Subject: [core] TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8

From: Carsten Bormann <[email-masked]>
Date: Thu, 25 Apr 2013 14:53:52 +0200

All,

can you give me a quick status about how far we got with interop-testing TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8?
(I'm interested both specifically in conjunction with CoAP/DTLS and about that cipher suite in general.)

Grüße, Carsten

---

From: Zach Shelby <[email-masked]>
Date: Thu, 25 Apr 2013 17:03:16 +0300

> (I'm interested both specifically in conjunction with CoAP/DTLS and about that cipher suite in general.)

ZigBee IP uses this same cipher suite with TLS, and that has been through a long period of interop and conformance testing. Just recently a bunch of vendors completed the first ZigBee IP certification. So definitely working there.

Zach

-- 
Zach Shelby, Chief Nerd, Sensinode Ltd.
http://www.sensinode.com @SensinodeIoT
Mobile: +358 40 7796297
Twitter: @zach_shelby
LinkedIn: http://fi.linkedin.com/in/zachshelby
6LoWPAN Book: http://6lowpan.net

---

From: Don Sturek <[email-masked]>
Date: Thu, 25 Apr 2013 07:35:15 -0700

To back up what Zach mentioned, we have the following companies who
completed ZigBee IP certification using TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8.

Here is a note on the specification which is now available publicly:
http://www.greentechmedia.com/articles/read/zigbees-ipv6-compatible-spec-go
es-live

Five companies completed the first round of ZigBee IP certification,
including:   Texas Instruments, Sensinode, Grid2Home, Exegin, and Silicon
Labs.

Additionally, for SEP 2.0 (the application portion residing over ZigBee
IP), we will use the same cipher suite for HTTPS/TLS.   There are
currently around 10 companies involved in interoperability testing (some
of the same companies as for ZigBee IP plus some additional end product,
Wi-Fi and HomePlug companies)

Don

On 4/25/13 7:03 AM, "Zach Shelby" <[email-masked]> wrote:

>> can you give me a quick status about how far we got with
>>interop-testing TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8?
>ZigBee IP uses this same cipher suite with TLS, and that has been through
>a long period of interop and conformance testing. Just recently a bunch
>of vendors completed the first ZigBee IP certification. So definitely
>working there.
>
>Zach
>
>-- 
>_______________________________________________
>core mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/core

---

From: "Kovatsch Matthias" <[email-masked]>
Date: Fri, 26 Apr 2013 13:43:05 +0000

> that cipher suite in general.)

Californium has a full CoAPS implementation (PSK, ECDHE, RawPublicKeys, Certificates):
https://github.com/mkovatsc/Californium

We had DTLS interops with Bremen (TinyDTLS), SICS (JCoAP + own DTLS), and Silicon Labs (own DTLS, unknown CoAP).
PSK worked with all of them.
ECDHE was tested successfully with SICS and Silicon Labs.
Mutual Authentication was working with SICS.
Fragmentation and RawPublicKeys could not be tested for interoperability with others so far, but it works with Californium only nodes.

Everything to the best of my knowledge of course. There might be more implementations I am not aware of.

Ciao
Matthias

---

From: Hauke Mehrtens <[email-masked]>
Date: Fri, 26 Apr 2013 17:48:06 +0200

> Everything to the best of my knowledge of course. There might be more implementations I am not aware of.

As already discussed off list I am currently working on adding support
for TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 and RawPublicKeys to TinyDTLS. I
got an initial handshake with Californium working, currently I
implemented the minimal feature set to do so, ECDSA signature generation
and verification is still missing.

Californium currently just supports RawPublicKeys in draft version 06,
but the current version is 07 and there are incompatible changes between
these versions in the client and server hello extensions.

Hauke