Tech-invite   3GPPspecs   Glossaries   IETFRFCs   Groups   SIP   ABNFs   Ti+   Search in Tech-invite

in Index   Prev   Next
in Index   None   None  Group: DICE

RFC 7925

Transport Layer Security (TLS) / Datagram Transport Layer Security (DTLS) Profiles for the Internet of Things

Pages: 61
Proposed STD
Part 2 of 3 – Pages 21 to 41
First   Prev   Next

Top   ToC   Page 21   prevText
4.  Credential Types

   The mandatory-to-implement functionality will depend on the
   credential type used with IoT devices.  The subsections below
   describe the implications of three different credential types, namely
   pre-shared secrets, raw public keys, and certificates.

4.1.  Preconditions

   All exchanges described in the subsequent sections assume that some
   information has been distributed before the TLS/DTLS interaction
   starts.  The credentials are used to authenticate the client to the
   server, and vice versa.  What information items have to be
   distributed depends on the chosen credential types.  In all cases,
   the IoT device needs to know what algorithms to prefer, particularly
   if there are multiple algorithm choices available as part of the
   implemented ciphersuites, as well as information about the other
   communication endpoint (for example, in the form of a URI) a
   particular credential has to be used with.

   Pre-Shared Secrets:  In this case, a shared secret together with an
      identifier needs to be made available to the device as well as to
      the other communication party.

   Raw Public Keys:  A public key together with a private key are stored
      on the device and typically associated with some identifier.  To
      authenticate the other communication party, the appropriate
      credential has to be known.  If the other end uses raw public keys
      as well, then their public key needs to be provisioned (out of
      band) to the device.

   Certificates:  The use of certificates requires the device to store
      the public key (as part of the certificate) as well as the private
      key.  The certificate will contain the identifier of the device as
      well as various other attributes.  Both communication parties are
      assumed to be in possession of a trust anchor store that contains
      CA certificates and, in case of certificate pinning, end-entity
Top   ToC   Page 22
      certificates.  Similar to the other credentials, the IoT device
      needs information about which entity to use which certificate
      with.  Without a trust anchor store on the IoT device, it will not
      be possible to perform certificate validation.

   We call the above-listed information "device credentials" and these
   device credentials may be provisioned to the device already during
   the manufacturing time or later in the process, depending on the
   envisioned business and deployment model.  These initial credentials
   are often called "root of trust".  Whatever process is chosen for
   generating these initial device credentials, it MUST be ensured that
   a different key pair is provisioned for each device and installed in
   as secure a manner as possible.  For example, it is preferable to
   generate public/private keys on the IoT device itself rather than
   generating them outside the device.  Since an IoT device is likely to
   interact with various other parties, the initial device credential
   may only be used with some dedicated entities, and configuring
   further configuration and credentials to the device is left to a
   separate interaction.  An example of a dedicated protocol used to
   distribute credentials, access control lists, and configure
   information is the LWM2M protocol [LWM2M].

   For all the credentials listed above, there is a chance that those
   may need to be replaced or deleted.  While separate protocols have
   been developed to check the status of these credentials and to manage
   these credentials, such as the Trust Anchor Management Protocol
   (TAMP) [RFC5934], their usage is, however, not envisioned in the IoT
   context so far.  IoT devices are assumed to have a software update
   mechanism built-in, and it will allow updates of low-level device
   information, including credentials and configuration parameters.
   This document does, however, not mandate a specific software/firmware
   update protocol.

   With all credentials used as input to TLS/DTLS authentication, it is
   important that these credentials have been generated with care.  When
   using a pre-shared secret, a critical consideration is using
   sufficient entropy during the key generation, as discussed in
   [RFC4086].  Deriving a shared secret from a password, some device
   identifiers, or other low-entropy sources is not secure.  A low-
   entropy secret, or password, is subject to dictionary attacks.
   Attention also has to be paid when generating public/private key
   pairs since the lack of randomness can result in the same key pair
   being used in many devices.  This topic is also discussed in
   Section 12 since keys are generated during the TLS/DTLS exchange
   itself as well, and the same considerations apply.
Top   ToC   Page 23
4.2.  Pre-Shared Secret

   The use of pre-shared secrets is one of the most basic techniques for
   TLS/DTLS since it is both computationally efficient and bandwidth
   conserving.  Authentication based on pre-shared secrets was
   introduced to TLS in RFC 4279 [RFC4279].

   Figure 8 illustrates the DTLS exchange including the cookie exchange.
   While the server is not required to initiate a cookie exchange with
   every handshake, the client is required to implement and to react on
   it when challenged, as defined in RFC 6347 [RFC6347].  The cookie
   exchange allows the server to react to flooding attacks.

         Client                                               Server
         ------                                               ------
         ClientHello                 -------->

                                     <--------    HelloVerifyRequest
                                                   (contains cookie)

         ClientHello                  -------->
         (with cookie)
                                      <--------      ServerHelloDone
         Finished                     -------->
                                      <--------             Finished

         Application Data             <------->     Application Data


   * indicates an optional message payload

      Figure 8: DTLS PSK Authentication Including the Cookie Exchange

   Note that [RFC4279] used the term "PSK identity" to refer to the
   identifier used to refer to the appropriate secret.  While
   "identifier" would be more appropriate in this context, we reuse the
   terminology defined in RFC 4279 to avoid confusion.  RFC 4279 does
   not mandate the use of any particular type of PSK identity, and the
   client and server have to agree on the identities and keys to be
   used.  The UTF-8 encoding of identities described in Section 5.1 of
   RFC 4279 aims to improve interoperability for those cases where the
   identity is configured by a human using some management interface
Top   ToC   Page 24
   provided by a web browser.  However, many IoT devices do not have a
   user interface, and most of their credentials are bound to the device
   rather than to the user.  Furthermore, credentials are often
   provisioned into hardware modules or provisioned alongside with
   firmware.  As such, the encoding considerations are not applicable to
   this usage environment.  For use with this profile, the PSK
   identities SHOULD NOT assume a structured format (such as domain
   names, distinguished names, or IP addresses), and a byte-by-byte
   comparison operation MUST be used by the server for any operation
   related to the PSK identity.  These types of identifiers are called
   "absolute" per RFC 6943 [RFC6943].

   Protocol-wise, the client indicates which key it uses by including a
   "PSK identity" in the ClientKeyExchange message.  As described in
   Section 3.2, clients may have multiple pre-shared keys with a single
   server, for example, in a hosting context.  The TLS Server Name
   Indication (SNI) extension allows the client to convey the name of
   the server it is contacting.  A server implementation needs to guide
   the selection based on a received SNI value from the client.

   RFC 4279 requires TLS implementations supporting PSK ciphersuites to
   support arbitrary PSK identities up to 128 octets in length and
   arbitrary PSKs up to 64 octets in length.  This is a useful
   assumption for TLS stacks used in the desktop and mobile environments
   where management interfaces are used to provision identities and
   keys.  Implementations in compliance with this profile MAY use PSK
   identities up to 128 octets in length and arbitrary PSKs up to 64
   octets in length.  The use of shorter PSK identities is RECOMMENDED.

   "The Constrained Application Protocol (CoAP)" [RFC7252] currently
   specifies TLS_PSK_WITH_AES_128_CCM_8 as the mandatory-to-implement
   ciphersuite for use with shared secrets.  This ciphersuite uses the
   AES algorithm with 128 bit keys and CCM as the mode of operation.
   The label "_8" indicates that an 8-octet authentication tag is used.
   Note that the shorted authentication tag increases the chance that an
   adversary with no knowledge of the secret key can present a message
   with a MAC that will pass the verification procedure.  The likelihood
   of accepting forged data is explained in Section 5.3.5 of
   [SP800-107-rev1] and depends on the lengths of the authentication tag
   and allowed numbers of MAC verifications using a given key.

   This ciphersuite makes use of the default TLS 1.2 PRF, which uses an
   HMAC with the SHA-256 hash function.  Note: Starting with TLS 1.2
   (and consequently DTLS 1.2), ciphersuites have to specify the PRF.
   RFC 5246 states that "New cipher suites MUST explicitly specify a PRF
   and, in general, SHOULD use the TLS PRF with SHA-256 or a stronger
   standard hash function."  The ciphersuites recommended in this
   document use the SHA-256 construct defined in Section 5 of RFC 5246.
Top   ToC   Page 25
   A device compliant with the profile in this section MUST implement
   TLS_PSK_WITH_AES_128_CCM_8 and follow the guidance from this section.

4.3.  Raw Public Key

   The use of raw public keys with TLS/DTLS, as defined in [RFC7250], is
   the first entry point into public key cryptography without having to
   pay the price of certificates and a public key infrastructure (PKI).
   The specification reuses the existing Certificate message to convey
   the raw public key encoded in the SubjectPublicKeyInfo structure.  To
   indicate support, two new extensions had been defined, as shown in
   Figure 9, namely the server_certificate_type and the

    Client                                          Server
    ------                                          ------

    ClientHello             -------->

                            <--------      ServerHelloDone

    Finished                -------->

                            <--------             Finished

   Note: Extensions marked with "#" were introduced with
         RFC 7250.

                  Figure 9: DTLS Raw Public Key Exchange

   The CoAP-recommended ciphersuite for use with this credential type is
   ciphersuite based on elliptic curve cryptography (ECC) uses the
   Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) as the key
   establishment mechanism and an Elliptic Curve Digital Signature
Top   ToC   Page 26
   Algorithm (ECDSA) for authentication.  The named DH groups
   [FFDHE-TLS] are not applicable to this profile since it relies on the
   ECC-based counterparts.  This ciphersuite makes use of the AEAD
   capability in DTLS 1.2 and utilizes an 8-octet authentication tag.
   The use of a DH key exchange provides perfect forward secrecy (PFS).
   More details about PFS can be found in Section 9.

   [RFC6090] provides valuable information for implementing ECC
   algorithms, particularly for choosing methods that have been
   available in the literature for a long time (i.e., 20 years and

   A device compliant with the profile in this section MUST implement
   TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
Top   ToC   Page 27
4.4.  Certificates

   The use of mutual certificate-based authentication is shown in
   Figure 10, which makes use of the "cached_info" extension [RFC7924].
   Support of the "cached_info" extension is REQUIRED.  Caching
   certificate chains allows the client to reduce the communication
   overhead significantly, otherwise the server would provide the end-
   entity certificate and the certificate chain with every full DTLS

    Client                                          Server
    ------                                          ------

    ClientHello             -------->

                            <--------      ServerHelloDone

    Finished                -------->

                            <--------             Finished

   Note: Extensions marked with "*" were introduced with
         RFC 7924.

          Figure 10: DTLS Mutual Certificate-Based Authentication

   TLS/DTLS offers a lot of choices when selecting ECC-based
   ciphersuites.  This document restricts the use to named curves
   defined in RFC 4492 [RFC4492].  At the time of writing, the
   recommended curve is secp256r1, and the use of uncompressed points
   follows the recommendation in CoAP.  Note that standardization for
   Curve25519 (for ECDHE) is ongoing (see [RFC7748]), and support for
   this curve will likely be required in the future.

   A device compliant with the profile in this section MUST implement
   TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and follow the guidance from this
Top   ToC   Page 28
4.4.1.  Certificates Used by Servers

   The algorithm for verifying the service identity, as described in RFC
   6125 [RFC6125], is essential for ensuring proper security when
   certificates are used.  As a summary, the algorithm contains the
   following steps:

   1.  The client constructs a list of acceptable reference identifiers
       based on the source domain and, optionally, the type of service
       to which the client is connecting.

   2.  The server provides its identifiers in the form of a PKIX

   3.  The client checks each of its reference identifiers against the
       presented identifiers for the purpose of finding a match.

   4.  When checking a reference identifier against a presented
       identifier, the client matches the source domain of the
       identifiers and, optionally, their application service type.

   For various terms used in the algorithm shown above, consult RFC
   6125.  It is important to highlight that comparing the reference
   identifier against the presented identifier obtained from the
   certificate is required to ensure the client is communicating with
   the intended server.

   It is worth noting that the algorithm description and the text in RFC
   6125 assumes that fully qualified DNS domain names are used.  If a
   server node is provisioned with a fully qualified DNS domain, then
   the server certificate MUST contain the fully qualified DNS domain
   name or "FQDN" as dNSName [RFC5280].  For CoAP, the coaps URI scheme
   is described in Section 6.2 of [RFC7252].  This FQDN is stored in the
   SubjectAltName or in the leftmost Common Name (CN) component of the
   subject name, as explained in Section of [RFC7252], and used
   by the client to match it against the FQDN used during the lookup
   process, as described in [RFC6125].  For other protocols, the
   appropriate URI scheme specification has to be consulted.

   The following recommendation is provided:

   1.  Certificates MUST NOT use DNS domain names in the CN of
       certificates and instead use the subjectAltName attribute, as
       described in the previous paragraph.

   2.  Certificates MUST NOT contain domain names with wildcard
Top   ToC   Page 29
   3.  Certificates MUST NOT contain multiple names (e.g., more than one
       dNSName field).

   Note that there will be servers that are not provisioned for use with
   DNS domain names, for example, IoT devices that offer resources to
   nearby devices in a local area network, as shown in Figure 7.  When
   such constrained servers are used, then the use of certificates as
   described in Section 4.4.2 is applicable.  Note that the SNI
   extension cannot be used in this case since SNI does not offer the
   ability to convey a 64-bit Extended Unique Identifier (EUI-64)
   [EUI64].  Note that this document does not recommend use of IP
   addresses in certificates nor does it discuss the implications of
   placing IP addresses in certificates.

4.4.2.  Certificates Used by Clients

   For client certificates, the identifier used in the SubjectAltName or
   in the leftmost CN component of subject name MUST be an EUI-64.

4.4.3.  Certificate Revocation

   For certificate revocation, neither the Online Certificate Status
   Protocol (OCSP) nor Certificate Revocation Lists (CRLs) are used.
   Instead, this profile relies on a software update mechanism to
   provision information about revoked certificates.  While multiple
   OCSP stapling [RFC6961] has recently been introduced as a mechanism
   to piggyback OCSP request/responses inside the DTLS/TLS handshake (to
   avoid the cost of a separate protocol handshake), further
   investigations are needed to determine its suitability for the IoT

   As stated earlier in this section, modifications to the trust anchor
   store depends on a software update mechanism as well.  There are
   limitations to the use of a software update mechanism because of the
   potential inability to change certain types of keys, such as those
   provisioned during manufacturing.  For this reason, manufacturer-
   provisioned credentials are typically employed only to obtain further
   certificates (for example, via a key distribution server) for use
   with servers the IoT device is finally communicating with.

4.4.4.  Certificate Content

   All certificate elements listed in Table 1 MUST be implemented by
   clients and servers claiming support for certificate-based
   authentication.  No other certificate elements are used by this
Top   ToC   Page 30
   When using certificates, IoT devices MUST provide support for a
   server certificate chain of at least 3, not including the trust
   anchor, and MAY reject connections from servers offering chains
   longer than 3.  IoT devices MAY have client certificate chains of any
   length.  Obviously, longer chains require more digital signature
   verification operations to perform and lead to larger certificate
   messages in the TLS handshake.

   Table 1 provides a summary of the elements in a certificate for use
   with this profile.

   |       Element        |                   Notes                    |
   |       version        |  This profile uses X.509 v3 certificates   |
   |                      |                 [RFC5280].                 |
   |                      |                                            |
   |     serialNumber     |  Positive integer unique per certificate.  |
   |                      |                                            |
   |      signature       |     This field contains the signature      |
   |                      |  algorithm, and this profile uses ecdsa-   |
   |                      |     with-SHA256 or stronger [RFC5758].     |
   |                      |                                            |
   |        issuer        |     Contains the DN of the issuing CA.     |
   |                      |                                            |
   |       validity       | Values expressed as UTC time in notBefore  |
   |                      |  and notAfter fields.  No validity period  |
   |                      |                 mandated.                  |
   |                      |                                            |
   |       subject        |    See rules outlined in this section.     |
   |                      |                                            |
   | subjectPublicKeyInfo |     The SubjectPublicKeyInfo structure     |
   |                      | indicates the algorithm and any associated |
   |                      |  parameters for the ECC public key.  This  |
   |                      | profile uses the id-ecPublicKey algorithm  |
   |                      |  identifier for ECDSA signature keys, as   |
   |                      |    defined and specified in [RFC5480].     |
   |                      |                                            |
   |  signatureAlgorithm  | The ECDSA signature algorithm with ecdsa-  |
   |                      |          with-SHA256 or stronger.          |
   |                      |                                            |
   |    signatureValue    |     Bit string containing the digital      |
   |                      |                 signature.                 |
   |                      |                                            |
Top   ToC   Page 31
   |      Extension:      |    See rules outlined in this section.     |
   |    subjectAltName    |                                            |
   |                      |                                            |
   |      Extension:      |    Indicates whether the subject of the    |
   |   BasicConstraints   | certificate is a CA and the maximum depth  |
   |                      | of valid certification paths that include  |
   |                      | this certificate.  This extension is used  |
   |                      |  for CA certs only, and then the value of  |
   |                      |    the "cA" field is set to TRUE.  The     |
   |                      |             default is FALSE.              |
   |                      |                                            |
   | Extension: Key Usage | The KeyUsage field MAY have the following  |
   |                      |   values in the context of this profile:   |
   |                      |     digitalSignature or keyAgreement,      |
   |                      |  keyCertSign for verifying signatures on   |
   |                      |          public key certificates.          |
   |                      |                                            |
   | Extension: Extended  |  The ExtKeyUsageSyntax field MAY have the  |
   |      Key Usage       |    following values in context of this     |
   |                      |    profile: id-kp-serverAuth for server    |
   |                      |    authentication, id-kp-clientAuth for    |
   |                      |  client authentication, id-kp-codeSigning  |
   |                      |   for code signing (for software update    |
   |                      |   mechanism), and id-kp-OCSPSigning for    |
   |                      |         future OCSP usage in TLS.          |

                       Table 1: Certificate Content

   There are various cryptographic algorithms available to sign digital
   certificates; those algorithms include RSA, the Digital Signature
   Algorithm (DSA), and ECDSA.  As Table 1 shows, certificates are
   signed using ECDSA in this profile.  This is not only true for the
   end-entity certificates but also for all other certificates in the
   chain, including CA certificates.  This profiling reduces the amount
   of flash memory needed on an IoT device to store the code of several
   algorithm implementations due to the smaller number of options.

   Further details about X.509 certificates can be found in
   Section of [RFC7252].

4.4.5.  Client Certificate URLs

   RFC 6066 [RFC6066] allows the sending of client-side certificates to
   be avoided and uses URLs instead.  This reduces the over-the-air
   transmission.  Note that the TLS "cached_info" extension does not
   provide any help with caching client certificates.
Top   ToC   Page 32
   TLS/DTLS clients MUST implement support for client certificate URLs
   for those environments where client-side certificates are used and
   the server-side is not constrained.  For constrained servers this
   functionality is NOT RECOMMENDED since it forces the server to
   execute an additional protocol exchange, potentially using a protocol
   it does not even support.  The use of this extension also increases
   the risk of a DoS attack against the constrained server due to the
   additional workload.

4.4.6.  Trusted CA Indication

   RFC 6066 [RFC6066] allows clients to indicate what trust anchor they
   support.  With certificate-based authentication, a DTLS server
   conveys its end-entity certificate to the client during the DTLS
   handshake.  Since the server does not necessarily know what trust
   anchors the client has stored, to facilitate certification path
   construction and validation, it includes intermediate CA certs in the
   certificate payload.

   Today, in most IoT deployments there is a fairly static relationship
   between the IoT device (and the software running on them) and the
   server-side infrastructure.  For these deployments where IoT devices
   interact with a fixed, preconfigured set of servers, this extension

   In cases where clients interact with dynamically discovered TLS/DTLS
   servers, for example, in the use cases described in Section 3.2.2,
   the use of this extension is RECOMMENDED.

5.  Signature Algorithm Extension

   The "signature_algorithms" extension, defined in Section of
   RFC 5246 [RFC5246], allows the client to indicate to the server which
   signature/hash algorithm pairs may be used in digital signatures.
   The client MUST send this extension to select the use of SHA-256,
   otherwise if this extension is absent, RFC 5246 defaults to SHA-1 /
   ECDSA for the ECDH_ECDSA and the ECDHE_ECDSA key exchange algorithms.

   The "signature_algorithms" extension is not applicable to the PSK-
   based ciphersuite described in Section 4.2.

6.  Error Handling

   TLS/DTLS uses the alert protocol to convey errors and specifies a
   long list of error types.  However, not all error messages defined in
   the TLS/DTLS specification are applicable to this profile.  In
   general, there are two categories of errors (as defined in
   Section 7.2 of RFC 5246), namely fatal errors and warnings.  Alert
Top   ToC   Page 33
   messages with a level of "fatal" result in the immediate termination
   of the connection.  If possible, developers should try to develop
   strategies to react to those fatal errors, such as restarting the
   handshake or informing the user using the (often limited) user
   interface.  Warnings may be ignored by the application since many IoT
   devices will have either limited ways to log errors or no ability at
   all.  In any case, implementers have to carefully evaluate the impact
   of errors and ways to remedy the situation since a commonly used
   approach for delegating decision making to users is difficult (or
   impossible) to accomplish in a timely fashion.

   All error messages marked as RESERVED are only supported for
   backwards compatibility with the Secure Socket Layer (SSL) and MUST
   NOT be used with this profile.  Those include
   decryption_failed_RESERVED, no_certificate_RESERVED, and

   A number of the error messages MUST only be used for certificate-
   based ciphersuites.  Hence, the following error messages MUST NOT be
   used with PSK and raw public key authentication:

   o  bad_certificate,

   o  unsupported_certificate,

   o  certificate_revoked,

   o  certificate_expired,

   o  certificate_unknown,

   o  unknown_ca, and

   o  access_denied.

   Since this profile does not make use of compression at the TLS layer,
   the decompression_failure error message MUST NOT be used either.

   RFC 4279 introduced the new alert message "unknown_psk_identity" for
   PSK ciphersuites.  As stated in Section 2 of RFC 4279, the
   decrypt_error error message may also be used instead.  For this
   profile, the TLS server MUST return the decrypt_error error message
   instead of the unknown_psk_identity since the two mechanisms exist
   and provide the same functionality.
Top   ToC   Page 34
   Furthermore, the following errors should not occur with devices and
   servers supporting this specification, but implementations MUST be
   prepared to process these errors to deal with servers that are not
   compliant to the profiles in this document:

   protocol_version:  While this document focuses only on one version of
      the TLS/DTLS protocol, namely version 1.2, ongoing work on TLS/
      DTLS 1.3 is in progress at the time of writing.

   insufficient_security:  This error message indicates that the server
      requires ciphers to be more secure.  This document specifies only
      one ciphersuite per profile, but it is likely that additional
      ciphersuites will get added over time.

   user_canceled:  Many IoT devices are unattended and hence this error
      message is unlikely to occur.

7.  Session Resumption

   Session resumption is a feature of the core TLS/DTLS specifications
   that allows a client to continue with an earlier established session
   state.  The resulting exchange is shown in Figure 11.  In addition,
   the server may choose not to do a cookie exchange when a session is
   resumed.  Still, clients have to be prepared to do a cookie exchange
   with every handshake.  The cookie exchange is not shown in the

         Client                                               Server
         ------                                               ------

         ClientHello                   -------->
                                       <--------             Finished
         Finished                      -------->
         Application Data              <------->     Application Data

                    Figure 11: DTLS Session Resumption

   Constrained clients MUST implement session resumption to improve the
   performance of the handshake.  This will lead to a reduced number of
   message exchanges, lower computational overhead (since only symmetric
   cryptography is used during a session resumption exchange), and
   session resumption requires less bandwidth.

   For cases where the server is constrained (but not the client), the
   client MUST implement RFC 5077 [RFC5077].  Note that the constrained
Top   ToC   Page 35
   server refers to a device that has limitations in terms of RAM and
   flash memory, which place restrictions on the amount of TLS/DTLS
   security state information that can be stored on such a device.  RFC
   5077 specifies a version of TLS/DTLS session resumption that does not
   require per-session state information to be maintained by the
   constrained server.  This is accomplished by using a ticket-based

   If both the client and the server are constrained devices, both
   devices SHOULD implement RFC 5077 and MUST implement basic session
   resumption.  Clients that do not want to use session resumption are
   always able to send a ClientHello message with an empty session_id to
   revert to a full handshake.

8.  Compression

   Section 3.3 of [RFC7525] recommends disabling TLS-/DTLS-level
   compression due to attacks, such as CRIME [CRIME].  For IoT
   applications, compression at the TLS/DTLS layer is not needed since
   application-layer protocols are highly optimized, and the compression
   algorithms at the DTLS layer increases code size and complexity.

   TLS/DTLS layer compression is NOT RECOMMENDED by this TLS/DTLS

9.  Perfect Forward Secrecy

   PFS is a property that preserves the confidentiality of past protocol
   interactions even in situations where the long-term secret is

   The PSK ciphersuite recommended in Section 4.2 does not offer this
   property since it does not utilize a DH exchange.  New ciphersuites
   that support PFS for PSK-based authentication, such as proposed in
   [PSK-AES-CCM-TLS], might become available as a standardized
   ciphersuite in the (near) future.  The recommended PSK-based
   ciphersuite offers excellent performance, a very small memory
   footprint, and has the lowest on the wire overhead at the expense of
   not using any public cryptography.  For deployments where public key
   cryptography is acceptable, the use of raw public keys might offer a
   middle ground between the PSK ciphersuite in terms of out-of-band
   validation and the functionality offered by asymmetric cryptography.

   Physical attacks create additional opportunities to gain access to
   the crypto material stored on IoT devices.  A PFS ciphersuite
   prevents an attacker from obtaining the communication content
   exchanged prior to a successful long-term key compromise; however, an
   implementation that (for performance or energy efficiency reasons)
Top   ToC   Page 36
   has been reusing the same ephemeral DH keys over multiple different
   sessions partially defeats PFS, thus increasing the damage extent.
   For this reason, implementations SHOULD NOT reuse ephemeral DH keys
   over multiple protocol exchanges.

   The impact of the disclosure of past communication interactions and
   the desire to increase the cost for pervasive monitoring (as demanded
   by [RFC7258]) has to be taken into account when selecting a
   ciphersuite that does not support the PFS property.

   Client implementations claiming support of this profile MUST
   implement the ciphersuites listed in Section 4 according to the
   selected credential type.

10.  Keep-Alive

   Application-layer communication may create state at the endpoints,
   and this state may expire at some time.  For this reason,
   applications define ways to refresh state, if necessary.  While the
   application-layer exchanges are largely outside the scope of the
   underlying TLS/DTLS exchange, similar state considerations also play
   a role at the level of TLS/DTLS.  While TLS/DTLS also creates state
   in the form of a security context (see the security parameter
   described in Appendix A.6 in RFC 5246) at the client and the server,
   this state information does not expire.  However, network
   intermediaries may also allocate state and require this state to be
   kept alive.  Failure to keep state alive at a stateful packet
   filtering firewall or at a NAT may result in the inability for one
   node to reach the other since packets will get blocked by these
   middleboxes.  Periodic keep-alive messages exchanged between the TLS/
   DTLS client and server keep state at these middleboxes alive.
   According to measurements described in [HomeGateway], there is some
   variance in state management practices used in residential gateways,
   but the timeouts are heavily impacted by the choice of the transport-
   layer protocol: timeouts for UDP are typically much shorter than
   those for TCP.

   RFC 6520 [RFC6520] defines a heartbeat mechanism to test whether the
   other peer is still alive.  As an additional feature, the same
   mechanism can also be used to perform Path Maximum Transmission Unit
   (MTU) Discovery.

   A recommendation about the use of RFC 6520 depends on the type of
   message exchange an IoT device performs and the number of messages
   the application needs to exchange as part of their application
   functionality.  There are three types of exchanges that need to be
Top   ToC   Page 37
   Client-Initiated, One-Shot Messages

      This is a common communication pattern where IoT devices upload
      data to a server on the Internet on an irregular basis.  The
      communication may be triggered by specific events, such as opening
      a door.

      The DTLS handshake may need to be restarted (ideally using session
      resumption, if possible) in case of an IP address change.

      In this case, there is no use for a keep-alive extension for this

   Client-Initiated, Regular Data Uploads

      This is a variation of the previous case whereby data gets
      uploaded on a regular basis, for example, based on frequent
      temperature readings.  If neither NAT bindings nor IP address
      changes occurred, then the record layer will not notice any
      changes.  For the case where the IP address and port number
      changes, it is necessary to recreate the record layer using
      session resumption.

      In this scenario, there is no use for a keep-alive extension.  It
      is also very likely that the device will enter a sleep cycle in
      between data transmissions to keep power consumption low.

   Server-Initiated Messages

      In the two previous scenarios, the client initiates the protocol
      interaction and maintains it.  Since messages to the client may
      get blocked by middleboxes, the initial connection setup is
      triggered by the client and then kept alive by the server.

      For this message exchange pattern, the use of DTLS heartbeat
      messages is quite useful but may have to be coordinated with
      application exchanges (for example, when the CoAP resource
      directory is used) to avoid redundant keep-alive message
      exchanges.  The MTU discovery mechanism, which is also part of
      [RFC6520], is less likely to be relevant since for many IoT
      deployments, the most constrained link is the wireless interface
      between the IoT device and the network itself (rather than some
      links along the end-to-end path).  Only in more complex network
      topologies, such as multi-hop mesh networks, path MTU discovery
      might be appropriate.  It also has to be noted that DTLS itself
      already provides a basic path discovery mechanism (see
      Section of RFC 6347) by using the fragmentation capability
      of the handshake protocol.
Top   ToC   Page 38
   For server-initiated messages, the heartbeat extension is

11.  Timeouts

   A variety of wired and wireless technologies are available to connect
   devices to the Internet.  Many of the low-power radio technologies,
   such as IEEE 802.15.4 or Bluetooth Smart, only support small frame
   sizes (e.g., 127 bytes in case of IEEE 802.15.4 as explained in
   [RFC4919]).  Other radio technologies, such as the Global System for
   Mobile Communications (GSM) using the short messaging service (SMS),
   have similar constraints in terms of payload sizes, such as 140 bytes
   without the optional segmentation and reassembly scheme known as
   "Concatenated SMS", but show higher latency.

   The DTLS handshake protocol adds a fragmentation and reassembly
   mechanism to the TLS handshake protocol since each DTLS record must
   fit within a single transport layer datagram, as described in
   Section 4.2.3 of [RFC6347].  Since handshake messages are potentially
   bigger than the maximum record size, the mechanism fragments a
   handshake message over a number of DTLS records, each of which can be
   transmitted separately.

   To deal with the unreliable message delivery provided by UDP, DTLS
   adds timeouts and "per-flight" retransmissions, as described in
   Section 4.2.4 of [RFC6347].  Although the timeout values are
   implementation specific, recommendations are provided in
   Section of [RFC6347], with an initial timer value of 1 second
   and double the value at each retransmission, up to no less than 60

   TLS protocol steps can take longer due to higher processing time on
   the constrained side.  On the other hand, the way DTLS handles
   retransmission, which is per-flight instead of per-segment, tends to
   interact poorly with low-bandwidth networks.

   For these reasons, it's essential that the probability of a spurious
   retransmit is minimized and, on timeout, the sending endpoint does
   not react too aggressively.  The latter is particularly relevant when
   the Wireless Sensor Network (WSN) is temporarily congested: if lost
   packets are reinjected too quickly, congestion worsens.

   An initial timer value of 9 seconds with exponential back off up to
   no less then 60 seconds is therefore RECOMMENDED.

   This value is chosen big enough to absorb large latency variance due
   to either slow computation on constrained endpoints or intrinsic
   network characteristics (e.g., GSM-SMS), as well as to produce a low
Top   ToC   Page 39
   number of retransmission events and relax the pacing between them.
   Its worst case wait time is the same as using 1s timeout (i.e., 63s),
   while triggering less than half of the retransmissions (2 instead of

   In order to minimize the wake time during DTLS handshake, sleepy
   nodes might decide to select a lower threshold and, consequently, a
   smaller initial timeout value.  If this is the case, the
   implementation MUST keep into account the considerations about
   network stability described in this section.

12.  Random Number Generation

   The TLS/DTLS protocol requires random numbers to be available during
   the protocol run.  For example, during the ClientHello and the
   ServerHello exchange, the client and the server exchange random
   numbers.  Also, the use of the DH exchange requires random numbers
   during the key pair generation.

   It is important to note that sources contributing to the randomness
   pool on laptops or desktop PCs are not available on many IoT devices,
   such as mouse movement, timing of keystrokes, air turbulence on the
   movement of hard drive heads, etc.  Other sources have to be found or
   dedicated hardware has to be added.

   Lacking sources of randomness in an embedded system may lead to the
   same keys generated again and again.

   The ClientHello and the ServerHello messages contain the "Random"
   structure, which has two components: gmt_unix_time and a sequence of
   28 random bytes. gmt_unix_time holds the current time and date in
   standard UNIX 32-bit format (seconds since the midnight starting Jan
   1, 1970, GMT).  Since many IoT devices do not have access to an
   accurate clock, it is RECOMMENDED that the receiver of a ClientHello
   or ServerHello does not assume that the value in
   "Random.gmt_unix_time" is an accurate representation of the current
   time and instead treats it as an opaque random string.

   When TLS is used with certificate-based authentication, the
   availability of time information is needed to check the validity of a
   certificate.  Higher-layer protocols may provide secure time
   information.  The gmt_unix_time component of the ServerHello is not
   used for this purpose.

   IoT devices using TLS/DTLS must offer ways to generate quality random
   numbers.  There are various implementation choices for integrating a
   hardware-based random number generator into a product: an
   implementation inside the microcontroller itself is one option, but
Top   ToC   Page 40
   dedicated crypto chips are also reasonable choices.  The best choice
   will depend on various factors outside the scope of this document.
   Guidelines and requirements for random number generation can be found
   in RFC 4086 [RFC4086] and in the NIST Special Publication 800-90a

   Chip manufacturers are highly encouraged to provide sufficient
   documentation of their design for random number generators so that
   customers can have confidence about the quality of the generated
   random numbers.  The confidence can be increased by providing
   information about the procedures that have been used to verify the
   randomness of numbers generated by the hardware modules.  For
   example, NIST Special Publication 800-22b [SP800-22b] describes
   statistical tests that can be used to verify random number

13.  Truncated MAC and Encrypt-then-MAC Extension

   The truncated MAC extension was introduced in RFC 6066 [RFC6066] with
   the goal to reduce the size of the MAC used at the record layer.
   This extension was developed for TLS ciphersuites that used older
   modes of operation where the MAC and the encryption operation were
   performed independently.

   The recommended ciphersuites in this document use the newer AEAD
   construct, namely the CCM mode with 8-octet authentication tags, and
   are therefore not applicable to the truncated MAC extension.

   RFC 7366 [RFC7366] introduced the encrypt-then-MAC extension (instead
   of the previously used MAC-then-encrypt) since the MAC-then-encrypt
   mechanism has been the subject of a number of security
   vulnerabilities.  RFC 7366 is, however, also not applicable to the
   AEAD ciphers recommended in this document.

   Implementations conformant to this specification MUST use AEAD
   ciphers.  RFC 7366 ("encrypt-then-MAC") and RFC 6066 ("truncated MAC
   extension") are not applicable to this specification and MUST NOT be

14.  Server Name Indication (SNI)

   The SNI extension [RFC6066] defines a mechanism for a client to tell
   a TLS/DTLS server the name of the server it wants to contact.  This
   is a useful extension for many hosting environments where multiple
   virtual servers are run on a single IP address.
Top   ToC   Page 41
   Implementing the Server Name Indication extension is REQUIRED unless
   it is known that a TLS/DTLS client does not interact with a server in
   a hosting environment.

15.  Maximum Fragment Length Negotiation

   This RFC 6066 extension lowers the maximum fragment length support
   needed for the record layer from 2^14 bytes to 2^9 bytes.

   This is a very useful extension that allows the client to indicate to
   the server how much maximum memory buffers it uses for incoming
   messages.  Ultimately, the main benefit of this extension is to allow
   client implementations to lower their RAM requirements since the
   client does not need to accept packets of large size (such as 16K
   packets as required by plain TLS/DTLS).

   Client implementations MUST support this extension.

16.  Session Hash

   In order to begin connection protection, the Record Protocol requires
   specification of a suite of algorithms, a master secret, and the
   client and server random values.  The algorithm for computing the
   master secret is defined in Section 8.1 of RFC 5246, but it only
   includes a small number of parameters exchanged during the handshake
   and does not include parameters like the client and server
   identities.  This can be utilized by an attacker to mount a
   man-in-the-middle attack since the master secret is not guaranteed to
   be unique across sessions, as discovered in the "triple handshake"
   attack [Triple-HS].

   [RFC7627] defines a TLS extension that binds the master secret to a
   log of the full handshake that computes it, thus preventing such

   Client implementations SHOULD implement this extension even though
   the ciphersuites recommended by this profile are not vulnerable to
   this attack.  For DH-based ciphersuites, the keying material is
   contributed by both parties and in case of the pre-shared secret key
   ciphersuite, both parties need to be in possession of the shared
   secret to ensure that the handshake completes successfully.  It is,
   however, possible that some application-layer protocols will tunnel
   other authentication protocols on top of DTLS making this attack
   relevant again.