draft-ietf-uta-tls13-iot-profile-02.txt   draft-ietf-uta-tls13-iot-profile-03.txt 
UTA H. Tschofenig UTA H. Tschofenig
Internet-Draft T. Fossati Internet-Draft T. Fossati
Updates: 7925 (if approved) Arm Limited Updates: 7925 (if approved) Arm Limited
Intended status: Standards Track 12 July 2021 Intended status: Standards Track 25 October 2021
Expires: 13 January 2022 Expires: 28 April 2022
TLS/DTLS 1.3 Profiles for the Internet of Things TLS/DTLS 1.3 Profiles for the Internet of Things
draft-ietf-uta-tls13-iot-profile-02 draft-ietf-uta-tls13-iot-profile-03
Abstract Abstract
This document is a companion to RFC 7925 and defines TLS/DTLS 1.3 This document is a companion to RFC 7925 and defines TLS/DTLS 1.3
profiles for Internet of Things devices. It also updates RFC 7925 profiles for Internet of Things devices. It also updates RFC 7925
with regards to the X.509 certificate profile. with regards to the X.509 certificate profile.
Discussion Venues Discussion Venues
This note is to be removed before publishing as an RFC. This note is to be removed before publishing as an RFC.
skipping to change at page 1, line 40 skipping to change at page 1, line 40
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/. Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on 13 January 2022. This Internet-Draft will expire on 28 April 2022.
Copyright Notice Copyright Notice
Copyright (c) 2021 IETF Trust and the persons identified as the Copyright (c) 2021 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/ Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document. license-info) in effect on the date of publication of this document.
skipping to change at page 2, line 42 skipping to change at page 2, line 42
15.1.3. Signature . . . . . . . . . . . . . . . . . . . . . 7 15.1.3. Signature . . . . . . . . . . . . . . . . . . . . . 7
15.1.4. Issuer . . . . . . . . . . . . . . . . . . . . . . . 7 15.1.4. Issuer . . . . . . . . . . . . . . . . . . . . . . . 7
15.1.5. Validity . . . . . . . . . . . . . . . . . . . . . 7 15.1.5. Validity . . . . . . . . . . . . . . . . . . . . . 7
15.1.6. subjectPublicKeyInfo . . . . . . . . . . . . . . . 8 15.1.6. subjectPublicKeyInfo . . . . . . . . . . . . . . . 8
15.2. Root CA Certificate . . . . . . . . . . . . . . . . . . 8 15.2. Root CA Certificate . . . . . . . . . . . . . . . . . . 8
15.3. Intermediate CA Certificate . . . . . . . . . . . . . . 8 15.3. Intermediate CA Certificate . . . . . . . . . . . . . . 8
15.4. End Entity Certificate . . . . . . . . . . . . . . . . . 8 15.4. End Entity Certificate . . . . . . . . . . . . . . . . . 8
15.4.1. Client Certificate Subject . . . . . . . . . . . . . 9 15.4.1. Client Certificate Subject . . . . . . . . . . . . . 9
16. Certificate Revocation Checks . . . . . . . . . . . . . . . . 9 16. Certificate Revocation Checks . . . . . . . . . . . . . . . . 9
17. Certificate Overhead . . . . . . . . . . . . . . . . . . . . 9 17. Certificate Overhead . . . . . . . . . . . . . . . . . . . . 9
17.1. Open Issues . . . . . . . . . . . . . . . . . . . . . . 10 18. Ciphersuites . . . . . . . . . . . . . . . . . . . . . . . . 10
18. Security Considerations . . . . . . . . . . . . . . . . . . . 10 19. Open Issues . . . . . . . . . . . . . . . . . . . . . . . . . 10
19. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10 20. Security Considerations . . . . . . . . . . . . . . . . . . . 10
20. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 21. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10
21. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 22. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11
21.1. Normative References . . . . . . . . . . . . . . . . . . 11 23. References . . . . . . . . . . . . . . . . . . . . . . . . . 11
21.2. Informative References . . . . . . . . . . . . . . . . . 12 23.1. Normative References . . . . . . . . . . . . . . . . . . 11
23.2. Informative References . . . . . . . . . . . . . . . . . 12
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 14
1. Introduction 1. Introduction
This document defines a profile of DTLS 1.3 [I-D.ietf-tls-dtls13] and This document defines a profile of DTLS 1.3 [I-D.ietf-tls-dtls13] and
TLS 1.3 [RFC8446] that offers communication security services for IoT TLS 1.3 [RFC8446] that offers communication security services for IoT
applications and is reasonably implementable on many constrained applications and is reasonably implementable on many constrained
devices. Profile thereby means that available configuration options devices. Profile thereby means that available configuration options
and protocol extensions are utilized to best support the IoT and protocol extensions are utilized to best support the IoT
environment. environment.
skipping to change at page 8, line 51 skipping to change at page 8, line 51
* extendedKeyUsage MUST NOT be present. * extendedKeyUsage MUST NOT be present.
15.4. End Entity Certificate 15.4. End Entity Certificate
* extendedKeyUsage MUST be present and contain at least one of id- * extendedKeyUsage MUST be present and contain at least one of id-
kp-serverAuth or id-kp-clientAuth. kp-serverAuth or id-kp-clientAuth.
* keyUsage MAY be present and contain one of digitalSignature or * keyUsage MAY be present and contain one of digitalSignature or
keyAgreement. keyAgreement.
* Domain names MUST NOT be encoded in the subject commonName, * Domain names MUST NOT be encoded in the subject commonName,
instead they MUST be encoded in a subjectAltName of type DNS-ID. instead they MUST be encoded in a subjectAltName of type DNS-ID.
Domain names MUST NOT contain wildcard ("*") characters. Domain names MUST NOT contain wildcard (*) characters.
subjectAltName MUST NOT contain multiple names. subjectAltName MUST NOT contain multiple names.
15.4.1. Client Certificate Subject 15.4.1. Client Certificate Subject
The requirement in Section 4.4.2 of [RFC7925] to only use EUI-64 for The requirement in Section 4.4.2 of [RFC7925] to only use EUI-64 for
client certificates is lifted. client certificates is lifted.
If the EUI-64 format is used to identify the subject of a client If the EUI-64 format is used to identify the subject of a client
certificate, it MUST be encoded in a subjectAltName of type DNS-ID as certificate, it MUST be encoded in a subjectAltName of type DNS-ID as
a string of the form "HH-HH-HH-HH-HH-HH-HH-HH" where 'H' is one of a string of the form HH-HH-HH-HH-HH-HH-HH-HH where 'H' is one of the
the symbols '0'-'9' or 'A'-'F'. symbols '0'-'9' or 'A'-'F'.
16. Certificate Revocation Checks 16. Certificate Revocation Checks
The considerations in Section 4.4.3 of [RFC7925] hold. The considerations in Section 4.4.3 of [RFC7925] hold.
Since the publication of RFC 7925 the need for firmware update Since the publication of RFC 7925 the need for firmware update
mechanisms has been reinforced and the work on standardizing a secure mechanisms has been reinforced and the work on standardizing a secure
and interoperable firmware update mechanism has made substantial and interoperable firmware update mechanism has made substantial
progress, see [I-D.ietf-suit-architecture]. RFC 7925 recommends to progress, see [I-D.ietf-suit-architecture]. RFC 7925 recommends to
use a software / firmware update mechanism to provision devices with use a software / firmware update mechanism to provision devices with
skipping to change at page 10, line 34 skipping to change at page 10, line 34
The use of certificate handles, as introduced in cTLS The use of certificate handles, as introduced in cTLS
[I-D.ietf-tls-ctls], is a form of caching or compressing certificates [I-D.ietf-tls-ctls], is a form of caching or compressing certificates
as well. as well.
Whether to utilize any of the above extensions or a combination of Whether to utilize any of the above extensions or a combination of
them depends on the anticipated deployment environment, the them depends on the anticipated deployment environment, the
availability of code, and the constraints imposed by already deployed availability of code, and the constraints imposed by already deployed
infrastructure (e.g., CA infrastructure, tool support). infrastructure (e.g., CA infrastructure, tool support).
17.1. Open Issues 18. Ciphersuites
// As soon as the ongoing discussion around CCM_8 deprecation
// settles, provide summary and capture the consensus.
19. Open Issues
A list of open issues can be found at https://github.com/thomas- A list of open issues can be found at https://github.com/thomas-
fossati/draft-tls13-iot/issues fossati/draft-tls13-iot/issues
18. Security Considerations 20. Security Considerations
This entire document is about security. This entire document is about security.
19. Acknowledgements 21. Acknowledgements
We would like to thank Ben Kaduk and John Mattsson. We would like to thank Ben Kaduk and John Mattsson.
20. IANA Considerations 22. IANA Considerations
IANA is asked to add the Option defined in Figure 2 to the CoAP IANA is asked to add the Option defined in Figure 2 to the CoAP
Option Numbers registry. Option Numbers registry.
+--------+------------+-----------+ +--------+------------+-----------+
| Number | Name | Reference | | Number | Name | Reference |
+--------+------------+-----------+ +--------+------------+-----------+
| TBD | Early-Data | RFCThis | | TBD | Early-Data | RFCThis |
+--------+------------+-----------+ +--------+------------+-----------+
skipping to change at page 11, line 24 skipping to change at page 11, line 29
CoAP Response Code registry. CoAP Response Code registry.
+--------+-------------+-----------+ +--------+-------------+-----------+
| Code | Description | Reference | | Code | Description | Reference |
+--------+-------------+-----------+ +--------+-------------+-----------+
| 4.25 | Too Early | RFCThis | | 4.25 | Too Early | RFCThis |
+--------+-------------+-----------+ +--------+-------------+-----------+
Figure 3: Too Early Response Code Figure 3: Too Early Response Code
21. References 23. References
21.1. Normative References 23.1. Normative References
[I-D.ietf-tls-dtls13] [I-D.ietf-tls-dtls13]
Rescorla, E., Tschofenig, H., and N. Modadugu, "The Rescorla, E., Tschofenig, H., and N. Modadugu, "The
Datagram Transport Layer Security (DTLS) Protocol Version Datagram Transport Layer Security (DTLS) Protocol Version
1.3", Work in Progress, Internet-Draft, draft-ietf-tls- 1.3", Work in Progress, Internet-Draft, draft-ietf-tls-
dtls13-43, 30 April 2021, dtls13-43, 30 April 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-tls- <https://datatracker.ietf.org/doc/html/draft-ietf-tls-
dtls13-43>. dtls13-43>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
skipping to change at page 12, line 33 skipping to change at page 12, line 38
<https://www.rfc-editor.org/rfc/rfc8446>. <https://www.rfc-editor.org/rfc/rfc8446>.
[RFC8449] Thomson, M., "Record Size Limit Extension for TLS", [RFC8449] Thomson, M., "Record Size Limit Extension for TLS",
RFC 8449, DOI 10.17487/RFC8449, August 2018, RFC 8449, DOI 10.17487/RFC8449, August 2018,
<https://www.rfc-editor.org/rfc/rfc8449>. <https://www.rfc-editor.org/rfc/rfc8449>.
[RFC8470] Thomson, M., Nottingham, M., and W. Tarreau, "Using Early [RFC8470] Thomson, M., Nottingham, M., and W. Tarreau, "Using Early
Data in HTTP", RFC 8470, DOI 10.17487/RFC8470, September Data in HTTP", RFC 8470, DOI 10.17487/RFC8470, September
2018, <https://www.rfc-editor.org/rfc/rfc8470>. 2018, <https://www.rfc-editor.org/rfc/rfc8470>.
21.2. Informative References 23.2. Informative References
[I-D.ietf-cose-cbor-encoded-cert] [I-D.ietf-cose-cbor-encoded-cert]
Raza, S., Höglund, J., Selander, G., Mattsson, J. P., and Mattsson, J. P., Selander, G., Raza, S., Höglund, J., and
M. Furuhed, "CBOR Encoded X.509 Certificates (C509 M. Furuhed, "CBOR Encoded X.509 Certificates (C509
Certificates)", Work in Progress, Internet-Draft, draft- Certificates)", Work in Progress, Internet-Draft, draft-
ietf-cose-cbor-encoded-cert-01, 25 May 2021, ietf-cose-cbor-encoded-cert-02, 12 July 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-cose- <https://datatracker.ietf.org/doc/html/draft-ietf-cose-
cbor-encoded-cert-01>. cbor-encoded-cert-02>.
[I-D.ietf-suit-architecture] [I-D.ietf-suit-architecture]
Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A Moran, B., Tschofenig, H., Brown, D., and M. Meriac, "A
Firmware Update Architecture for Internet of Things", Work Firmware Update Architecture for Internet of Things", Work
in Progress, Internet-Draft, draft-ietf-suit-architecture- in Progress, Internet-Draft, draft-ietf-suit-architecture-
16, 27 January 2021, 16, 27 January 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-suit- <https://datatracker.ietf.org/doc/html/draft-ietf-suit-
architecture-16>. architecture-16>.
[I-D.ietf-tls-certificate-compression] [I-D.ietf-tls-certificate-compression]
Ghedini, A. and V. Vasiliev, "TLS Certificate Ghedini, A. and V. Vasiliev, "TLS Certificate
Compression", Work in Progress, Internet-Draft, draft- Compression", Work in Progress, Internet-Draft, draft-
ietf-tls-certificate-compression-10, 6 January 2020, ietf-tls-certificate-compression-10, 6 January 2020,
<https://datatracker.ietf.org/doc/html/draft-ietf-tls- <https://datatracker.ietf.org/doc/html/draft-ietf-tls-
certificate-compression-10>. certificate-compression-10>.
[I-D.ietf-tls-ctls] [I-D.ietf-tls-ctls]
Rescorla, E., Barnes, R., and H. Tschofenig, "Compact TLS Rescorla, E., Barnes, R., and H. Tschofenig, "Compact TLS
1.3", Work in Progress, Internet-Draft, draft-ietf-tls- 1.3", Work in Progress, Internet-Draft, draft-ietf-tls-
ctls-02, 5 May 2021, ctls-04, 25 October 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-tls- <https://datatracker.ietf.org/doc/html/draft-ietf-tls-
ctls-02>. ctls-04>.
[I-D.ietf-tls-dtls-connection-id] [I-D.ietf-tls-dtls-connection-id]
Rescorla, E., Tschofenig, H., Fossati, T., and A. Kraus, Rescorla, E., Tschofenig, H., Fossati, T., and A. Kraus,
"Connection Identifiers for DTLS 1.2", Work in Progress, "Connection Identifiers for DTLS 1.2", Work in Progress,
Internet-Draft, draft-ietf-tls-dtls-connection-id-13, 22 Internet-Draft, draft-ietf-tls-dtls-connection-id-13, 22
June 2021, <https://datatracker.ietf.org/doc/html/draft- June 2021, <https://datatracker.ietf.org/doc/html/draft-
ietf-tls-dtls-connection-id-13>. ietf-tls-dtls-connection-id-13>.
[I-D.ietf-tls-esni] [I-D.ietf-tls-esni]
Rescorla, E., Oku, K., Sullivan, N., and C. A. Wood, "TLS Rescorla, E., Oku, K., Sullivan, N., and C. A. Wood, "TLS
Encrypted Client Hello", Work in Progress, Internet-Draft, Encrypted Client Hello", Work in Progress, Internet-Draft,
draft-ietf-tls-esni-12, 7 July 2021, draft-ietf-tls-esni-13, 12 August 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-tls- <https://datatracker.ietf.org/doc/html/draft-ietf-tls-
esni-12>. esni-13>.
[I-D.ietf-uta-rfc7525bis] [I-D.ietf-uta-rfc7525bis]
Sheffer, Y., Holz, R., Saint-Andre, P., and T. Fossati, Sheffer, Y., Holz, R., Saint-Andre, P., and T. Fossati,
"Recommendations for Secure Use of Transport Layer "Recommendations for Secure Use of Transport Layer
Security (TLS) and Datagram Transport Layer Security Security (TLS) and Datagram Transport Layer Security
(DTLS)", Work in Progress, Internet-Draft, draft-ietf-uta- (DTLS)", Work in Progress, Internet-Draft, draft-ietf-uta-
rfc7525bis-01, 7 July 2021, rfc7525bis-03, 25 October 2021,
<https://datatracker.ietf.org/doc/html/draft-ietf-uta- <https://datatracker.ietf.org/doc/html/draft-ietf-uta-
rfc7525bis-01>. rfc7525bis-03>.
[I-D.irtf-cfrg-hpke] [I-D.irtf-cfrg-hpke]
Barnes, R. L., Bhargavan, K., Lipp, B., and C. A. Wood, Barnes, R. L., Bhargavan, K., Lipp, B., and C. A. Wood,
"Hybrid Public Key Encryption", Work in Progress, "Hybrid Public Key Encryption", Work in Progress,
Internet-Draft, draft-irtf-cfrg-hpke-10, 7 July 2021, Internet-Draft, draft-irtf-cfrg-hpke-12, 2 September 2021,
<https://datatracker.ietf.org/doc/html/draft-irtf-cfrg- <https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-
hpke-10>. hpke-12>.
[RFC6066] Eastlake 3rd, D., "Transport Layer Security (TLS) [RFC6066] Eastlake 3rd, D., "Transport Layer Security (TLS)
Extensions: Extension Definitions", RFC 6066, Extensions: Extension Definitions", RFC 6066,
DOI 10.17487/RFC6066, January 2011, DOI 10.17487/RFC6066, January 2011,
<https://www.rfc-editor.org/rfc/rfc6066>. <https://www.rfc-editor.org/rfc/rfc6066>.
[RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J., [RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J.,
Weiler, S., and T. Kivinen, "Using Raw Public Keys in Weiler, S., and T. Kivinen, "Using Raw Public Keys in
Transport Layer Security (TLS) and Datagram Transport Transport Layer Security (TLS) and Datagram Transport
Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250, Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250,
 End of changes. 24 change blocks. 
32 lines changed or deleted 38 lines changed or added

This html diff was produced by rfcdiff 1.48. The latest version is available from http://tools.ietf.org/tools/rfcdiff/