idnits 2.17.00 (12 Aug 2021) /tmp/idnits47154/draft-ietf-dice-profile-05.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year == The document seems to lack the recommended RFC 2119 boilerplate, even if it appears to use RFC 2119 keywords -- however, there's a paragraph with a matching beginning. Boilerplate error? (The document does seem to have the reference to RFC 2119 which the ID-Checklist requires). -- The document date (October 26, 2014) is 2763 days in the past. Is this intentional? Checking references for intended status: Proposed Standard ---------------------------------------------------------------------------- (See RFCs 3967 and 4897 for information about using normative references to lower-maturity documents in RFCs) == Missing Reference: 'ChangeCipherSpec' is mentioned on line 657, but not defined -- Possible downref: Non-RFC (?) normative reference: ref. 'EUI64' == Outdated reference: draft-ietf-tls-cached-info has been published as RFC 7924 == Outdated reference: draft-ietf-tls-session-hash has been published as RFC 7627 ** Obsolete normative reference: RFC 5246 (Obsoleted by RFC 8446) ** Obsolete normative reference: RFC 6347 (Obsoleted by RFC 9147) ** Downref: Normative reference to an Informational RFC: RFC 7251 == Outdated reference: draft-ietf-uta-tls-bcp has been published as RFC 7525 -- Obsolete informational reference (is this intentional?): RFC 5077 (Obsoleted by RFC 8446) -- Obsolete informational reference (is this intentional?): RFC 6961 (Obsoleted by RFC 8446) Summary: 3 errors (**), 0 flaws (~~), 6 warnings (==), 4 comments (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 dice H. Tschofenig, Ed. 3 Internet-Draft ARM Ltd. 4 Intended status: Standards Track October 26, 2014 5 Expires: April 29, 2015 7 A Datagram Transport Layer Security (DTLS) 1.2 Profile for the Internet 8 of Things 9 draft-ietf-dice-profile-05.txt 11 Abstract 13 This document defines a DTLS 1.2 profile that is suitable for 14 Internet of Things applications and is reasonably implementable on 15 many constrained devices. 17 A common design pattern in IoT deployments is the use of a 18 constrained device (typically providing sensor data) that interacts 19 with the web infrastructure. This document focuses on this 20 particular pattern. 22 Status of This Memo 24 This Internet-Draft is submitted in full conformance with the 25 provisions of BCP 78 and BCP 79. 27 Internet-Drafts are working documents of the Internet Engineering 28 Task Force (IETF). Note that other groups may also distribute 29 working documents as Internet-Drafts. The list of current Internet- 30 Drafts is at http://datatracker.ietf.org/drafts/current/. 32 Internet-Drafts are draft documents valid for a maximum of six months 33 and may be updated, replaced, or obsoleted by other documents at any 34 time. It is inappropriate to use Internet-Drafts as reference 35 material or to cite them other than as "work in progress." 37 This Internet-Draft will expire on April 29, 2015. 39 Copyright Notice 41 Copyright (c) 2014 IETF Trust and the persons identified as the 42 document authors. All rights reserved. 44 This document is subject to BCP 78 and the IETF Trust's Legal 45 Provisions Relating to IETF Documents 46 (http://trustee.ietf.org/license-info) in effect on the date of 47 publication of this document. Please review these documents 48 carefully, as they describe your rights and restrictions with respect 49 to this document. Code Components extracted from this document must 50 include Simplified BSD License text as described in Section 4.e of 51 the Trust Legal Provisions and are provided without warranty as 52 described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 57 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 58 3. The Communication Model . . . . . . . . . . . . . . . . . . . 5 59 4. The Ciphersuite Concept . . . . . . . . . . . . . . . . . . . 6 60 5. Credential Types . . . . . . . . . . . . . . . . . . . . . . 8 61 5.1. Pre-Shared Secret . . . . . . . . . . . . . . . . . . . . 8 62 5.2. Raw Public Key . . . . . . . . . . . . . . . . . . . . . 10 63 5.3. Certificates . . . . . . . . . . . . . . . . . . . . . . 12 64 6. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 14 65 7. Session Resumption . . . . . . . . . . . . . . . . . . . . . 15 66 8. Compression . . . . . . . . . . . . . . . . . . . . . . . . . 15 67 9. Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . . 16 68 10. Keep-Alive . . . . . . . . . . . . . . . . . . . . . . . . . 16 69 11. Random Number Generation . . . . . . . . . . . . . . . . . . 17 70 12. Client Certificate URLs . . . . . . . . . . . . . . . . . . . 18 71 13. Trusted CA Indication . . . . . . . . . . . . . . . . . . . . 18 72 14. Truncated MAC Extension . . . . . . . . . . . . . . . . . . . 19 73 15. Server Name Indication (SNI) . . . . . . . . . . . . . . . . 19 74 16. Maximum Fragment Length Negotiation . . . . . . . . . . . . . 20 75 17. TLS Session Hash . . . . . . . . . . . . . . . . . . . . . . 20 76 18. Negotiation and Downgrading Attacks . . . . . . . . . . . . . 20 77 19. Privacy Considerations . . . . . . . . . . . . . . . . . . . 21 78 20. Security Considerations . . . . . . . . . . . . . . . . . . . 21 79 21. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 22 80 22. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 22 81 23. References . . . . . . . . . . . . . . . . . . . . . . . . . 22 82 23.1. Normative References . . . . . . . . . . . . . . . . . . 22 83 23.2. Informative References . . . . . . . . . . . . . . . . . 23 84 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 25 86 1. Introduction 88 This document defines a DTLS 1.2 [RFC6347] profile that offers 89 communication security for Internet of Things (IoT) applications and 90 is reasonably implementable on many constrained devices. The DTLS 91 1.2 protocol is based on Transport Layer Security (TLS) 1.2 [RFC5246] 92 and provides equivalent security guarantees. This document aims to 93 meet the following goals: 95 o Serves as a one-stop shop for implementers to know which pieces of 96 the specification jungle contain relevant details. 98 o Does not alter the TLS/DTLS specifications. 100 o Does not introduce any new extensions. 102 o Aligns with the DTLS security modes of the Constrained Application 103 Protocol (CoAP) [RFC7252]. 105 DTLS is used to secure a number of applications run over an 106 unreliable datagram transport. CoAP [RFC7252] is one such protocol 107 and has been designed specifically for use in IoT environments. CoAP 108 can be secured a number of different ways, also called security 109 modes. These security modes are as follows, see Section 5.1, 110 Section 5.2, Section 5.3 for additional details: 112 No Security Protection at the Transport Layer: No DTLS is used but 113 instead application layer security functionality is assumed. 115 Shared Secret-based DTLS Authentication: DTLS supports the use of 116 shared secrets [RFC4279]. This mode is useful if the number of 117 communication relationships between the IoT device and servers is 118 small and for very constrained devices. Shared secret-based 119 authentication mechanisms offer good performance and require a 120 minimum of data to be exchanged. 122 DTLS Authentication using Asymmetric Cryptography: TLS supports 123 client and server authentication using asymmetric cryptography. 124 Two approaches for validating these public keys are available. 125 First, [RFC7250] allows raw public keys to be used in TLS without 126 the overhead of certificates. This approach requires out-of-band 127 validation of the public key. Second, the use of X.509 128 certificates [RFC5280] with TLS is common on the Web today (at 129 least for server-side authentication) and certain IoT environments 130 may also re-use those capabilities. Certificates bind an 131 identifier to the public key signed by a certification authority 132 (CA). A trust anchor store has to be provisioned on the device to 133 indicate what CAs are trusted. Furthermore, the certificate may 134 contain a wealth of other information used to make authorization 135 decisions. 137 As described in [I-D.ietf-lwig-tls-minimal], an application designer 138 developing an IoT device needs to consider the security threats and 139 the security services that can be used to mitigate the threats. 140 Enabling devices to upload data and retrieve configuration 141 information, inevitably requires that Internet-connected devices be 142 able to authenticate themselves to servers and vice versa as well as 143 to ensure that the data and information exchanged is integrity and 144 confidentiality protected. While these security services can be 145 provided at different layers in the protocol stack the use of 146 communication security, as offered by DTLS, has been very popular on 147 the Internet and it is likely to be useful for IoT scenarios as well. 148 In case the communication security features offered by DTLS meet the 149 security requirements of your application the remainder of the 150 document might offer useful guidance. 152 Not every IoT deployment will use CoAP but the discussion regarding 153 choice of credentials and cryptographic algorithms will be very 154 similar. As such, the discussions in this document are applicable 155 beyond the use of the CoAP protocol. 157 The design of DTLS is intentionally very similar to TLS. Since DTLS 158 operates on top of an unreliable datagram transport a few 159 enhancements to the TLS structure are, however necessary. RFC 6347 160 explains these differences in great detail. As a short summary, for 161 those not familiar with DTLS the differences are: 163 o An explicit sequence number and an epoch field is included in the 164 TLS Record Layer. Section 4.1 of RFC 6347 explains the processing 165 rules for these two new fields. The value used to compute the MAC 166 is the 64-bit value formed by concatenating the epoch and the 167 sequence number. 169 o Stream ciphers must not be used with DTLS. The only stream cipher 170 defined for TLS 1.2 is RC4 and due to cryptographic weaknesses it 171 is not recommended anymore even for use with TLS. 173 o The TLS Handshake Protocol has been enhanced to include a 174 stateless cookie exchange for Denial of Service (DoS) resistance. 175 Furthermore, the header has been extended to deal with message 176 loss, reordering, and fragmentation. Retransmission timers have 177 been included to deal with message loss. For DoS protection a new 178 handshake message, the HelloVerifyRequest, was added to DTLS. 179 This handshake message is sent by the server and includes a 180 stateless cookie, which is returned in a ClientHello message back 181 to the server. This type of DoS protection mechanism has also 182 been incorporated into the design of IKEv2. Although the exchange 183 is optional for the server to execute, a client implementation has 184 to be prepared to respond to it. 186 2. Terminology 188 The key words "MUST", "MUST NOT", "REQUIRED", "MUST", "MUST NOT", 189 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 190 document are to be interpreted as described in [RFC2119]. 192 Note that "Client" and "Server" in this document refer to TLS roles, 193 where the Client initiates the TLS handshake. This does not restrict 194 the interaction pattern of the protocols carried inside TLS as the 195 record layer allows bi-directional communication. In the case of 196 CoAP the "Client" can act as a CoAP Server or Client. 198 RFC 7228 [RFC7228] introduces the notion of constrained-node 199 networks, which are small devices with severe constraints on power, 200 memory, and processing resources. The terms constrained devices, and 201 Internet of Things (IoT) devices are used interchangeably. 203 3. The Communication Model 205 This document describes a profile of DTLS 1.2 and, to be useful, it 206 has to make assumptions about the envisioned communication 207 architecture. 209 The communication architecture shown in Figure 1 assumes a unicast 210 communication interaction with an IoT device utilizing a DTLS client 211 and that client interacts with one or multiple DTLS servers. 213 Clients are provisioned with information about the servers they need 214 to initiate their DTLS exchange with and with credentials. This 215 information may be conveyed to clients as part of a firmware/software 216 package or via a configuration protocol. The following credential 217 types are supported by this profile: 219 o For PSK-based authentication (see Section 5.1), this includes the 220 paired "PSK identity" and shared secret to be used with each 221 server. 223 o For raw public key-based authentication (see Section 5.2), this 224 includes either the server's public key or the hash of the 225 server's public key. 227 o For certificate-based authentication (see Section 5.3), this 228 includes a pre-populated trust anchor store that allows the DTLS 229 stack to perform path validation for the certificate obtained 230 during the handshake with the server. 232 This document focuses on the description of the DTLS client-side 233 functionality but, quite naturally, the equivalent server-side 234 support has to be available. 236 +////////////////////////////////////+ 237 | Configuration | 238 |////////////////////////////////////| 239 | Server A --> PSK Identity, PSK | 240 | Server B --> Public Key (Server B),| 241 | Public Key (Client) | 242 | Server C --> Public Key (Client), | 243 | Trust Anchor Store | 244 +------------------------------------+ 245 oo 246 oooooo 247 o 248 +------+ 249 |Client|--- 250 +------+ \ 251 \ ,-------. 252 ,' `. +------+ 253 / IP-based \ |Server| 254 ( Network ) | A | 255 \ / +------+ 256 `. ,' 257 '---+---' +------+ 258 | |Server| 259 | | B | 260 | +------+ 261 | 262 | +------+ 263 +----------------->|Server| 264 | C | 265 +------+ 267 Figure 1: Constrained DTLS Client Profile. 269 4. The Ciphersuite Concept 271 TLS (and consequently DTLS) has the concept of ciphersuites and an 272 IANA registry [IANA-TLS] was created to register the suites. A 273 ciphersuite (and the specification that defines it) contains the 274 following information: 276 o Authentication and Key Exchange Algorithm (e.g., PSK) 278 o Cipher and Key Length (e.g., AES with 128 bit keys) 280 o Mode of operation (e.g., CBC) 281 o Hash Algorithm for Integrity Protection (e.g., SHA in combination 282 with HMAC) 284 o Hash Algorithm for use with the Pseudorandom Function (e.g. HMAC 285 with the SHA-256) 287 o Misc information (e.g., length of authentication tags) 289 o Information whether the ciphersuite is suitable for DTLS or only 290 for TLS 292 The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a 293 pre-shared authentication and key exchange algorithm. RFC 6655 294 [RFC6655] defines this ciphersuite. It uses the Advanced Encryption 295 Standard (AES) encryption algorithm, which is a block cipher. Since 296 the AES algorithm supports different key lengths (such as 128, 192 297 and 256 bits) this information has to be specified as well and the 298 selected ciphersuite supports 128 bit keys. A block cipher encrypts 299 plaintext in fixed-size blocks and AES operates on fixed block size 300 of 128 bits. For messages exceeding 128 bits, the message is 301 partitioned into 128-bit blocks and the AES cipher is applied to 302 these input blocks with appropriate chaining, which is called mode of 303 operation. 305 TLS 1.2 introduced Authenticated Encryption with Associated Data 306 (AEAD) ciphersuites [RFC5116]. AEAD is a class of block cipher modes 307 which encrypt (parts of) the message and authenticate the message 308 simultaneously. Examples of such modes include the Counter with CBC- 309 MAC (CCM) mode, and the Galois/Counter Mode (GCM). 311 Some AEAD ciphersuites have shorter authentication tags and are 312 therefore more suitable for networks with low bandwidth where small 313 message size matters. The TLS_PSK_WITH_AES_128_CCM_8 ciphersuite 314 that ends in "_8" has an 8-octet authentication tag, while the 315 regular CCM ciphersuites have 16-octet authentication tags. 317 TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in 318 the TLS pseudo random function (PRF) with cipher-suite-specified 319 PRFs. For this reason authors of more recent TLS 1.2 ciphersuite 320 specifications explicitly indicate the MAC algorithm and the hash 321 functions used with the TLS PRF. 323 This document references the CoAP recommended ciphersuite choices, 324 which have been selected based on implementation and deployment 325 experience from the IoT community. Over time the preference for 326 certain algorithms will, however, change. Not all components of a 327 ciphersuite change at the same speed. Changes are more likely to 328 expect for ciphers, the mode of operation, and the hash algorithms. 330 Some deployment environments will also be impacted by local 331 regulation, which might dictate a certain and less likely for public 332 key algorithms (such as RSA vs. ECC). 334 5. Credential Types 336 5.1. Pre-Shared Secret 338 The use of pre-shared secret credentials is one of the most basic 339 techniques for DTLS since it is both computational efficient and 340 bandwidth conserving. Pre-shared secret based authentication was 341 introduced to TLS with RFC 4279 [RFC4279]. The exchange shown in 342 Figure 2 illustrates the DTLS exchange including the cookie exchange. 343 While the server is not required to initiate a cookie exchange with 344 every handshake, the client is required to implement and to react on 345 it when challenged. The cookie exchange allows the server to react 346 to flooding attacks. 348 Client Server 349 ------ ------ 350 ClientHello --------> 352 <-------- HelloVerifyRequest 353 (contains cookie) 355 ClientHello --------> 356 (with cookie) 357 ServerHello 358 *ServerKeyExchange 359 <-------- ServerHelloDone 360 ClientKeyExchange 361 ChangeCipherSpec 362 Finished --------> 363 ChangeCipherSpec 364 <-------- Finished 366 Application Data <-------> Application Data 368 Legend: 370 * indicates an optional message payload 372 Figure 2: DTLS PSK Authentication including the Cookie Exchange. 374 [RFC4279] does not mandate the use of any particular type of 375 identity. Hence, the TLS client and server clearly have to agree on 376 the identities and keys to be used. The mandated encoding of 377 identities in Section 5.1 of RFC 4279 aims to improve 378 interoperability for those cases where the identity is configured by 379 a person using some management interface. Many IoT devices do, 380 however, not have a user interface and most of their credentials are 381 bound to the device rather than the user. Furthermore, credentials 382 are provisioned into trusted hardware modules or in the firmware by 383 the developers. As such, the encoding considerations are not 384 applicable to this usage environment. For use with this profile the 385 PSK identities SHOULD NOT assume a structured format (as domain 386 names, Distinguished Names, or IP addresses have) and a bit-by-bit 387 comparison operation can then be used by the server-side 388 infrastructure. 390 The client indicates which key it uses by including a "PSK identity" 391 in the ClientKeyExchange message. As described in Section 3 clients 392 may have multiple pre-shared keys with a single server and to help 393 the client in selecting which PSK identity / PSK pair to use, the 394 server can provide a "PSK identity hint" in the ServerKeyExchange 395 message. If the hint for PSK key selection is based on the domain 396 name of the server then servers SHOULD NOT send the "PSK identity 397 hint" in the ServerKeyExchange message. Hence, servers SHOULD NOT 398 send the "PSK identity hint" in the ServerKeyExchange message and 399 client MUST ignore the message. This approach is inline with RFC 400 4279 [RFC4279]. Note: The TLS Server Name Indication (SNI) extension 401 allows the client to tell a server the name of the server it is 402 contacting, which is relevant for hosting environments. A server 403 using the identity hint needs to guide the selection based on a 404 received SNI value from the client. 406 RFC 4279 requires TLS implementations supporting PSK ciphersuites to 407 support arbitrary PSK identities up to 128 octets in length, and 408 arbitrary PSKs up to 64 octets in length. This is a useful 409 assumption for TLS stacks used in the desktop and mobile environment 410 where management interfaces are used to provision identities and 411 keys. For the IoT environment, however, many devices are not 412 equipped with displays and input devices (e.g., keyboards). Hence, 413 keys are distributed as part of hardware modules or are embedded into 414 the firmware. As such, these restrictions are not applicable to this 415 profile. 417 Constrained Application Protocol (CoAP) [RFC7252] currently specifies 418 TLS_PSK_WITH_AES_128_CCM_8 as the mandatory to implement ciphersuite 419 for use with shared secrets. This ciphersuite uses the AES algorithm 420 with 128 bit keys and CCM as the mode of operation. The label "_8" 421 indicates that an 8-octet authentication tag is used. This 422 ciphersuite makes use of the default TLS 1.2 Pseudorandom Function 423 (PRF), which uses an HMAC with the SHA-256 hash function. (Note that 424 all IoT implementations will need a SHA-256 implementation due to the 425 construction of the pseudo-random number function in TLS 1.2.) 427 A device compliant with this protocol MUST implement 428 TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section. 430 5.2. Raw Public Key 432 The use of raw public keys with DTLS, as defined in [RFC7250], is the 433 first entry point into public key cryptography without having to pay 434 the price of certificates and a PKI. The specification re-uses the 435 existing Certificate message to convey the raw public key encoded in 436 the SubjectPublicKeyInfo structure. To indicate support two new TLS 437 extensions had been defined, as shown in Figure 3, namely the 438 server_certificate_type and the client_certificate_type. To operate 439 this mechanism securely it is necessary to authenticate and authorize 440 the public keys out-of-band. This document therefore assumes that a 441 client implementation comes with one or multiple raw public keys of 442 servers, it has to communicate with, pre-provisioned. Additionally, 443 a device will have its own raw public key. To replace, delete, or 444 add raw public key to this list requires a software update, for 445 example using a firmware update mechanism. 447 Client Server 448 ------ ------ 450 ClientHello --------> 451 client_certificate_type 452 server_certificate_type 454 <------- HelloVerifyRequest 456 ClientHello --------> 457 client_certificate_type 458 server_certificate_type 460 ServerHello 461 client_certificate_type 462 server_certificate_type 463 Certificate 464 ServerKeyExchange 465 CertificateRequest 466 <-------- ServerHelloDone 468 Certificate 469 ClientKeyExchange 470 CertificateVerify 471 [ChangeCipherSpec] 472 Finished --------> 474 [ChangeCipherSpec] 475 <-------- Finished 477 Figure 3: DTLS Raw Public Key Exchange including the Cookie Exchange. 479 The CoAP recommended ciphersuite for use with this credential type is 480 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 [RFC7251]. This elliptic curve 481 cryptography (ECC) based AES-CCM TLS ciphersuite uses the Ephemeral 482 Elliptic Curve Diffie-Hellman (ECDHE) as the key establishment 483 mechanism and an Elliptic Curve Digital Signature Algorithm (ECDSA) 484 for authentication. Due to the use of Ephemeral Elliptic Curve 485 Diffie-Hellman (ECDHE) the recently introduced named Diffie-Hellman 486 groups [I-D.ietf-tls-negotiated-dl-dhe] are not applicable to this 487 profile. This ciphersuite make use of the AEAD capability in DTLS 488 1.2 and utilizes an eight-octet authentication tag. The use of a 489 Diffie-Hellman key exchange adds perfect forward secrecy (PFS). More 490 details about PFS can be found in Section 9. 492 RFC 6090 [RFC6090] provides valuable information for implementing 493 Elliptic Curve Cryptography algorithms, particularly for choosing 494 methods that have been published more than 20 years ago. 496 Since many IoT devices will either have limited ways to log error or 497 no ability at all, any error will lead to implementations attempting 498 to re-try the exchange. Implementers have to carefully evaluate the 499 impact of errors and ways to remedy the situation since a commonly 500 used approach for delegating decision making to users is difficult in 501 a timely fashion (or impossible). 503 A device compliant with this protocol MUST implement 504 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this 505 section. 507 5.3. Certificates 509 The use of mutual certificate-based authentication is shown in 510 Figure 4, which makes use of the cached info extension 511 [I-D.ietf-tls-cached-info]. Support of the cached info extension is 512 required. Caching certificate chains allows the client to reduce the 513 communication overhead significantly since otherwise the server would 514 provide the end entity certificate, and the certificate chain. 515 Because certificate validation requires that root keys be distributed 516 independently, the self-signed certificate that specifies the root 517 certificate authority is omitted from the chain. Client 518 implementations MUST be provisioned with a trust anchor store that 519 contains the root certificates. The use of the Trust Anchor 520 Management Protocol (TAMP) [RFC5934] is, however, not envisioned. 521 Instead IoT devices using this profile MUST rely a software update 522 mechanism to provision these trust anchors. 524 When DTLS is used to secure CoAP messages then the server provided 525 certificates MUST contain the fully qualified DNS domain name or 526 "FQDN". The coaps URI scheme is described in Section 6.2 of 527 [RFC7252]. This FQDN is stored in the SubjectAltName or in the CN, 528 as explained in Section 9.1.3.3 of [RFC7252], and used by the client 529 to match it against the FQDN used during the look-up process, as 530 described in RFC 6125 [RFC6125]. For the profile in this 531 specification does not assume dynamic discovery of local servers. 533 For client certificates the identifier used in the SubjectAltName or 534 in the CN MUST be an EUI-64 [EUI64], as mandated in Section 9.1.3.3 535 of [RFC7252]. 537 For certificate revocation neither the Online Certificate Status 538 Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used. 539 Instead, this profile relies on a software update mechanism. While 540 multiple OCSP stapling [RFC6961] has recently been introduced as a 541 mechanism to piggyback OCSP request/responses inside the DTLS/TLS 542 handshake to avoid the cost of a separate protocol handshake further 543 investigations are needed to determine its suitability for the IoT 544 environment. 546 Client Server 547 ------ ------ 549 ClientHello --------> 550 cached_information 552 <------- HelloVerifyRequest 554 ClientHello --------> 555 cached_information 556 ServerHello 557 cached_information 558 Certificate 559 ServerKeyExchange 560 CertificateRequest 561 <-------- ServerHelloDone 563 Certificate 564 ClientKeyExchange 565 CertificateVerify 566 [ChangeCipherSpec] 567 Finished --------> 569 [ChangeCipherSpec] 570 <-------- Finished 572 Figure 4: DTLS Mutual Certificate-based Authentication. 574 Regarding the ciphersuite choice the discussion in Section 5.2 575 applies. Further details about X.509 certificates can be found in 576 Section 9.1.3.3 of [RFC7252]. The TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 577 ciphersuite description in Section 5.2 is also applicable to this 578 section. 580 IoT devices MUST provide support for a server certificate chain of at 581 least 3 not including the trust anchor and MAY reject connections 582 from servers offering chains longer than 3. IoT devices MAY have 583 client certificate chains of any length. Obviously, longer chains 584 require more resources to process, transmit or receive. 586 A device compliant with this protocol MUST implement 587 TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this 588 section. 590 6. Error Handling 592 DTLS uses the Alert protocol to convey error messages and specifies a 593 longer list of errors. However, not all error messages defined in 594 the TLS specification are applicable to this profile. All error 595 messages marked as RESERVED are only supported for backwards 596 compatibility with SSL and are therefore not applicable to this 597 profile. Those include decryption_failed_RESERVED, 598 no_certificate_RESERVE, and export_restriction_RESERVED. 600 A number of the error messages are applicable only for certificate- 601 based authentication ciphersuites. Hence, for PSK and raw public key 602 use the following error messages are not applicable: 604 o bad_certificate, 606 o unsupported_certificate, 608 o certificate_revoked, 610 o certificate_expired, 612 o certificate_unknown, 614 o unknown_ca, and 616 o access_denied. 618 Since this profile does not make use of compression at the TLS layer 619 the decompression_failure error message is not applicable either. 621 RFC 4279 introduced a new alert message unknown_psk_identity for PSK 622 ciphersuites. As stated in Section 2 of RFC 4279 the 623 decryption_error error message may also be used instead. For this 624 profile the TLS server MUST return the decryption_error error message 625 instead of the unknown_psk_identity. 627 Furthermore, the following errors should not occur based on the 628 description in this specification: 630 protocol_version: This document only focuses on one version of the 631 DTLS protocol. 633 insufficient_security: This error message indicates that the server 634 requires ciphers to be more secure. This document does, however, 635 specify the only acceptable ciphersuites and client 636 implementations must support them. 638 user_canceled: The IoT devices in focus of this specification are 639 assumed to be unattended. 641 7. Session Resumption 643 Session resumption is a feature of DTLS that allows a client to 644 continue with an earlier established session state. The resulting 645 exchange is shown in Figure 5. In addition, the server may choose 646 not to do a cookie exchange when a session is resumed. Still, 647 clients have to be prepared to do a cookie exchange with every 648 handshake. 650 Client Server 651 ------ ------ 653 ClientHello --------> 654 ServerHello 655 [ChangeCipherSpec] 656 <-------- Finished 657 [ChangeCipherSpec] 658 Finished --------> 659 Application Data <-------> Application Data 661 Figure 5: DTLS Session Resumption. 663 Clients MUST implement session resumption to improve the performance 664 of the handshake (in terms of reduced number of message exchanges, 665 lower computational overhead, and less bandwidth conserved). 667 Since the communication model described in Section 3 does not assume 668 that the server is constrained. RFC 5077 [RFC5077] describing TLS 669 session resumption without server-side state is not utilized by this 670 profile. 672 8. Compression 674 [I-D.ietf-uta-tls-bcp] recommends to always disable DTLS-level 675 compression due to attacks. For IoT applications compression at the 676 DTLS is not needed since application layer protocols are highly 677 optimized and the compression algorithms at the DTLS layer increase 678 code size and complexity. 680 This DTLS client profile does not include DTLS layer compression. 682 9. Perfect Forward Secrecy 684 Perfect forward secrecy (PFS) is designed to prevent the compromise 685 of a long-term secret key from affecting the confidentiality of past 686 conversations. The PSK ciphersuite recommended in the CoAP 687 specification [RFC7252] does not offer this property since it does 688 not utilize a Diffie-Hellman exchange. [I-D.ietf-uta-tls-bcp] on the 689 other hand recommends using ciphersuites offering this security 690 property and so do the public key-based ciphersuites recommended by 691 the CoAP specification. 693 The use of PFS is certainly a trade-off decision since on one hand 694 the compromise of long-term secrets of embedded devices is more 695 likely than with many other Internet hosts but on the other hand a 696 Diffie-Hellman exchange requires ephemeral key pairs to be generated, 697 which can be demanding from a performance point of view. Finally, 698 the impact of the disclosure of past conversations and the desire to 699 increase the cost for pervasive monitoring (see [RFC7258]) has to be 700 taken into account. 702 Our recommendation is to stick with the ciphersuite suggested in the 703 CoAP specification. New ciphersuites support PFS for pre-shared 704 secret-based authentication, such as 705 [I-D.schmertmann-dice-ccm-psk-pfs], and might be available as a 706 standardized ciphersuite in the future. 708 10. Keep-Alive 710 RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the 711 other peer is still alive. The same mechanism can also be used to 712 perform Path Maximum Transmission Unit (MTU) Discovery. 714 A recommendation about the use of RFC 6520 depends on the type of 715 message exchange an IoT device performs. There are three types of 716 exchanges that need to be analysed: 718 Client-Initiated, One-Shot Messages 720 This is a common communication pattern where IoT devices upload 721 data to a server on the Internet on an irregular basis. The 722 communication may be triggered by specific events, such as opening 723 a door. 725 Since the upload happens on an irregular and unpredictable basis 726 and due to renumbering and Network Address Translation (NAT) a new 727 DTLS session or DTLS session resumption can be used. 729 In this case there is no use for a keep-alive extension for this 730 scenario. 732 Client-Initiated, Regular Data Uploads 734 This is a variation of the previous case whereby data gets 735 uploaded on a regular basis, for example, based on frequent 736 temperature readings. With such regular exchange it can be 737 assumed that the DTLS context is still in kept at the IoT device. 738 If neither NAT bindings nor IP address changes occurred then the 739 DTLS record layer will not notice any changes. For the case where 740 IP and port changes happened it is necessary to re-create the DTLS 741 record layer using session resumption. 743 In this scenario there is no use for a keep-alive extension. It 744 is also very likely that the device will enter a sleep cycle in 745 between data transmissions to keep power consumption low. 747 Server-Initiated Messages 749 In the two previous scenarios the client initiated the protocol 750 interaction. In this case, we consider server-initiated messages. 751 Since messages to the client may get blocked by intermediaries, 752 such as NATs and stateful packet filtering firewalls, the initial 753 connection setup is triggered by the client and then kept alive. 754 Since state expires fairly quickly at middleboxes regular 755 heartbeats are necessary whereby these keep-alive messages may be 756 exchanged at the application layer or within DTLS itself. 758 For this message exchange pattern the use of DTLS heartbeat 759 messages is quite useful. The MTU discovery mechanism, on the 760 other hand, is less likely to be relevant since for many IoT 761 deployments the must constrained link is the wireless interface at 762 the IoT device itself rather than somewhere in the network. Only 763 in more complex network topologies the situation might be 764 different. 766 For server-initiated messages the heartbeat extension can be 767 recommended. 769 11. Random Number Generation 771 The DTLS protocol requires random numbers to be available during the 772 protocol run. For example, during the ClientHello and the 773 ServerHello exchange the client and the server exchange random 774 numbers. Also, the use of the Diffie-Hellman exchange requires 775 random numbers during the key pair generation. Special care has to 776 be paid when generating random numbers in embedded systems as many 777 entropy sources available on desktop operating systems or mobile 778 devices might be missing, as described in [Heninger]. Consequently, 779 if not enough time is given during system start time to fill the 780 entropy pool then the output might be predictable and repeatable, for 781 example leading to the same keys generated again and again. 783 Recommendation: IoT devices using DTLS MUST offer ways to generate 784 quality random numbers. Guidelines and requirements for random 785 number generation can be found in RFC 4086 [RFC4086]. 787 It is important to note that sources contributing to the randomness 788 pool on laptops, or desktop PCs are not available on many IoT device, 789 such as mouse movement, timing of keystrokes, air turbulence on the 790 movement of hard drive heads, etc. Other sources have to be found or 791 dedicated hardware has to be added. 793 The ClientHello and the ServerHello message contains the 'Random' 794 structure, which has two components: gmt_unix_time and a random 795 sequence of 28 random bytes. gmt_unix_time holds the current time 796 and date in standard UNIX 32-bit format (seconds since the midnight 797 starting Jan 1, 1970, GMT). [I-D.mathewson-no-gmtunixtime] argues 798 that the entire value the ClientHello.Random and ServerHello.Random 799 fields, including gmt_unix_time, should be set to a cryptographically 800 random sequence because of privacy concerns (fingerprinting). Since 801 many IoT devices do not have access to a real-time clock this 802 recommendation is even more relevant in the embedded systems 803 environment. 805 12. Client Certificate URLs 807 This RFC 6066 [RFC6066] extension allows to avoid sending client-side 808 certificates and URLs instead. This reduces the over-the-air 809 transmission. 811 This is certainly a useful extension when a certificate-based mode 812 for DTLS is used since the TLS cached info extension does not provide 813 any help with caching information on the server side. 815 Recommendation: Add support for client certificate URLs for those 816 environments where client-side certificates are used. 818 13. Trusted CA Indication 820 This RFC 6066 extension allows clients to indicate what trust anchor 821 they support. With certificate-based authentication a DTLS server 822 conveys its end entity certificate to the client during the DTLS 823 exchange provides. Since the server does not necessarily know what 824 trust anchors the client has stored it includes intermediate CA certs 825 in the certificate payload as well to facilitate with certification 826 path construction and path validation. 828 Today, in most IoT deployments there is a fairly static relationship 829 between the IoT device (and the software running on them) and the 830 server- side infrastructure and no such dynamic indication of trust 831 anchors is needed. 833 Recommendation: For IoT deployments where clients talk to a fixed, 834 pre-configured set of servers and where a software update mechanism 835 is available this extension is not recommended. Environments where 836 the client needs to interact with dynamically discovered DTLS servers 837 this extension may be useful to reduce the communication overhead. 838 Note, however, in that case the TLS cached info extension may help to 839 reduce the communication overhead for everything but the first 840 protocol interaction. 842 14. Truncated MAC Extension 844 The truncated MAC extension was introduced with RFC 6066 with the 845 goal to reduces the size of the MAC used at the Record Layer. This 846 extension was developed for TLS ciphersuites that used older modes of 847 operation where the MAC and the encryption operation was performed 848 independently. 850 For CoAP, however, the recommended ciphersuites use the newer 851 Authenticated Encryption with Associated Data (AEAD) construct, 852 namely the CBC-MAC mode (CCM) with eight-octet authentication tags. 853 Furthermore, the extension [RFC7366] introducing the encrypt-then-MAC 854 security mechanism (instead of the MAC-then-encrypt) is also not 855 applicable for this profile. 857 Recommendation: Since this profile only supports AEAD ciphersuites 858 this extension is not applicable. 860 15. Server Name Indication (SNI) 862 This RFC 6066 extension defines a mechanism for a client to tell a 863 TLS server the name of the server it wants to contact. This is a 864 useful extension for many hosting environments where multiple virtual 865 servers are run on single IP address. 867 Recommendation: Unless it is known that a DTLS client does not 868 interact with a server in a hosting environment that requires such an 869 extension we advice to offer support for the SNI extension in this 870 profile. 872 16. Maximum Fragment Length Negotiation 874 This RFC 6066 extension lowers the maximum fragment length support 875 needed for the Record Layer from 2^14 bytes to 2^9 bytes. 877 This is a very useful extension that allows the client to indicate to 878 the server how much maximum memory buffers it uses for incoming 879 messages. Ultimately, the main benefit of this extension is it to 880 allows client implementations to lower their RAM requirements since 881 the client does not need to accept packets of large size (such as 16k 882 packets as required by plain TLS/DTLS). 884 Recommendation: Client implementations MUST support this extension. 886 17. TLS Session Hash 888 The TLS master secret is not cryptographically bound to important 889 session parameters such as the client and server identities. This 890 can be utilized by an attacker to mount a man-in-the-middle attack 891 since the master secret is not guaranteed to be unique across 892 sessions. 894 [I-D.ietf-tls-session-hash] defines a TLS extension that binds the 895 master secret to a log of the full handshake that computes it, thus 896 preventing such attacks. 898 Recommendation: Client implementations SHOULD implement this 899 extension support this extension even though the ciphersuites 900 recommended by this profile are not vulnerable this attack. For 901 Diffie-Hellman-based ciphersuites the keying material is contributed 902 by both parties and in case of the pre-shared secret key ciphersuite 903 both parties need to be in possession of the shared secret to ensure 904 that the handshake completes successfully. It is, however, possible 905 that some application layer protocols will tunnel other 906 authentication protocols on top of DTLS making this attack relevant 907 again. 909 18. Negotiation and Downgrading Attacks 911 CoAP demands version 1.2 of DTLS to be used and the earlier version 912 of DTLS is not supported. As such, there is no risk of downgrading 913 to an older version of DTLS. The work described in 914 [I-D.bmoeller-tls-downgrade-scsv] is therefore also not applicable to 915 this environment since there is no legacy server infrastructure to 916 worry about. 918 To prevent the TLS renegotiation attack [RFC5746] clients MUST 919 respond to server-initiated renegotiation attempts with an Alert 920 message (no_renegotiation) and clients MUST NOT initiate them. TLS 921 and DTLS allows a client and a server who already have a TLS 922 connection to negotiate new parameters, generate new keys, etc by 923 initiating a TLS handshake using a ClientHello message. 924 Renegotiation happens in the existing TLS connection, with the new 925 handshake packets being encrypted along with application data. 927 19. Privacy Considerations 929 The DTLS handshake exchange conveys various identifiers, which can be 930 observed by an on-path eavesdropper. For example, the DTLS PSK 931 exchange reveals the PSK identity, the supported extensions, the 932 session id, algorithm parameters, etc. When session resumption is 933 used then individual TLS sessions can be correlated by an on-path 934 adversary. With many IoT deployments it is likely that keying 935 material and their identifiers are persistent over a longer period of 936 time due to the cost of updating software on these devices. 938 User participation with many IoT deployments poses a challenge since 939 many of the IoT devices operate unattended, even though they will 940 initially be provisioned by a human. The ability to control data 941 sharing and to configure preference will have to be provided at a 942 system level rather than at the level of the DTLS exchange itself, 943 which is the scope of this document. Quite naturally, the use of 944 DTLS with mutual authentication will allow a TLS server to collect 945 authentication information about the IoT device (likely over a long 946 period of time). While this strong form of authentication will 947 prevent mis-attribution it also allows strong identification. 948 Device-related data collection (e.g., sensor recordings) will be 949 associated with other data to be truly useful and this extra data 950 might include personal data about the owner of the device or data 951 about the environment it senses. Consequently, the data stored on 952 the server-side will be vulnerable to stored data compromise. For 953 the communication between the client and the server this 954 specification prevents eavesdroppers to gain access to the 955 communication content. While the PSK-based ciphersuite does not 956 provide PFS the asymmetric versions do. This prevents an adversary 957 from obtaining past communication content when access to a long-term 958 secret has been gained. Note that no extra effort to make traffic 959 analysis more difficult is provided by the recommendations made in 960 this document. 962 20. Security Considerations 964 This entire document is about security. 966 We would also like to point out that designing a software update 967 mechanism into an IoT system is crucial to ensure that both 968 functionality can be enhanced and that potential vulnerabilities can 969 be fixed. This software update mechanism is also useful for changing 970 configuration information, for example, trust anchors and other 971 keying related information. 973 21. IANA Considerations 975 This document includes no request to IANA. 977 22. Acknowledgements 979 Thanks to Robert Cragie, Russ Housley, Rene Hummen, Sandeep Kumar, 980 Sye Loong Keoh, Eric Rescorla, Michael Richardson, Zach Shelby, 981 Michael StJohns, and Sean Turner for their helpful comments and 982 discussions that have shaped the document. 984 Big thanks also to Klaus Hartke, who wrote the initial version of 985 this document. 987 23. References 989 23.1. Normative References 991 [EUI64] "GUIDELINES FOR 64-BIT GLOBAL IDENTIFIER (EUI-64) 992 REGISTRATION AUTHORITY", April 2010, 993 . 996 [I-D.ietf-tls-cached-info] 997 Santesson, S. and H. Tschofenig, "Transport Layer Security 998 (TLS) Cached Information Extension", draft-ietf-tls- 999 cached-info-16 (work in progress), February 2014. 1001 [I-D.ietf-tls-session-hash] 1002 Bhargavan, K., Delignat-Lavaud, A., Pironti, A., Langley, 1003 A., and M. Ray, "Transport Layer Security (TLS) Session 1004 Hash and Extended Master Secret Extension", draft-ietf- 1005 tls-session-hash-02 (work in progress), October 2014. 1007 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1008 Requirement Levels", BCP 14, RFC 2119, March 1997. 1010 [RFC4279] Eronen, P. and H. Tschofenig, "Pre-Shared Key Ciphersuites 1011 for Transport Layer Security (TLS)", RFC 4279, December 1012 2005. 1014 [RFC5246] Dierks, T. and E. Rescorla, "The Transport Layer Security 1015 (TLS) Protocol Version 1.2", RFC 5246, August 2008. 1017 [RFC5746] Rescorla, E., Ray, M., Dispensa, S., and N. Oskov, 1018 "Transport Layer Security (TLS) Renegotiation Indication 1019 Extension", RFC 5746, February 2010. 1021 [RFC6066] Eastlake, D., "Transport Layer Security (TLS) Extensions: 1022 Extension Definitions", RFC 6066, January 2011. 1024 [RFC6125] Saint-Andre, P. and J. Hodges, "Representation and 1025 Verification of Domain-Based Application Service Identity 1026 within Internet Public Key Infrastructure Using X.509 1027 (PKIX) Certificates in the Context of Transport Layer 1028 Security (TLS)", RFC 6125, March 2011. 1030 [RFC6347] Rescorla, E. and N. Modadugu, "Datagram Transport Layer 1031 Security Version 1.2", RFC 6347, January 2012. 1033 [RFC6520] Seggelmann, R., Tuexen, M., and M. Williams, "Transport 1034 Layer Security (TLS) and Datagram Transport Layer Security 1035 (DTLS) Heartbeat Extension", RFC 6520, February 2012. 1037 [RFC7250] Wouters, P., Tschofenig, H., Gilmore, J., Weiler, S., and 1038 T. Kivinen, "Using Raw Public Keys in Transport Layer 1039 Security (TLS) and Datagram Transport Layer Security 1040 (DTLS)", RFC 7250, June 2014. 1042 [RFC7251] McGrew, D., Bailey, D., Campagna, M., and R. Dugal, "AES- 1043 CCM Elliptic Curve Cryptography (ECC) Cipher Suites for 1044 TLS", RFC 7251, June 2014. 1046 23.2. Informative References 1048 [Heninger] 1049 Heninger, N., Durumeric, Z., Wustrow, E., and A. 1050 Halderman, "Mining Your Ps and Qs: Detection of Widespread 1051 Weak Keys in Network Devices", 21st USENIX Security 1052 Symposium, 1053 https://www.usenix.org/conference/usenixsecurity12/ 1054 technical-sessions/presentation/heninger, 2012. 1056 [I-D.bmoeller-tls-downgrade-scsv] 1057 Moeller, B. and A. Langley, "TLS Fallback Signaling Cipher 1058 Suite Value (SCSV) for Preventing Protocol Downgrade 1059 Attacks", draft-bmoeller-tls-downgrade-scsv-02 (work in 1060 progress), May 2014. 1062 [I-D.ietf-lwig-tls-minimal] 1063 Kumar, S., Keoh, S., and H. Tschofenig, "A Hitchhiker's 1064 Guide to the (Datagram) Transport Layer Security Protocol 1065 for Smart Objects and Constrained Node Networks", draft- 1066 ietf-lwig-tls-minimal-01 (work in progress), March 2014. 1068 [I-D.ietf-tls-negotiated-dl-dhe] 1069 Gillmor, D., "Negotiated Discrete Log Diffie-Hellman 1070 Ephemeral Parameters for TLS", draft-ietf-tls-negotiated- 1071 dl-dhe-00 (work in progress), July 2014. 1073 [I-D.ietf-uta-tls-bcp] 1074 Sheffer, Y., Holz, R., and P. Saint-Andre, 1075 "Recommendations for Secure Use of TLS and DTLS", draft- 1076 ietf-uta-tls-bcp-06 (work in progress), October 2014. 1078 [I-D.mathewson-no-gmtunixtime] 1079 Mathewson, N. and B. Laurie, "Deprecating gmt_unix_time in 1080 TLS", draft-mathewson-no-gmtunixtime-00 (work in 1081 progress), December 2013. 1083 [I-D.schmertmann-dice-ccm-psk-pfs] 1084 Schmertmann, L. and C. Bormann, "ECDHE-PSK AES-CCM Cipher 1085 Suites with Forward Secrecy for Transport Layer Security 1086 (TLS)", draft-schmertmann-dice-ccm-psk-pfs-01 (work in 1087 progress), August 2014. 1089 [IANA-TLS] 1090 IANA, "TLS Cipher Suite Registry", 1091 http://www.iana.org/assignments/tls-parameters/ 1092 tls-parameters.xhtml#tls-parameters-4, 2014. 1094 [RFC4086] Eastlake, D., Schiller, J., and S. Crocker, "Randomness 1095 Requirements for Security", BCP 106, RFC 4086, June 2005. 1097 [RFC5077] Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, 1098 "Transport Layer Security (TLS) Session Resumption without 1099 Server-Side State", RFC 5077, January 2008. 1101 [RFC5116] McGrew, D., "An Interface and Algorithms for Authenticated 1102 Encryption", RFC 5116, January 2008. 1104 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., 1105 Housley, R., and W. Polk, "Internet X.509 Public Key 1106 Infrastructure Certificate and Certificate Revocation List 1107 (CRL) Profile", RFC 5280, May 2008. 1109 [RFC5934] Housley, R., Ashmore, S., and C. Wallace, "Trust Anchor 1110 Management Protocol (TAMP)", RFC 5934, August 2010. 1112 [RFC6090] McGrew, D., Igoe, K., and M. Salter, "Fundamental Elliptic 1113 Curve Cryptography Algorithms", RFC 6090, February 2011. 1115 [RFC6655] McGrew, D. and D. Bailey, "AES-CCM Cipher Suites for 1116 Transport Layer Security (TLS)", RFC 6655, July 2012. 1118 [RFC6961] Pettersen, Y., "The Transport Layer Security (TLS) 1119 Multiple Certificate Status Request Extension", RFC 6961, 1120 June 2013. 1122 [RFC7228] Bormann, C., Ersue, M., and A. Keranen, "Terminology for 1123 Constrained-Node Networks", RFC 7228, May 2014. 1125 [RFC7252] Shelby, Z., Hartke, K., and C. Bormann, "The Constrained 1126 Application Protocol (CoAP)", RFC 7252, June 2014. 1128 [RFC7258] Farrell, S. and H. Tschofenig, "Pervasive Monitoring Is an 1129 Attack", BCP 188, RFC 7258, May 2014. 1131 [RFC7366] Gutmann, P., "Encrypt-then-MAC for Transport Layer 1132 Security (TLS) and Datagram Transport Layer Security 1133 (DTLS)", RFC 7366, September 2014. 1135 Author's Address 1137 Hannes Tschofenig (editor) 1138 ARM Ltd. 1139 110 Fulbourn Rd 1140 Cambridge CB1 9NJ 1141 Great Britain 1143 Email: Hannes.tschofenig@gmx.net 1144 URI: http://www.tschofenig.priv.at