tech-invite   World Map     

IETF     RFCs     Groups     SIP     ABNFs    |    3GPP     Specs     Gloss.     Arch.     IMS     UICC    |    Misc.    |    search     info

RFC 7925

Proposed STD
Pages: 61
Top     in Index     Prev     Next
in Group Index     No Prev: Lowest Number in Group     No Next: Highest Number in Group     Group: DICE

Transport Layer Security (TLS) / Datagram Transport Layer Security (DTLS) Profiles for the Internet of Things

Part 1 of 3, p. 1 to 21
None       Next Section

 


Top       ToC       Page 1 
Internet Engineering Task Force (IETF)                H. Tschofenig, Ed.
Request for Comments: 7925                                      ARM Ltd.
Category: Standards Track                                     T. Fossati
ISSN: 2070-1721                                                    Nokia
                                                               July 2016


                    Transport Layer Security (TLS) /
                Datagram Transport Layer Security (DTLS)
                  Profiles for the Internet of Things

Abstract

   A common design pattern in Internet of Things (IoT) deployments is
   the use of a constrained device that collects data via sensors or
   controls actuators for use in home automation, industrial control
   systems, smart cities, and other IoT deployments.

   This document defines a Transport Layer Security (TLS) and Datagram
   Transport Layer Security (DTLS) 1.2 profile that offers
   communications security for this data exchange thereby preventing
   eavesdropping, tampering, and message forgery.  The lack of
   communication security is a common vulnerability in IoT products that
   can easily be solved by using these well-researched and widely
   deployed Internet security protocols.

Status of This Memo

   This is an Internet Standards Track document.

   This document is a product of the Internet Engineering Task Force
   (IETF).  It represents the consensus of the IETF community.  It has
   received public review and has been approved for publication by the
   Internet Engineering Steering Group (IESG).  Further information on
   Internet Standards is available in Section 2 of RFC 7841.

   Information about the current status of this document, any errata,
   and how to provide feedback on it may be obtained at
   http://www.rfc-editor.org/info/rfc7925.

[Page 2] 
Copyright Notice

   Copyright (c) 2016 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Top       Page 3 
Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   4
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   4
   3.  Overview  . . . . . . . . . . . . . . . . . . . . . . . . . .   5
     3.1.  TLS and DTLS  . . . . . . . . . . . . . . . . . . . . . .   5
     3.2.  Communication Models  . . . . . . . . . . . . . . . . . .   6
     3.3.  The Ciphersuite Concept . . . . . . . . . . . . . . . . .  20
   4.  Credential Types  . . . . . . . . . . . . . . . . . . . . . .  21
     4.1.  Preconditions . . . . . . . . . . . . . . . . . . . . . .  21
     4.2.  Pre-Shared Secret . . . . . . . . . . . . . . . . . . . .  23
     4.3.  Raw Public Key  . . . . . . . . . . . . . . . . . . . . .  25
     4.4.  Certificates  . . . . . . . . . . . . . . . . . . . . . .  27
   5.  Signature Algorithm Extension . . . . . . . . . . . . . . . .  32
   6.  Error Handling  . . . . . . . . . . . . . . . . . . . . . . .  32
   7.  Session Resumption  . . . . . . . . . . . . . . . . . . . . .  34
   8.  Compression . . . . . . . . . . . . . . . . . . . . . . . . .  35
   9.  Perfect Forward Secrecy . . . . . . . . . . . . . . . . . . .  35
   10. Keep-Alive  . . . . . . . . . . . . . . . . . . . . . . . . .  36
   11. Timeouts  . . . . . . . . . . . . . . . . . . . . . . . . . .  38
   12. Random Number Generation  . . . . . . . . . . . . . . . . . .  39
   13. Truncated MAC and Encrypt-then-MAC Extension  . . . . . . . .  40
   14. Server Name Indication (SNI)  . . . . . . . . . . . . . . . .  40
   15. Maximum Fragment Length Negotiation . . . . . . . . . . . . .  41
   16. Session Hash  . . . . . . . . . . . . . . . . . . . . . . . .  41
   17. Renegotiation Attacks . . . . . . . . . . . . . . . . . . . .  42
   18. Downgrading Attacks . . . . . . . . . . . . . . . . . . . . .  42
   19. Crypto Agility  . . . . . . . . . . . . . . . . . . . . . . .  43
   20. Key Length Recommendations  . . . . . . . . . . . . . . . . .  44
   21. False Start . . . . . . . . . . . . . . . . . . . . . . . . .  45
   22. Privacy Considerations  . . . . . . . . . . . . . . . . . . .  45
   23. Security Considerations . . . . . . . . . . . . . . . . . . .  46
   24. References  . . . . . . . . . . . . . . . . . . . . . . . . .  47
     24.1.  Normative References . . . . . . . . . . . . . . . . . .  47
     24.2.  Informative References . . . . . . . . . . . . . . . . .  48
   Appendix A.  Conveying DTLS over SMS  . . . . . . . . . . . . . .  56
     A.1.  Overview  . . . . . . . . . . . . . . . . . . . . . . . .  56
     A.2.  Message Segmentation and Reassembly . . . . . . . . . . .  57
     A.3.  Multiplexing Security Associations  . . . . . . . . . . .  57
     A.4.  Timeout . . . . . . . . . . . . . . . . . . . . . . . . .  58
   Appendix B.  DTLS Record Layer Per-Packet Overhead  . . . . . . .  59
   Appendix C.  DTLS Fragmentation . . . . . . . . . . . . . . . . .  60
   Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . .  60
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  61

Top      ToC       Page 4 
1.  Introduction

   An engineer developing an Internet of Things (IoT) device needs to
   investigate the security threats and decide about the security
   services that can be used to mitigate these threats.

   Enabling IoT devices to exchange data often requires authentication
   of the two endpoints and the ability to provide integrity and
   confidentiality protection of exchanged data.  While these security
   services can be provided at different layers in the protocol stack,
   the use of Transport Layer Security (TLS) / Datagram Transport Layer
   Security (DTLS) has been very popular with many application
   protocols, and it is likely to be useful for IoT scenarios as well.

   Fitting Internet protocols into constrained devices can be difficult,
   but thanks to the standardization efforts, new profiles and protocols
   are available, such as the Constrained Application Protocol (CoAP)
   [RFC7252].  CoAP messages are mainly carried over UDP/DTLS, but other
   transports can be utilized, such as SMS (as described in Appendix A)
   or TCP (as currently being proposed with [COAP-TCP-TLS]).

   While the main goal for this document is to protect CoAP messages
   using DTLS 1.2 [RFC6347], the information contained in the following
   sections is not limited to CoAP nor to DTLS itself.

   Instead, this document defines a profile of DTLS 1.2 [RFC6347] and
   TLS 1.2 [RFC5246] that offers communication security services for IoT
   applications and is reasonably implementable on many constrained
   devices.  Profile thereby means that available configuration options
   and protocol extensions are utilized to best support the IoT
   environment.  This document does not alter TLS/DTLS specifications
   and does not introduce any new TLS/DTLS extension.

   The main target audience for this document is the embedded system
   developer configuring and using a TLS/DTLS stack.  This document may,
   however, also help those developing or selecting a suitable TLS/DTLS
   stack for an IoT product.  If you are familiar with (D)TLS, then skip
   ahead to Section 4.

2.  Terminology

   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
   "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
   "OPTIONAL" in this document are to be interpreted as described in RFC
   2119 [RFC2119].

   This specification refers to TLS as well as DTLS and particularly to
   version 1.2, which is the most recent version at the time of writing.

Top      ToC       Page 5 
   We refer to TLS/DTLS whenever the text is applicable to both versions
   of the protocol and to TLS or DTLS when there are differences between
   the two protocols.  Note that TLS 1.3 is being developed, but it is
   not expected that this profile will "just work" due to the
   significant changes being done to TLS for version 1.3.

   Note that "client" and "server" in this document refer to TLS/DTLS
   roles, where the client initiates the handshake.  This does not
   restrict the interaction pattern of the protocols on top of DTLS
   since the record layer allows bidirectional communication.  This
   aspect is further described in Section 3.2.

   RFC 7228 [RFC7228] introduces the notion of constrained-node
   networks, which are made of small devices with severe constraints on
   power, memory, and processing resources.  The terms constrained
   devices and IoT devices are used interchangeably.

   The terms "certification authority" (CA) and "distinguished name"
   (DN) are taken from [RFC5280].  The terms "trust anchor" and "trust
   anchor store" are defined in [RFC6024] as:

      A trust anchor represents an authoritative entity via a public key
      and associated data.  The public key is used to verify digital
      signatures, and the associated data is used to constrain the types
      of information for which the trust anchor is authoritative.

      A trust anchor store is a set of one or more trust anchors stored
      in a device.... A device may have more than one trust anchor
      store, each of which may be used by one or more applications.

3.  Overview

3.1.  TLS and DTLS

   The TLS protocol [RFC5246] provides authenticated, confidentiality-
   and integrity-protected communication between two endpoints.  The
   protocol is composed of two layers: the Record Protocol and the
   handshaking protocols.  At the lowest level, layered on top of a
   reliable transport protocol (e.g., TCP), is the Record Protocol.  It
   provides connection security by using symmetric cryptography for
   confidentiality, data origin authentication, and integrity
   protection.  The Record Protocol is used for encapsulation of various
   higher-level protocols.  The handshaking protocols consist of three
   subprotocols -- namely, the handshake protocol, the change cipher
   spec protocol, and the alert protocol.  The handshake protocol allows
   the server and client to authenticate each other and to negotiate an
   encryption algorithm and cryptographic keys before the application
   protocol transmits or receives data.

Top      ToC       Page 6 
   The design of DTLS [RFC6347] is intentionally very similar to TLS.
   However, since DTLS operates on top of an unreliable datagram
   transport, it must explicitly cope with the absence of reliable and
   ordered delivery assumptions made by TLS.  RFC 6347 explains these
   differences in great detail.  As a short summary, for those not
   familiar with DTLS, the differences are:

   o  An explicit sequence number and an epoch field is included in the
      Record Protocol.  Section 4.1 of RFC 6347 explains the processing
      rules for these two new fields.  The value used to compute the
      Message Authentication Code (MAC) is the 64-bit value formed by
      concatenating the epoch and the sequence number.

   o  Stream ciphers must not be used with DTLS.  The only stream cipher
      defined for TLS 1.2 is RC4, and due to cryptographic weaknesses,
      it is not recommended anymore even for use with TLS [RFC7465].
      Note that the term "stream cipher" is a technical term in the TLS
      specification.  Section 4.7 of RFC 5246 defines stream ciphers in
      TLS as follows: "In stream cipher encryption, the plaintext is
      exclusive-ORed with an identical amount of output generated from a
      cryptographically secure keyed pseudorandom number generator."

   o  The TLS handshake protocol has been enhanced to include a
      stateless cookie exchange for Denial-of-Service (DoS) resistance.
      For this purpose, a new handshake message, the HelloVerifyRequest,
      was added to DTLS.  This handshake message is sent by the server
      and includes a stateless cookie, which is returned in a
      ClientHello message back to the server.  Although the exchange is
      optional for the server to execute, a client implementation has to
      be prepared to respond to it.  Furthermore, the handshake message
      format has been extended to deal with message loss, reordering,
      and fragmentation.

3.2.  Communication Models

   This document describes a profile of DTLS and, to be useful, it has
   to make assumptions about the envisioned communication architecture.

   Two communication architectures (and consequently two profiles) are
   described in this document.

Top      ToC       Page 7 
3.2.1.  Constrained TLS/DTLS Clients

   The communication architecture shown in Figure 1 assumes a unicast
   communication interaction with an IoT device utilizing a constrained
   TLS/DTLS client interacting with one or multiple TLS/DTLS servers.

   Before a client can initiate the TLS/DTLS handshake, it needs to know
   the IP address of that server and what credentials to use.
   Application-layer protocols, such as CoAP, which is conveyed on top
   of DTLS, may be configured with URIs of the endpoints to which CoAP
   needs to register and publish data.  This configuration information
   (including non-confidential credentials, like certificates) may be
   conveyed to clients as part of a firmware/software package or via a
   configuration protocol.  The following credential types are supported
   by this profile:

   o  For authentication based on the Pre-Shared Key (PSK) (see
      Section 4.2), this includes the paired "PSK identity" and shared
      secret to be used with each server.

   o  For authentication based on the raw public key (see Section 4.3),
      this includes either the server's public key or the hash of the
      server's public key.

   o  For certificate-based authentication (see Section 4.4), this
      includes a pre-populated trust anchor store that allows the DTLS
      stack to perform path validation for the certificate obtained
      during the handshake with the server.

   Figure 1 shows example configuration information stored at the
   constrained client for use with respective servers.

   This document focuses on the description of the DTLS client-side
   functionality but, quite naturally, the equivalent server-side
   support has to be available.

Top      ToC       Page 8 
              +////////////////////////////////////+
              |          Configuration             |
              |////////////////////////////////////|
              | Server A --> PSK Identity, PSK     |
              |                                    |
              | Server B --> Public Key (Server B),|
              |              Public/Private Key    |
              |              (for Client)          |
              |                                    |
              | Server C --> Public/Private Key    |
              |              (for Client)          |
              |              Trust Anchor Store    |
              +------------------------------------+
                oo
          oooooo
         o
   +-----------+
   |Constrained|
   |TLS/DTLS   |
   |Client     |-
   +-----------+ \
                  \  ,-------.
                   ,'         `.            +------+
                  /  IP-Based   \           |Server|
                 (    Network    )          |  A   |
                  \             /           +------+
                   `.         ,'
                     '---+---'                  +------+
                         |                      |Server|
                         |                      |  B   |
                         |                      +------+
                         |
                         |                  +------+
                         +----------------->|Server|
                                            |  C   |
                                            +------+

                   Figure 1: Constrained Client Profile

Top      ToC       Page 9 
3.2.1.1.  Examples of Constrained Client Exchanges

3.2.1.1.1.  Network Access Authentication Example

   Reuse is a recurring theme when considering constrained environments
   and is behind a lot of the directions taken in developments for
   constrained environments.  The corollary of reuse is to not add
   functionality if it can be avoided.  An example relevant to the use
   of TLS is network access authentication, which takes place when a
   device connects to a network and needs to go through an
   authentication and access control procedure before it is allowed to
   communicate with other devices or connect to the Internet.

   Figure 2 shows the network access architecture with the IoT device
   initiating the communication to an access point in the network using
   the procedures defined for a specific physical layer.  Since
   credentials may be managed and stored centrally, in the
   Authentication, Authorization, and Accounting (AAA) server, the
   security protocol exchange may need to be relayed via the
   Authenticator, i.e., functionality running on the access point to the
   AAA server.  The authentication and key exchange protocol itself is
   encapsulated within a container, the Extensible Authentication
   Protocol (EAP) [RFC3748], and messages are conveyed back and forth
   between the EAP endpoints, namely the EAP peer located on the IoT
   device and the EAP server located on the AAA server or the access
   point.  To route EAP messages from the access point, acting as a AAA
   client, to the AAA server requires an adequate protocol mechanism,
   namely RADIUS [RFC2865] or Diameter [RFC6733].

   More details about the concepts and a description about the
   terminology can be found in RFC 5247 [RFC5247].

Top      ToC       Page 10 
                                                +--------------+
                                                |Authentication|
                                                |Authorization |
                                                |Accounting    |
                                                |Server        |
                                                |(EAP Server)  |
                                                |              |
                                                +-^----------^-+
                                                  * EAP      o RADIUS/
                                                  *          o Diameter
                                                --v----------v--
                                             ///                \\\
                                           //                      \\
                                          |        Federation        |
                                          |        Substrate         |
                                           \\                      //
                                             \\\                ///
                                                --^----------^--
                                                  * EAP      o RADIUS/
                                                  *          o Diameter
    +-------------+                             +-v----------v--+
    |             |      EAP/EAP Method         |               |
    | Internet of |<***************************>| Access Point  |
    | Things      |                             |(Authenticator)|
    | Device      |    EAP Lower Layer and      |(AAA Client)   |
    | (EAP Peer)  | Secure Association Protocol |               |
    |             |<--------------------------->|               |
    |             |                             |               |
    |             |      Physical Layer         |               |
    |             |<===========================>|               |
    +-------------+                             +---------------+
      Legend:

       <****>: Device-to-AAA-Server Exchange
       <---->: Device-to-Authenticator Exchange
       <oooo>: AAA-Client-to-AAA-Server Exchange
       <====>: Physical layer like IEEE 802.11/802.15.4

                   Figure 2: Network Access Architecture

Top      ToC       Page 11 
   One standardized EAP method is EAP-TLS, defined in RFC 5216
   [RFC5216], which reuses the TLS-based protocol exchange and
   encapsulates it inside the EAP payload.  In terms of reuse, this
   allows many components of the TLS protocol to be shared between the
   network access security functionality and the TLS functionality
   needed for securing application-layer traffic.  In the EAP-TLS
   exchange shown in Figure 3, the IoT device as the EAP peer acts as a
   TLS client.

      Authenticating Peer     Authenticator
      -------------------     -------------
                              <- EAP-Request/
                              Identity
      EAP-Response/
      Identity (MyID) ->
                              <- EAP-Request/
                              EAP-Type=EAP-TLS
                              (TLS Start)
      EAP-Response/
      EAP-Type=EAP-TLS
      (TLS client_hello)->
                              <- EAP-Request/
                              EAP-Type=EAP-TLS
                              (TLS server_hello,
                               TLS certificate,
                               [TLS server_key_exchange,]
                               TLS certificate_request,
                               TLS server_hello_done)
      EAP-Response/
      EAP-Type=EAP-TLS
      (TLS certificate,
       TLS client_key_exchange,
       TLS certificate_verify,
       TLS change_cipher_spec,
       TLS finished) ->
                              <- EAP-Request/
                              EAP-Type=EAP-TLS
                              (TLS change_cipher_spec,
                               TLS finished)
      EAP-Response/
      EAP-Type=EAP-TLS ->
                              <- EAP-Success

                        Figure 3: EAP-TLS Exchange

Top      ToC       Page 12 
   The guidance in this document also applies to the use of EAP-TLS for
   network access authentication.  An IoT device using a network access
   authentication solution based on TLS can reuse most parts of the code
   for the use of DTLS/TLS at the application layer, thereby saving a
   significant amount of flash memory.  Note, however, that the
   credentials used for network access authentication and those used for
   application-layer security are very likely different.

3.2.1.1.2.  CoAP-Based Data Exchange Example

   When a constrained client uploads sensor data to a server
   infrastructure, it may use CoAP by pushing the data via a POST
   message to a preconfigured endpoint on the server.  In certain
   circumstances, this might be too limiting and additional
   functionality is needed, as shown in Figures 4 and 5, where the IoT
   device itself runs a CoAP server hosting the resource that is made
   accessible to other entities.  Despite running a CoAP server on the
   IoT device, it is still the DTLS client on the IoT device that
   initiates the interaction with the non-constrained resource server in
   our scenario.

   Figure 4 shows a sensor starting a DTLS exchange with a resource
   directory and uses CoAP to register available resources in Figure 5.
   [CoRE-RD] defines the resource directory (RD) as a web entity that
   stores information about web resources and implements
   Representational State Transfer (REST) interfaces for registration
   and lookup of those resources.  Note that the described exchange is
   borrowed from the Open Mobile Alliance (OMA) Lightweight
   Machine-to-Machine (LWM2M) specification [LWM2M] that uses RD but
   adds proxy functionality.

   The initial DTLS interaction between the sensor, acting as a DTLS
   client, and the resource directory, acting as a DTLS server, will be
   a full DTLS handshake.  Once this handshake is complete, both parties
   have established the DTLS record layer.  Subsequently, the CoAP
   client can securely register at the resource directory.

   After some time (assuming that the client regularly refreshes its
   registration), the resource directory receives a request from an
   application to retrieve the temperature information from the sensor.
   This request is relayed by the resource directory to the sensor using
   a GET message exchange.  The already established DTLS record layer
   can be used to secure the message exchange.

Top      ToC       Page 13 
                                                    Resource
       Sensor                                       Directory
       ------                                       ---------

     +---
     |
     | ClientHello             -------->
     | #client_certificate_type#
    F| #server_certificate_type#
    U|
    L|                         <-------    HelloVerifyRequest
    L|
     | ClientHello             -------->
    D| #client_certificate_type#
    T| #server_certificate_type#
    L|
    S|                                            ServerHello
     |                               #client_certificate_type#
    H|                               #server_certificate_type#
    A|                                            Certificate
    N|                                      ServerKeyExchange
    D|                                     CertificateRequest
    S|                         <--------      ServerHelloDone
    H|
    A| Certificate
    K| ClientKeyExchange
    E| CertificateVerify
     | [ChangeCipherSpec]
     | Finished                -------->
     |
     |                                     [ChangeCipherSpec]
     |                         <--------             Finished
     +---

      Note: Extensions marked with "#" were introduced with
            RFC 7250.

          Figure 4: DTLS/CoAP Exchange Using Resource Directory:
                         Part 1 -- DTLS Handshake

Top      ToC       Page 14 
   Figure 5 shows the DTLS-secured communication between the sensor and
   the resource directory using CoAP.

                                                    Resource
       Sensor                                       Directory
       ------                                       ---------

   [[==============DTLS-Secured Communication===================]]

     +---                                                  ///+
    C|                                                        \ D
    O| Req: POST coap://rd.example.com/rd?ep=node1            \ T
    A| Payload:                                               \ L
    P| </temp>;ct=41;                                         \ S
     |    rt="temperature-c";if="sensor",                     \
    R| </light>;ct=41;                                        \ R
    D|    rt="light-lux";if="sensor"                          \ E
     |                         -------->                      \ C
    R|                                                        \ O
    E|                                                        \ R
    G|                                     Res: 2.01 Created  \ D
     |                         <--------  Location: /rd/4521  \
     |                                                        \ L
     +---                                                     \ A
                                                              \ Y
                              *                               \ E
                              * (time passes)                 \ R
                              *                               \
     +---                                                     \ P
    C|                                                        \ R
    O|              Req: GET coaps://sensor.example.com/temp  \ O
    A|                         <--------                      \ T
    P|                                                        \ E
     | Res:  2.05 Content                                     \ C
    G| Payload:                                               \ T
    E| 25.5                     -------->                     \ E
    T|                                                        \ D
     +---                                                  ///+

          Figure 5: DTLS/CoAP Exchange Using Resource Directory:
                        Part 2 -- CoAP/RD Exchange

   Note that the CoAP GET message transmitted from the resource server
   is protected using the previously established DTLS record layer.

Top      ToC       Page 15 
3.2.2.  Constrained TLS/DTLS Servers

   Section 3.2.1 illustrates a deployment model where the TLS/DTLS
   client is constrained and efforts need to be taken to improve memory
   utilization, bandwidth consumption, reduce performance impacts, etc.
   In this section, we assume a scenario where constrained devices run
   TLS/DTLS servers to secure access to application-layer services
   running on top of CoAP, HTTP, or other protocols.  Figure 6
   illustrates a possible deployment whereby a number of constrained
   servers are waiting for regular clients to access their resources.
   The entire process is likely, but not necessarily, controlled by a
   third party, the authentication and authorization server.  This
   authentication and authorization server is responsible for holding
   authorization policies that govern the access to resources and
   distribution of keying material.

Top      ToC       Page 16 
            +////////////////////////////////////+
            |          Configuration             |
            |////////////////////////////////////|
            | Credentials                        |
            |    Client A  -> Public Key         |
            |    Server S1 -> Symmetric Key      |
            |    Server S2 -> Certificate        |
            |    Server S3 -> Public Key         |
            | Trust Anchor Store                 |
            | Access Control Lists               |
            |    Resource X: Client A / GET      |
            |    Resource Y: Client A / PUT      |
            +------------------------------------+
                oo
          oooooo
         o
   +---------------+                +-----------+
   |Authentication |      +-------->|TLS/DTLS   |
   |& Authorization|      |         |Client A   |
   |Server         |      |         +-----------+
   +---------------+     ++
                ^        |                  +-----------+
                 \       |                  |Constrained|
                  \  ,-------.              | Server S1 |
                   ,'         `.            +-----------+
                  /    Local    \
                 (    Network    )
                  \             /        +-----------+
                   `.         ,'         |Constrained|
                     '---+---'           | Server S2 |
                         |               +-----------+
                         |
                         |                   +-----------+
                         +-----------------> |Constrained|
                                             | Server S3 |
                                             +-----------+

                   Figure 6: Constrained Server Profile

   A deployment with constrained servers has to overcome several
   challenges.  Below we explain how these challenges can be solved with
   CoAP, as an example.  Other protocols may offer similar capabilities.
   While the requirements for the TLS/DTLS protocol profile change only
   slightly when run on a constrained server (in comparison to running
   it on a constrained client), several other ecosystem factors will
   impact deployment.

Top      ToC       Page 17 
   There are several challenges that need to be addressed:

   Discovery and Reachability:

      A client must first and foremost discover the server before
      initiating a connection to it.  Once it has been discovered,
      reachability to the device needs to be maintained.

      In CoAP, the discovery of resources offered by servers is
      accomplished by sending a unicast or multicast CoAP GET to a well-
      known URI.  The Constrained RESTful Environments (CoRE) Link
      Format specification [RFC6690] describes the use case (see
      Section 1.2.1) and reserves the URI (see Section 7.1).  Section 7
      of the CoAP specification [RFC7252] describes the discovery
      procedure.  [RFC7390] describes the use case for discovering CoAP
      servers using multicast (see Section 3.3) and specifies the
      protocol processing rules for CoAP group communications (see
      Section 2.7).

      The use of RD [CoRE-RD] is yet another possibility for discovering
      registered servers and their resources.  Since RD is usually not a
      proxy, clients can discover links registered with the RD and then
      access them directly.

   Authentication:

      The next challenge concerns the provisioning of authentication
      credentials to the clients as well as servers.  In Section 3.2.1,
      we assume that credentials (and other configuration information)
      are provisioned to the device, and that those can be used with the
      authorization servers.  Of course, this leads to a very static
      relationship between the clients and their server-side
      infrastructure but poses fewer challenges from a deployment point
      of view, as described in Section 2 of [RFC7452].  In any case,
      engineers and product designers have to determine how the relevant
      credentials are distributed to the respective parties.  For
      example, shared secrets may need to be provisioned to clients and
      the constrained servers for subsequent use of TLS/DTLS PSK.  In
      other deployments, certificates, private keys, and trust anchors
      for use with certificate-based authentication may need to be
      utilized.

      Practical solutions use either pairing (also called imprinting) or
      a trusted third party.  With pairing, two devices execute a
      special protocol exchange that is unauthenticated to establish a
      shared key (for example, using an unauthenticated Diffie-Hellman
      (DH) exchange).  To avoid man-in-the-middle attacks, an
      out-of-band channel is used to verify that nobody has tampered

Top      ToC       Page 18 
      with the exchanged protocol messages.  This out-of-band channel
      can come in many forms, including:

      *  Human involvement by comparing hashed keys, entering passkeys,
         and scanning QR codes

      *  The use of alternative wireless communication channels (e.g.,
         infrared communication in addition to Wi-Fi)

      *  Proximity-based information

      More details about these different pairing/imprinting techniques
      can be found in the Smart Object Security Workshop report
      [RFC7397] and various position papers submitted on that topic,
      such as [ImprintingSurvey].  The use of a trusted third party
      follows a different approach and is subject to ongoing
      standardization efforts in the Authentication and Authorization
      for Constrained Environments (ACE) working group [ACE-WG].

   Authorization

      The last challenge is the ability for the constrained server to
      make an authorization decision when clients access protected
      resources.  Pre-provisioning access control information to
      constrained servers may be one option but works only in a small
      scale, less dynamic environment.  For a finer-grained and more
      dynamic access control solution, the reader is referred to the
      ongoing work in the IETF ACE working group.

   Figure 7 shows an example interaction whereby a device, a thermostat
   in our case, searches in the local network for discoverable resources
   and accesses those.  The thermostat starts the procedure using a
   link-local discovery message using the "All CoAP Nodes" multicast
   address by utilizing the link format per RFC 6690 [RFC6690].  The
   IPv6 multicast address used for CoAP link-local discovery is
   FF02::FD.  As a result, a temperature sensor and a fan respond.
   These responses allow the thermostat to subsequently read temperature
   information from the temperature sensor with a CoAP GET request
   issued to the previously learned endpoint.  In this example we assume
   that accessing the temperature sensor readings and controlling the
   fan requires authentication and authorization of the thermostat and
   TLS is used to authenticate both endpoints and to secure the
   communication.

Top      ToC       Page 19 
                                 Temperature
     Thermostat                     Sensor              Fan
     ----------                   ---------             ---

       Discovery
       -------------------->
       GET coap://[FF02::FD]/.well-known/core

                     CoAP 2.05 Content
      <-------------------------------
      </3303/0/5700>;rt="temperature";
                     if="sensor"

                                        CoAP 2.05 Content
      <--------------------------------------------------
                           </fan>;rt="fan";if="actuation"

   +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+
   \ Protocol steps to obtain access token or keying        /
   \ material for access to the temperature sensor and fan. /
   +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+

      Read Sensor Data
      (authenticated/authorized)
      ------------------------------->
      GET /3303/0/5700

                    CoAP 2.05 Content
     <-------------------------------
                               22.5 C

     Configure Actuator
     (authenticated/authorized)
     ------------------------------------------------->
     PUT /fan?on-off=true
                                      CoAP 2.04 Changed
     <-------------------------------------------------

               Figure 7: Local Discovery and Resource Access

Top      ToC       Page 20 
3.3.  The Ciphersuite Concept

   TLS (and consequently DTLS) support ciphersuites, and an IANA
   registry [IANA-TLS] was created to register the suites.  A
   ciphersuite (and the specification that defines it) contains the
   following information:

   o  Authentication and key exchange algorithm (e.g., PSK)

   o  Cipher and key length (e.g., Advanced Encryption Standard (AES)
      with 128-bit keys [AES])

   o  Mode of operation (e.g., Counter with CBC-MAC (CCM) mode for AES)
      [RFC3610]

   o  Hash algorithm for integrity protection, such as the Secure Hash
      Algorithm (SHA) in combination with Keyed-Hashing for Message
      Authentication (HMAC) (see [RFC2104] and [RFC6234])

   o  Hash algorithm for use with pseudorandom functions (e.g., HMAC
      with the SHA-256)

   o  Misc information (e.g., length of authentication tags)

   o  Information whether the ciphersuite is suitable for DTLS or only
      for TLS

   The TLS ciphersuite TLS_PSK_WITH_AES_128_CCM_8, for example, uses a
   pre-shared authentication and key exchange algorithm.  [RFC6655]
   defines this ciphersuite.  It uses the AES encryption algorithm,
   which is a block cipher.  Since the AES algorithm supports different
   key lengths (such as 128, 192, and 256 bits), this information has to
   be specified as well, and the selected ciphersuite supports 128-bit
   keys.  A block cipher encrypts plaintext in fixed-size blocks, and
   AES operates on a block size of 128 bits.  For messages exceeding 128
   bits, the message is partitioned into 128-bit blocks, and the AES
   cipher is applied to these input blocks with appropriate chaining,
   which is called mode of operation.

   TLS 1.2 introduced Authenticated Encryption with Associated Data
   (AEAD) ciphersuites (see [RFC5116] and [RFC6655]).  AEAD is a class
   of block cipher modes that encrypt (parts of) the message and
   authenticate the message simultaneously.  AES-CCM [RFC6655] is an
   example of such a mode.

   Some AEAD ciphersuites have shorter authentication tags (i.e.,
   message authentication codes) and are therefore more suitable for
   networks with low bandwidth where small message size matters.  The

Top      ToC       Page 21 
   TLS_PSK_WITH_AES_128_CCM_8 ciphersuite that ends in "_8" has an
   8-octet authentication tag, while the regular CCM ciphersuites have,
   at the time of writing, 16-octet authentication tags.  The design of
   CCM and the security properties are described in [CCM].

   TLS 1.2 also replaced the combination of MD5/SHA-1 hash functions in
   the TLS pseudorandom function (PRF) used in earlier versions of TLS
   with ciphersuite-specified PRFs.  For this reason, authors of more
   recent TLS 1.2 ciphersuite specifications explicitly indicate the MAC
   algorithm and the hash functions used with the TLS PRF.



(page 21 continued on part 2)

Next Section