From nobody Mon Jan 19 11:46:17 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 89F191B2C18; Mon, 19 Jan 2015 11:46:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YAkdU1XeKTx9; Mon, 19 Jan 2015 11:46:14 -0800 (PST) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A1671B2ACE; Mon, 19 Jan 2015 11:46:14 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.10.0.p8 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150119194614.11907.75300.idtracker@ietfa.amsl.com> Date: Mon, 19 Jan 2015 11:46:14 -0800 Archived-At: Cc: dtls-iot@ietf.org Subject: [Dtls-iot] I-D Action: draft-ietf-dice-profile-09.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Jan 2015 19:46:15 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DTLS In Constrained Environments Working Group of the IETF. Title : A TLS/DTLS 1.2 Profile for the Internet of Things Authors : Hannes Tschofenig Thomas Fossati Filename : draft-ietf-dice-profile-09.txt Pages : 51 Date : 2015-01-19 Abstract: A common design pattern in Internet of Things (IoT) deployments is the use of a constrained device (typically providing sensor data) that makes data available for home automation, industrial control systems, smart cities and other IoT deployments. This document defines a Transport Layer Security (TLS) and Datagram TLS 1.2 profile that offers communications security for this data exchange thereby preventing eavesdropping, tampering, and message forgery. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dice-profile/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-dice-profile-09 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-dice-profile-09 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Jan 19 11:56:14 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4C301B2C11 for ; Mon, 19 Jan 2015 11:56:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SNx0jRB2yt9o for ; Mon, 19 Jan 2015 11:56:10 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC5621B2B2D for ; Mon, 19 Jan 2015 11:56:09 -0800 (PST) Received: from [192.168.131.150] ([80.92.115.149]) by mail.gmx.com (mrgmx002) with ESMTPSA (Nemesis) id 0Lvl0u-1XfGNn1IeC-017RNY for ; Mon, 19 Jan 2015 20:56:07 +0100 Message-ID: <54BD6150.8010904@gmx.net> Date: Mon, 19 Jan 2015 20:56:00 +0100 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0 MIME-Version: 1.0 To: "dtls-iot@ietf.org" OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="BFlRnFhI8Gta4gTJdvQGuHwPCJVBqLuvc" X-Provags-ID: V03:K0:vIFSbJ5XH8pGrBsoh46232WdJejRh8abir19WUqXcTGj6ZInN9G tEWsqBO7RejvEosVrUfmtx+X7mnk2WEslJANHPdaZ1W0i0ZYYH8Cpr+x0LkvyjKzIuc6knC GP7qV8ESzP60LsLHZazKCHGXxSEq3mvyKfGUqriT2O2lIzvcYDg6pdu6SF3kXN583m5gSwP /UTJk/QxID466kw4o0pEA== X-UI-Out-Filterresults: notjunk:1; Archived-At: Subject: [Dtls-iot] draft-ietf-dice-profile-09.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Jan 2015 19:56:12 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --BFlRnFhI8Gta4gTJdvQGuHwPCJVBqLuvc Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, we have just submitted version -09 of the profile document. Here are the changes with this version: * Added two figures to the constrained server section (as requested by Akbar in his review). * Corrected figure showing DTLS Mutual Certificate-based Authentication. The TLS cached info payloads were incorrect. * Added table with description regarding the certificate content. Note: Currently we state that all elements in the table are MTI. * Added clarification regarding Client Certificate URLs when used with constrained servers. * Added clarification regarding Trusted CA Indication when used with constrained servers. * Added notes for chip manufacturers regarding hardware-based random number generators. Included references to two NIST specifications (NIST SP 800-22b and 800-90a). * Added a reference to the OMA LWM2M spec in the security consideration section with regards to a suitable software update mechanism. * Included reference to the ACE working group. We asked the chairs to issue another working group last call due to the changes the document has experienced since the last working group last call. Ciao Hannes & Thomas --BFlRnFhI8Gta4gTJdvQGuHwPCJVBqLuvc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJUvWFQAAoJEGhJURNOOiAtcjgIAJNipaqi0A3J5yKOOdGqfxpC fEBeL5CtUzfhQiNBnZ/5kz6m8QlOJ3mwuBSdTvNI9J5ewqiZ+47Jl3N8DuY2rBA9 R3hpFBGjWvcWMBndp9ljmzOjOZYjb1LdjDIbe56/aB3DHEf7lKgIOTP/nX9QfEHX Ayvlm0V+7y4d2hStPRoTIy3jkNa1wog7gqHGPlBgZ+vqSMcXY3PMbXBU7OGLbgvU K+qQmdE2KQCdbrI0q3VzmjK4ZW2ZDuEMksf15j59TAHFB5lXOl5M/EpiZmnOMt7D wQl9UUXIj2iXZ6fY5yl1NCK+kRemA4x7rORTGoqeqD2t7YXVcyroiyG7rs3UhA0= =Xj6b -----END PGP SIGNATURE----- --BFlRnFhI8Gta4gTJdvQGuHwPCJVBqLuvc-- From nobody Mon Jan 19 16:57:43 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07BFB1ACDEB for ; Mon, 19 Jan 2015 16:57:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IYzBlPIszZIk for ; Mon, 19 Jan 2015 16:57:40 -0800 (PST) Received: from mail-we0-x236.google.com (mail-we0-x236.google.com [IPv6:2a00:1450:400c:c03::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28D121A90D9 for ; Mon, 19 Jan 2015 16:57:40 -0800 (PST) Received: by mail-we0-f182.google.com with SMTP id l61so9092820wev.13 for ; Mon, 19 Jan 2015 16:57:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=references:from:mime-version:in-reply-to:date:message-id:subject:to :cc:content-type; bh=pHLEOhCBaj2Ej7OtUxYJ/fmLEH/VgTBXTkoanECJ1no=; b=s1cuw8RJuB5tsR3Hr5TUjhPVnr0bXseMkjcToE4R2VzpFqiC6jPIJtTNvHSUlKMFbD 4U1JGBtjZOTk15M6GHPNeM3LQLPnGdyGp5gvpJZX71+XnX86C2B6ZGJdrCSwFExnZ8X9 4lrXn3hcfX23SSybTgdeMeLYTNi4zCNNBmxecNoYB1JcfCKEja74Fv1r3g0DY5U7sVP1 y2iZgYGpu2oUe3iPjz7+/J9xQEInL/WH1kfWIofHuANw3zJz7Vhuwzw/wdQYyEyfBma8 P+NImiD1cbr0FIox1wcO+wiHwIfNhbUmsF2qJmM8IlIFt0sul5VQlELYe08ySqUSe8vv 0fWg== X-Received: by 10.194.5.37 with SMTP id p5mr67573871wjp.20.1421715458953; Mon, 19 Jan 2015 16:57:38 -0800 (PST) References: <54BD6150.8010904@gmx.net> From: Dorothy Gellert Mime-Version: 1.0 (1.0) In-Reply-To: <54BD6150.8010904@gmx.net> Date: Mon, 19 Jan 2015 16:57:36 -0800 Message-ID: <230184888506540814@unknownmsgid> To: Hannes Tschofenig Content-Type: text/plain; charset=UTF-8 Archived-At: Cc: "dtls-iot@ietf.org" Subject: Re: [Dtls-iot] draft-ietf-dice-profile-09.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Jan 2015 00:57:42 -0000 Hi Hannes- Thanks for the new revision. Let's let this version soak for a bit with the WG before we issue a LC. We had a good number of issue last time during the 3 week WGLC and want to make sure we have time to shake out all the issues. Dorothy > On Jan 19, 2015, at 11:56, Hannes Tschofenig wrote: > > Hi all, > > we have just submitted version -09 of the profile document. > > Here are the changes with this version: > > * Added two figures to the constrained server section > (as requested by Akbar in his review). > > * Corrected figure showing DTLS Mutual Certificate-based > Authentication. The TLS cached info payloads were incorrect. > > * Added table with description regarding the certificate content. > Note: Currently we state that all elements in the table are MTI. > > * Added clarification regarding Client Certificate URLs > when used with constrained servers. > > * Added clarification regarding Trusted CA Indication > when used with constrained servers. > > * Added notes for chip manufacturers regarding hardware-based > random number generators. Included references to two NIST > specifications (NIST SP 800-22b and 800-90a). > > * Added a reference to the OMA LWM2M spec in the security > consideration section with regards to a suitable software > update mechanism. > > * Included reference to the ACE working group. > > We asked the chairs to issue another working group last call due to the > changes the document has experienced since the last working group last > call. > > Ciao > Hannes & Thomas > > _______________________________________________ > dtls-iot mailing list > dtls-iot@ietf.org > https://www.ietf.org/mailman/listinfo/dtls-iot From nobody Mon Jan 26 00:32:42 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 005781A876E for ; Mon, 26 Jan 2015 00:32:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PBDLkwz9Kbtk for ; Mon, 26 Jan 2015 00:32:39 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 107291A876D for ; Mon, 26 Jan 2015 00:32:39 -0800 (PST) Received: from [192.168.131.152] ([80.92.115.149]) by mail.gmx.com (mrgmx101) with ESMTPSA (Nemesis) id 0M7TQZ-1XSDXn2pXT-00xKeF; Mon, 26 Jan 2015 09:32:37 +0100 Message-ID: <54C5FBA0.3080507@gmx.net> Date: Mon, 26 Jan 2015 09:32:32 +0100 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Dorothy Gellert References: <54BD6150.8010904@gmx.net> <230184888506540814@unknownmsgid> In-Reply-To: <230184888506540814@unknownmsgid> OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hsnqo3K21C5umOP0Lrx5ilscAOwvCc1tT" X-Provags-ID: V03:K0:pwrWiP1A6Vhrp+BEoBqWondnvhvMpOYs6gI5n+U9XJWOEeLseZ1 RUiAueRvxiA6NbE5si7Lgat6/G/Yp+nCL1MQDh7DgETCVsLSSka3jv8cEt/3dUFLJVJeKF1 w9bVlqoHLv84M23uyZSc3LOyFM5yRJcv0nWneiP9VJlcc19UPzzz00f3dKIK+pEuCH58Spk IzUFfVb5Ux8lIsPL7tDxA== X-UI-Out-Filterresults: notjunk:1; Archived-At: Cc: "dtls-iot@ietf.org" Subject: Re: [Dtls-iot] draft-ietf-dice-profile-09.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Jan 2015 08:32:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hsnqo3K21C5umOP0Lrx5ilscAOwvCc1tT Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Dorothy, I believe at this point in time we are looking for reviewers who can figure out whether there are things missing and to find bugs. Whether these reviews happen as part of the ordinary working group process or as part of a WGLC does not really matter that much. I personally prefer WGLCs since they put a clear deadline to reviews. In any case, I could imagine that the following persons could provide valuable review feedback: * Akbar (on the constrained server message exchange, particularly Section 4.2) * Olaf & Matthias (on the details of DTLS since they have implementation experience with DTLS) * Matthias, Carsten, Ludwig, and Michael (as proponents for adding the constrained servers scenario, which lead changes throughout the document)= * Sandeep (since he had various detailed comments on the document) * Rene, John Mattsson, and Russ (since they provided feedback on the use of the AES-CCM / AES-GCM cipher discussion) The tracker does not yet indicate who the document shepherd is going to be. Obviously, the shepherd will also have to review the document now. Here is the template for the write-up: http://www.ietf.org/iesg/template/doc-writeup-qa-style.html Ciao Hannes On 01/20/2015 01:57 AM, Dorothy Gellert wrote: > Hi Hannes- >=20 > Thanks for the new revision. > Let's let this version soak for a bit with the WG before we issue a > LC. We had a good number of issue last time during the 3 week WGLC > and want to make sure we have time to shake out all the issues. >=20 >=20 >=20 > Dorothy >=20 >> On Jan 19, 2015, at 11:56, Hannes Tschofenig wrote: >> >> Hi all, >> >> we have just submitted version -09 of the profile document. >> >> Here are the changes with this version: >> >> * Added two figures to the constrained server section >> (as requested by Akbar in his review). >> >> * Corrected figure showing DTLS Mutual Certificate-based >> Authentication. The TLS cached info payloads were incorrect. >> >> * Added table with description regarding the certificate content. >> Note: Currently we state that all elements in the table are MTI. >> >> * Added clarification regarding Client Certificate URLs >> when used with constrained servers. >> >> * Added clarification regarding Trusted CA Indication >> when used with constrained servers. >> >> * Added notes for chip manufacturers regarding hardware-based >> random number generators. Included references to two NIST >> specifications (NIST SP 800-22b and 800-90a). >> >> * Added a reference to the OMA LWM2M spec in the security >> consideration section with regards to a suitable software >> update mechanism. >> >> * Included reference to the ACE working group. >> >> We asked the chairs to issue another working group last call due to th= e >> changes the document has experienced since the last working group last= >> call. >> >> Ciao >> Hannes & Thomas >> >> _______________________________________________ >> dtls-iot mailing list >> dtls-iot@ietf.org >> https://www.ietf.org/mailman/listinfo/dtls-iot --hsnqo3K21C5umOP0Lrx5ilscAOwvCc1tT Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJUxfugAAoJEGhJURNOOiAtPf4IAJ3jc65fJwCUfWbLcM1UEIxD Xh0kNFkYBuatq6k/yc7De2kdi87GfyhCQI5uQWdtgSrwhhiKb77+eUx5CtS7pbRL DyMiS7emz7MsMpxJi8KRy6LxBgE2hdbQ/Rz51GkoDIYaMRM4YDeccFGQ2zoOPj6G EOMvY2j0GIngrKs8U/K0h4Befg2cvlPImsf8b/WuFz7676x/wl7W39GJowbFBhQR hxuxsiGbZ7skZQ7+JG7iNpaRrSNm4SvClzrS2lbJ0bvOCDluw/Qrq07ysYvSqeMo UZjVKMHQ6MfSqUhkykHD5E0hvrgC2Euahl1t7KZjBx95mOqg1hCXej0NKIOGCQM= =wgY2 -----END PGP SIGNATURE----- --hsnqo3K21C5umOP0Lrx5ilscAOwvCc1tT-- From nobody Mon Jan 26 02:24:20 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3F34B1A88A6 for ; Mon, 26 Jan 2015 02:24:19 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qVDR9UgI4j9r for ; Mon, 26 Jan 2015 02:24:17 -0800 (PST) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 17D671A88A8 for ; Mon, 26 Jan 2015 02:24:17 -0800 (PST) Received: from [192.168.131.152] ([80.92.115.149]) by mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0LoKHN-1XnUhD3gfR-00gIeR for ; Mon, 26 Jan 2015 11:24:15 +0100 Message-ID: <54C615B0.8040008@gmx.net> Date: Mon, 26 Jan 2015 11:23:44 +0100 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: "dtls-iot@ietf.org" OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="NV0dcdVDQsTP8hj5dm4umps8EkdWBI6Rt" X-Provags-ID: V03:K0:WMgqj6pi3One9X7I89Q1D7E2J+nJs2uAfwIJCJ4PlYHZorGaCS2 548U+fxnvqjWFWjyqDOC9yryRY+75gauTidH5NHXY0Z+BN0vWsdTc6U+Ng2/BPOrmj6Yvnp dtD7RnHtA9HB9s+YyKvGtgOuA4uxkXx2XGBQn3k7X4E1GKvC54HetR7GIObqnjn/CpIG+r+ edE0/W5D6K/EedXLn922g== X-UI-Out-Filterresults: notjunk:1; Archived-At: Subject: [Dtls-iot] TLS Cached Info: Input from this group X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Jan 2015 10:24:19 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NV0dcdVDQsTP8hj5dm4umps8EkdWBI6Rt Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, after making progress with the profile document I am trying to finalize the work on the TLS cached info document (which is also referenced in the profile document, btw). Let me start with a short reminder about the purpose of the TLS cached info document. The TLS cached info document introduces an extension that allows the two parties to cache information from earlier exchanges with the benefit of saving bandwidth in future exchanges. This works well with information that is fairly static, such as information inside the Certificate and the CertificateRequest message. I have gotten good review comments last year from the TLS working group and I have subsequently updated the draft again. Here is the most recent version of the document: https://github.com/hannestschofenig/tschofenig-ids/blob/master/tls-cached= -info/draft-ietf-tls-cached-info-18.txt Version -18 of the document allows omitting of the Certificate, CertificateRequest, and the CertificateStatus message. As the example in Appendix A shows this provides good optimization capabilities even for the most basic case (where only the Certificate and the CertificateRequest messages are omitted, ECC-keys are used, and no intermediate CA certificates are exchanged, i.e., only end-entity certificates are exchanged between the two parties). The exchange works roughly as follows: * Client computes a fingerprint of the Certificate message provided by the server in an earlier exchange by computing a SHA-256 hash over the entire Certificate message. * Client conveys this fingerprint in the ClientHello message (within the cached-info extension). * Server looks at it and compares it with hash of the Certificate message it would send. If they match, then the client has the most recent version and the server omits sending that Certificate message to the client. Although OCSP isn't used in the constrained client-to-cloud interaction it serves as a future extensibility option. Hence, it is included in the document now as well. Some review comments, however, raised the question whether transmission of the client certificate could also be omitted (when it is cached by the server). With the initial focus on the constrained client-to-server use case in mind this was not really necessary since another extension, the Certificate URL extension, allows the server to find the client certificate via the indicated URL. However, in the meanwhile we have expanded the document to also include the peer-to-peer case and the use of Certificate URLs is not such a great idea when you are dealing with constrained servers. Hence, I wanted to introduce the ability to cache client certificates as well. Here is how this could work. * Client indicates support of server-side caching of certificates via a new type in the cached-info extension. It conveys the fingerprint of the Certificate message it would send. The client may have more than one certificate but in the IoT case this is rather rare. So, we are talking about a single fingerprint for the entire Certificate message. * Server knows whether client authentication is needed and, if so, looks at the cache. It puts the fingerprint in the cached-info extension (to indicate to the client what certificate to select). It also sends a CertificateRequest message (unless that message is omitted due to the use of another cached-info type). * Client omits sending the Certificate message based on the message from the server. In an alternative design one could send one fingerprint for reach certificate (rather than for the entire certificate message altogether). This would be more flexible but leads to a more complex specification. Any thoughts? Ciao Hannes --NV0dcdVDQsTP8hj5dm4umps8EkdWBI6Rt Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJUxhWwAAoJEGhJURNOOiAtJ1MH/RKhZX/zDpaNoC5eSadeFLdr wg4BkMhtSDAPq0ly33DL66FYKT3RUieYLIBpv/g5D9u9b8h/vfV3mTQh88k/D4q9 MAwTPj6FP5BdAHgb7BCcUMXGkFxax4JrTUpFrswcDNkLCZxamlOXRArn3TPVLolO C84i7WrmFVL0BVVzq2ZsT1uwLeejyWmSm10GpgTQRlDnj8PsC9n8nCNg6p1H4NVb WgGjnJkBD/tt2b7zRY4DnRR72+t2w11emS1uTawk8+tQbViO22lQ5B/C++D4MM/m syvaQFG44CHEYsqTQhYluOyax393tkbGC7kSGEaoxwhYnioI8pWzXnl8EldoUrM= =ot9J -----END PGP SIGNATURE----- --NV0dcdVDQsTP8hj5dm4umps8EkdWBI6Rt-- From nobody Mon Jan 26 05:28:26 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD4C11A8A90 for ; Mon, 26 Jan 2015 05:28:23 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id djkDnb4qhIuf for ; Mon, 26 Jan 2015 05:28:21 -0800 (PST) Received: from service88.mimecast.com (service88.mimecast.com [195.130.217.12]) by ietfa.amsl.com (Postfix) with ESMTP id 1B2E91A8A81 for ; Mon, 26 Jan 2015 05:28:17 -0800 (PST) Received: from USA-SJC-GW2.usa.Arm.com (fw-tnat.snv.arm.com [217.140.100.22]) (Using TLS) by service88.mimecast.com; Mon, 26 Jan 2015 13:28:16 +0000 Received: from Spock.usa.Arm.com ([fe80::4116:859a:65b1:2f84]) by USA-SJC-GW2.usa.Arm.com ([::1]) with mapi; Mon, 26 Jan 2015 05:28:14 -0800 From: Zach Shelby To: "dtls-iot@ietf.org" Date: Mon, 26 Jan 2015 05:28:12 -0800 Thread-Topic: 2nd WGLC on draft-ietf-dice-profile, ending Feb 6th Thread-Index: AdA5a+8tM72XhEoEQqO7kFSQa2axNw== Message-ID: <258751E5-69DB-4787-A7EE-B6C955225AA4@arm.com> Accept-Language: en-US, en-GB Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US, en-GB MIME-Version: 1.0 X-MC-Unique: 115012613281603302 Content-Type: multipart/alternative; boundary="_000_258751E569DB4787A7EEB6C955225AA4armcom_" Archived-At: Subject: [Dtls-iot] 2nd WGLC on draft-ietf-dice-profile, ending Feb 6th X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Jan 2015 13:28:24 -0000 --_000_258751E569DB4787A7EEB6C955225AA4armcom_ Content-Type: text/plain; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable This mail kicks off a 2nd WGLC for our DTLS profile draft: https://tools.ietf.org/html/draft-ietf-dice-profile-09 This WGLC will end of Friday, Feb 6th, 2015. Please send your reviews to th= is mailing list. The authors have identified some key reviewers, in additio= n to those that volunteered in Honolulu. Thanks! Zach & Dorothy -- IMPORTANT NOTICE: The contents of this email and any attachments are con= fidential and may also be privileged. If you are not the intended recipient= , please notify the sender immediately and do not disclose the contents to = any other person, use it for any purpose, or store or copy the information = in any medium. Thank you. ARM Limited, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, Regist= ered in England & Wales, Company No: 2557590 ARM Holdings plc, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, R= egistered in England & Wales, Company No: 2548782 --_000_258751E569DB4787A7EEB6C955225AA4armcom_ Content-Type: text/html; charset=WINDOWS-1252 Content-Transfer-Encoding: quoted-printable
This mail kicks off a 2nd WGLC for our DTLS profile draft:


This WGLC will end of Friday, Feb 6th, 2015. Please send your reviews = to this mailing list. The authors have identified some key reviewers, in ad= dition to those that volunteered in Honolulu.

Thanks!
Zach & Dorothy



-- IMPORTANT NOTICE: The co= ntents of this email and any attachments are confidential and may also be p= rivileged. If you are not the intended recipient, please notify the sender = immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the informat= ion in any medium. Thank you.

ARM Limited, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, Regist= ered in England & Wales, Company No: 2557590
ARM Holdings plc, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, R= egistered in England & Wales, Company No: 2548782
 --_000_258751E569DB4787A7EEB6C955225AA4armcom_--