_renegotiation) and clients MUST NOT initiate them. TLS 838 and DTLS allows a client and a server who already have a TLS 839 connection to negotiate new parameters, generate new keys, etc by 840 initiating a TLS handshake using a ClientHello message. 841 Renegotiation happens in the existing TLS connection, with the new 842 handshake packets being encrypted along with application data. 844 20. Privacy Considerations 846 The DTLS handshake exchange conveys various identifiers, which can be 847 observed by an on-path eavesdropper. For example, the DTLS PSK 848 exchange reveals the PSK identity, the supported extensions, the 849 session id, algorithm parameters, etc. When session resumption is 850 used then individual TLS sessions can be correlated by an on-path 851 adversary. With many IoT deployments it is likely that keying 852 material and their identifiers are persistent over a longer period of 853 time due to the cost of updating software on these devices. 855 User participation with many IoT deployments poses a challenge since 856 many of the IoT devices operate unattended, even though they will 857 initially be enabled by a human. The ability to control data sharing 858 and to configure preference will have to be provided at a system 859 level rather than at the level of a DTLS profile, which is the scope 860 of this document. Quite naturally, the use of DTLS with mutual 861 authentication will allow a TLS server to collect authentication 862 information about the IoT device (potentially over a long period of 863 time). While this strong form of authentication will prevent mis- 864 attribution it also allows strong identification. This device- 865 related data collection (e.g., sensor recordings) will be associated 866 with other data to be truly useful and this extra data might include 867 personal data about the owner of the device or data about the 868 environment it senses. Consequently, the data stored on the server- 869 side will be vulnerable to stored data compromise. For the 870 communication between the client and the server this specification 871 prevents eavesdroppers to gain access to the communication content. 872 While the PSK-based ciphersuite does not provide PFS the asymmetric 873 version does. No explicit techniques, such as extra padding, have 874 been provided to make traffic analysis more difficult. 876 21. Security Considerations 878 This entire document is about security. 880 We would also like to point out that designing a software update 881 mechanism into an IoT system is crucial to ensure that both 882 functionality can be enhanced and that potential vulnerabilities can 883 be fixed. This software update mechanism is also useful for changing 884 configuration information, for example, trust anchors and other 885 keying related information. 887 22. IANA Considerations 889 This document includes no request to IANA. 891 23. Acknowledgements 893 Thanks to Rene Hummen, Sye Loong Keoh, Sandeep Kumar, Eric Rescorla, 894 Russ Housley, Michael Richardson, Zach Shelby, and Sean Turner for 895 their helpful comments and discussions that have shaped the document. 897 Big thanks also to Klaus Hartke, who wrote the initial version of 898 this document. 900 24. References 902 24.1. Normative References 904 [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) 905 REGISTRATION AUTHORITY", April 2010, 906 . 909 [I-D.ietf-tls-cached-info] 910 Santesson, S. and H. Tschofenig, "Transport Layer Security 911 (TLS) Cached Information Extension", draft-ietf-tls- 912 cached-info-16 (work in progress), February 2014. 914 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 915 Requirement Levels", BCP 14, RFC 2119, March 1997. 917 [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites 918 for Transport Layer Security (TLS)", RFC 4279, December 919 2005. 921 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 922 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 924 [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, 925 "Transport Layer Security (TLS) Renegotiation Indication 926 Extension", RFC 5746, February 2010. 928 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions: 929 Extension Definitions", RFC 6066, January 2011. 931 [RFC6125] Saint-Andre, P. and J. Hodges, "Representation and 932 Verification of Domain-Based Application Service Identity 933 within Internet Public Key Infrastructure Using X.509 934 (PKIX) Certificates in the Context of Transport Layer 935 Security (TLS)", RFC 6125, March 2011. 937 [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer 938 Security Version 1.2", RFC 6347, January 2012. 940 [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport 941 Layer Security (TLS) and Datagram Transport Layer Security 942 (DTLS) Heartbeat Extension", RFC 6520, February 2012. 944 [RFC7250] Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and 945 T. Kivinen, "Using Raw Public Keys in Transport Layer 946 Security (TLS) and Datagram Transport Layer Security 947 (DTLS)", RFC 7250, June 2014. 949 [RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- 950 CCM Elliptic Curve Cryptography (ECC) Cipher Suites for 951 TLS", RFC 7251, June 2014. 953 24.2. Informative References 955 [Heninger] 956 Heninger, N., Durumeric, Z., Wustrow, E., and A. 957 Halderman, "Mining Your Ps and Qs: Detection of Widespread 958 Weak Keys in Network Devices", 21st USENIX Security 959 Symposium, 960 https://www.usenix.org/conference/usenixsecurity12/ 961 technical-sessions/presentation/heninger, 2012. 963 [I-D.bmoeller-tls-downgrade-scsv] 964 Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher 965 Suite Value (SCSV) for Preventing Protocol Downgrade 966 Attacks", draft-bmoeller-tls-downgrade-scsv-02 (work in 967 progress), May 2014. 969 [I-D.cooper-ietf-privacy-requirements] 970 Cooper, A., Farrell, S., and S. Turner, "Privacy 971 Requirements for IETF Protocols", draft-cooper-ietf- 972 privacy-requirements-01 (work in progress), October 2013. 974 [I-D.ietf-lwig-tls-minimal] 975 Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's 976 Guide to the (Datagram) Transport Layer Security Protocol 977 for Smart Objects and Constrained Node Networks", draft- 978 ietf-lwig-tls-minimal-01 (work in progress), March 2014. 980 [I-D.ietf-uta-tls-bcp] 981 Sheffer, Y., Holz, R., and P. Saint-Andre, 982 "Recommendations for Secure Use of TLS and DTLS", draft- 983 ietf-uta-tls-bcp-01 (work in progress), June 2014. 985 [I-D.schmertmann-dice-ccm-psk-pfs] 986 Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher 987 Suites with Forward Secrecy for Transport Layer Security 988 (TLS)", draft-schmertmann-dice-ccm-psk-pfs-00 (work in 989 progress), February 2014. 991 [IANA-TLS] 992 IANA, "TLS Cipher Suite Registry", 993 http://www.iana.org/assignments/tls-parameters/ 994 tls-parameters.xhtml#tls-parameters-4, 2014. 996 [RFC3552] Rescorla, E. and B. Korver, "Guidelines for Writing RFC 997 Text on Security Considerations", BCP 72, RFC 3552, July 998 2003. 1000 [RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness 1001 Requirements for Security", BCP 106, RFC 4086, June 2005. 1003 [RFC4492] Blake-Wilson, S., Bolyard, N., Gupta, V., Hawk, C., and B. 1004 Moeller, "Elliptic Curve Cryptography (ECC) Cipher Suites 1005 for Transport Layer Security (TLS)", RFC 4492, May 2006. 1007 [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, 1008 "Transport Layer Security (TLS) Session Resumption without 1009 Server-Side State", RFC 5077, January 2008. 1011 [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated 1012 Encryption", RFC 5116, January 2008. 1014 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., 1015 Housley, R., and W. Polk, "Internet X.509 Public Key 1016 Infrastructure Certificate and Certificate Revocation List 1017 (CRL) Profile", RFC 5280, May 2008. 1019 [RFC5289] Rescorla, E., "TLS Elliptic Curve Cipher Suites with SHA- 1020 256/384 and AES Galois Counter Mode (GCM)", RFC 5289, 1021 August 2008. 1023 [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor 1024 Management Protocol (TAMP)", RFC 5934, August 2010. 1026 [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic 1027 Curve Cryptography Algorithms", RFC 6090, February 2011. 1029 [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for 1030 Transport Layer Security (TLS)", RFC 6655, July 2012. 1032 [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) 1033 Multiple Certificate Status Request Extension", RFC 6961, 1034 June 2013. 1036 [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J., 1037 Morris, J., Hansen, M., and R. Smith, "Privacy 1038 Considerations for Internet Protocols", RFC 6973, July 1039 2013. 1041 [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained 1042 Application Protocol (CoAP)", RFC 7252, June 2014. 1044 [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an 1045 Attack", BCP 188, RFC 7258, May 2014. 1047 Author's Address 1049 Hannes Tschofenig (editor) 1050 ARM Ltd. 1051 110 Fulbourn Rd 1052 Cambridge CB1 9NJ 1053 Great Britain 1055 Email: Hannes.tschofenig@gmx.net 1056 URI: http://www.tschofenig.priv.at