From nobody Wed May 27 08:55:18 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0CB81A009E for ; Wed, 27 May 2015 08:55:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.011 X-Spam-Level: X-Spam-Status: No, score=-0.011 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uRAsz1wyZP2b for ; Wed, 27 May 2015 08:55:14 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AF9F31A0025 for ; Wed, 27 May 2015 08:55:13 -0700 (PDT) Received: from [192.168.131.131] ([80.92.115.230]) by mail.gmx.com (mrgmx001) with ESMTPSA (Nemesis) id 0Ln8Tl-1ZbwA70dnZ-00hRFi; Wed, 27 May 2015 17:55:10 +0200 Message-ID: <5565E8DA.7060207@gmx.net> Date: Wed, 27 May 2015 17:55:06 +0200 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Derek Atkins References: <55196612.9060004@gmx.net> In-Reply-To: OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="6so4UtRA2fqE4NaTnGhCaDdJs3fLjScdV" X-Provags-ID: V03:K0:iv9pm8hXa61bW7S0sMVqZC0tT05iVTGugV8fM73qA0Fi3IwPzK4 8Zo/D+6qsuiX8hnE/mSDVvTOh/y/cM6VW/tIKW1Anw1ExTIdkUk6aaii6pUvjYkX+kJFFom JmtVpZM7BVpdThCvPMGKGdGWd1q1yvcuh5HCL/srEdutTS9gGczhPf5eKIezbeyGN6LKp9/ MgwyUI8YTg13iBU1ngvCQ== X-UI-Out-Filterresults: notjunk:1; Archived-At: Cc: "dtls-iot@ietf.org" Subject: Re: [Dtls-iot] Certificate Profiling X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 May 2015 15:55:16 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6so4UtRA2fqE4NaTnGhCaDdJs3fLjScdV Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Derek, I added text to take your comment into account. Here is the new text: " TLS/DTLS offers a lot of freedom for the use with ECC. This document restricts the use of ECC ciphersuites to named curves defined in RFC 4492 [RFC4492]. At the time of writing the recommended curve is secp256r1 and the use of uncompressed points to follow the recommendation in CoAP. Note that standardization for Curve25519 (for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for this curve will likely be required in the future. To offer elliptic- curve signatures using the Edwards-curve Digital Signature Algorithm (EdDSA) standardization work on Ed25519 is also ongoing (see [I-D.josefsson-eddsa-ed25519]). " Ciao Hannes On 04/01/2015 10:17 PM, Derek Atkins wrote: > Hannes Tschofenig writes: >=20 >> Hi all, >> >> Section 6.3 of draft-ietf-dice-profile-10 discusses the recommendation= s >> for use with certificates. >> While the current text restricts the use of certificates quite a bit I= >> got feedback that the current text still leaves several aspects untouc= hed. >> >> Here is a proposal of further recommendations: >> >> * TLS/DTLS offers a lot of freedom for using ECC curves. I would sugge= st >> to restrict the use of RFC4492-defined ECC ciphersuites to named curve= s >> only. >=20 > Do we want to consider alternate key agreement schemes that may enable > lower-powered devices to have lower overhead? >=20 > -derek >=20 --6so4UtRA2fqE4NaTnGhCaDdJs3fLjScdV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJVZejaAAoJEGhJURNOOiAtLMoH/AuPRy7R21i/qQu2Hg3xyfJ7 VGmiVpD7qAZ88KBQNIqB7ZM1KUpmqVZ27gZAbFx6bo1kryr65iRKuMqh1hs/n8GC SSJFtTzfwZ52/zS5m8/XVIV+xpDyu9pDSWX3bSsJtqMO57hWc+30URH7KxwAuI7t hL3RDyszZtCKBaRNtDM0CEyOfYhYTqONbyKiU5JDlAMMwtZ6dR4oCCbXB7Jd7K4x vkyuqq+2IQ7gRxgmX17jtHlL0PSmZDqleFRM9dHQwVkPXhXH2Z8lKJ6XhiXNEar1 J7EZekZlBLHsFlIQLMF1wURRXMx9NJQYcsHEVBmKcVCiSI4rgsRMXFGGmy5kW54= =ruJl -----END PGP SIGNATURE----- --6so4UtRA2fqE4NaTnGhCaDdJs3fLjScdV-- From nobody Wed May 27 10:06:15 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5B3A81A8753 for ; Wed, 27 May 2015 10:06:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xZ5gbxEKJC-M for ; Wed, 27 May 2015 10:06:12 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.22]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C703F1A011B for ; Wed, 27 May 2015 10:06:11 -0700 (PDT) Received: from [192.168.131.131] ([80.92.115.230]) by mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0MIdYi-1Yzqdk1yXY-002Cal; Wed, 27 May 2015 19:06:08 +0200 Message-ID: <5565F97E.7080006@gmx.net> Date: Wed, 27 May 2015 19:06:06 +0200 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: "Kumar, Sandeep" , "dtls-iot@ietf.org" References: In-Reply-To: OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="A5LitQSCuh2XHifhq8J97sQ7Vugu0NdBX" X-Provags-ID: V03:K0:DC/n5Sj32sG8SuLkKXIfQV1bmnDYn/0k3b+QNOR0DgAG0lV9Rzu d2jxqgANEzfND58be7O61++oRlQ4qVISC/++HdiV+PdBs8r9FW7XbP3PVbTvbeL+/3DfD9X QAyBIBeyompeQsTEc1OUOVKFBZiJNGKGFYXvqJkHIwMNkTXTKzcdnqJw20kxaIRdTDGZ90x v4479suCEOBbyY58/7BIA== X-UI-Out-Filterresults: notjunk:1;V01:K0:UExMZfgkrwA=:gJr232Xfrv8pTlmCv/jw/M d638dF4j3fk/gsbGU3mtHpqXFbkxXTnaT2WFFGynLiyzMFOXzAyVBsE9IdYQaVrgUvv+gON4P 9mgCukgMZFzMaFMHxVk4YtEgDGe21uJnXYSko7L0svTbpSwYhieKrZsGC9GfzC2/I+0Ne/Em5 CSDOlXAbgqozMO+f+K66osfim7hUNc9WZGUiQ3ZH9mtKpjjYFK6ni5VfjJlksZilSoRo8S6aW ee5EEx3S6F3NEkwFmrQApoWZ4hCjv7DO1KkFWElVo/E7Xtp6HUNiMx1m4Zhd1v5x58fZPzDOD rB523d8pmcBle8+Rc0TFXAjx5rVOxCzKW0fPWRODix4gT5QsiENvF9lngRouBPOtmYvzT/S+z LIpWmqqj3IeQwDsfEqQgF0tuj+95OK6HnaMN2YTpKMqJgQsJ2c6Z+4wUU6kejQckPennHpGJR VEDEHjMtaD8/qUK8UQ3/qc95KLEBh/CscxRMuYDpZgAtRDCzttj2Kt4w4moU0GjPJp67s9kEG yL3IXtcy7Po3U+Vs6/dYE/68LkRoNTADk6jm8lSYEEdlDZlIUkRjhpJAV9rDMDrcZFxG2MfM+ TWDY4i/PP9puqqQlKmKQaa8+/0sbIqkXSBLIKZjuG6vQS9q+RAS6Shz0r2QjqenMIGfQnwSl1 40yaO5ToVKJ46VK4br6+GP7zBP21Rpw3xm6UmrcTFwwE6kA== Archived-At: Subject: Re: [Dtls-iot] DTLS profle draft X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 May 2015 17:06:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --A5LitQSCuh2XHifhq8J97sQ7Vugu0NdBX Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Sandeep, I am not sure whether I replied to your message already. On 03/27/2015 05:40 PM, Kumar, Sandeep wrote: > =20 >=20 > Hi Hannes and Thomas >=20 > =20 >=20 > Thanks for the well-written document and taking into consideration all > the comments. >=20 > =20 >=20 > However would like one final clarification: >=20 > Sec 6 states: =93TLS server MUST return the decryption_error error mess= age >=20 > instead of the unknown_psk_identity since the two mechanisms exist >=20 > and provide the same functionality.=94 >=20 > =20 >=20 > However Sec 2 of RFC4279 states: =93Alternatively, if the >=20 > server wishes to hide the fact that the PSK identity was not known, >=20 > it MAY continue the protocol as if the PSK identity existed but the >=20 > key was incorrect: that is, respond with a "decrypt_error" alert.=94= >=20 > =20 >=20 > Is the assumption that the server MUST continue the handshake if the > psk_identity is not known and send the decryption_error on the Finished= > message? >=20 > Is that not opening up options for a DoS attacks on a constrained serve= r? >=20 >=20 There are various types of DoS attacks that are possible in an IoT deployment. I am most worried about amplification attacks. This attack does not fall into that category. >=20 > ---- >=20 > Some other minor things that could be fixed: >=20 > =20 >=20 > - The Fig4 client_certificate_type and server_certificate_typ= e > can be shown clearly as extensions similar to as in Fig 8. >=20 > =20 >=20 Fixed. > =20 >=20 > - In Sec 4.2 Discovery and Reachability: >=20 > =93=85.. Once it as been discovered,=85.=94 >=20 > as -> has >=20 Fixed. > =20 >=20 > - In Sec 6.1 mentions client identity but I guess you are > referring to the PSK identity >=20 >=20 I added clarifying text and here is the updated paragraph: " Note that [RFC4279] used the term PSK identity to refer to the identifier used to refer to the appropriate secret. While 'identifier' would be more appropriate in this context we re-use the terminology defined in RFC 4279 to avoid confusion. RFC 4279 does not mandate the use of any particular type of PSK identity and the client and server have to agree on the identities and keys to be used. The UTF-8 encoding of identities described in Section 5.1 of RFC 4279 aims to improve interoperability for those cases where the identity is configured by a human using some management interface provided by a Web browser. However, many IoT devices do not have a user interface and most of their credentials are bound to the device rather than to the user. Furthermore, credentials are often provisioned into hardware modules or into the firmware by developers. As such, the encoding considerations are not applicable to this usage environment. For use with this profile the PSK identities SHOULD NOT assume a structured format (such as domain names, Distinguished Names, or IP addresses) and a bit-by-bit comparison operation MUST be used by the server for any operation related to the PSK identity. " >=20 > =20 >=20 > - Sec 9: =93For cases where the server is constrained (but not= > the client) the client MUST implement RFC 5077=94 >=20 > Wondering how useful the mandatory statement is since =93constrained=94= > itself is a vague term. >=20 > =20 Here is the updated paragraph: " For cases where the server constrained (but not the client) the client MUST implement RFC 5077 [RFC5077]. Note that the constrained server refers to a device that has limitations in terms of RAM and flash memory, which place restrictions on the amount of TLS/DTLS security state information that can be stored on such a device. RFC 5077 specifies a version of TLS/DTLS session resumption that does not require per-session state information to be maintained by the constrained server. This is accomplished by using a ticket-based approach. " >=20 > - Figure 11: shows 128 symmetric and 283 bit-length ECC, but= > I could not find this relationship in the ENISA-2014 document. I have > only seen it mapped to 256-bits. Wondering if this is a typo. >=20 >=20 Figure 11 is taken from RFC 4492. The challenge with providing good numbers for key length is that it depends on lots of assumptions and the referenced material explains those assumptions. Depending on the paper the results are somewhat different. >=20 > =20 >=20 > Overall great work. >=20 Thanks. Ciao Hannes > =20 >=20 > Regards >=20 > Sandeep >=20 > =20 >=20 > Dr. Sandeep S. Kumar >=20 > Senior Scientist, >=20 > Data Science department, >=20 > Philips Research, >=20 > HTC36.p.22 Eindhoven, The Netherlands. >=20 > =20 >=20 >=20 > -----------------------------------------------------------------------= - > The information contained in this message may be confidential and > legally protected under applicable law. The message is intended solely > for the addressee(s). If you are not the intended recipient, you are > hereby notified that any use, forwarding, dissemination, or reproductio= n > of this message is strictly prohibited and may be unlawful. If you are > not the intended recipient, please contact the sender by return e-mail > and destroy all copies of the original message. >=20 >=20 > _______________________________________________ > dtls-iot mailing list > dtls-iot@ietf.org > https://www.ietf.org/mailman/listinfo/dtls-iot >=20 --A5LitQSCuh2XHifhq8J97sQ7Vugu0NdBX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJVZfl+AAoJEGhJURNOOiAtMp4IAJi+1/1zduyWupOmp/BPiTR8 PtfgRXC4XnfukYPfVXhfPX+hgCPdJNo/kmz8Hf3R1CN4Qxz1BAqerWCrm0dDPl5n XijqueftLLspO23q5A2n2zDsY+tT1gTRo7WdJENoXkuK5/9HwClAyR9jCFEubsnO wyGfvpeLMCeSmbpWxxMA5hMkMhkLHc+jeSJWo48gd6vOkvvSkHwxJmsagW3DHcFn zHzWw3jdLT6vEGUjlrhOv2HH7DUVOCL0S/N5g0yZVwF0aLLd7f93vH8gau3sCfCa O4kqrHOEQn3vLW8MkEK5720LATpJysDpaA6OubKHG0jqKNQhsG3XD882QF9IMCc= =A0aB -----END PGP SIGNATURE----- --A5LitQSCuh2XHifhq8J97sQ7Vugu0NdBX-- From nobody Wed May 27 10:49:52 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52BD31A8757 for ; Wed, 27 May 2015 10:49:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pAF0WMYz1eoG for ; Wed, 27 May 2015 10:49:49 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.20]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9E96C1A1BB5 for ; Wed, 27 May 2015 10:49:48 -0700 (PDT) Received: from [192.168.131.131] ([80.92.115.230]) by mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0LsfrR-1Z9Bp52WUr-012Kh0 for ; Wed, 27 May 2015 19:49:46 +0200 Message-ID: <556603B9.2040802@gmx.net> Date: Wed, 27 May 2015 19:49:45 +0200 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: dtls-iot@ietf.org OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dWXF23kQ8DdlQ79Er8RTL2Ol7gkooInqc" X-Provags-ID: V03:K0:nVh7hby9jQfzCNaLJ9BErfzJqGEBxho4a4GG5qZ/DjjQ6iR2fU0 G205dqMxe7loxAV6hZ2nlrNfDQccPA8PZWN4zlZe7w4kgljIIQuAPvGURkkxy41lkBebV9M hfb5IAtvc1o/Y5jHd3vpnWqxxoreupS8Yl+95BVGeon8UsZ1J+r4qugaUHKEgeGfnJM7Iex QzQZUNJgj/fjlppRgwYBA== X-UI-Out-Filterresults: notjunk:1; Archived-At: Subject: [Dtls-iot] draft-ietf-dice-profile-11.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 May 2015 17:49:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dWXF23kQ8DdlQ79Er8RTL2Ol7gkooInqc Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi all, I have just submitted another update to the DTLS profile document. The changes include * Comments from Sandeep addressed. http://www.ietf.org/mail-archive/web/dtls-iot/current/msg00589.html * Comment from Derek incorporated http://www.ietf.org/mail-archive/web/dtls-iot/current/msg00594.html * Text in Section 6.3 "Certificates" restructured to improve readability. Incorporated summary of my post to the mailing list end of March: http://www.ietf.org/mail-archive/web/dtls-iot/current/msg00590.htm= l Ciao Hannes --dWXF23kQ8DdlQ79Er8RTL2Ol7gkooInqc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJVZgO5AAoJEGhJURNOOiAtyRAH/jzqTCddz6UC051XYy9/xVlq fKsLLbApXZg7hrsOYDFWPBcXcMeVNlL7OrYBJWpBPJmN5kYaXT0MDamirtLGJujR LniUt8cttfIRyoxNs0p14xE/0+tbWj5hYxVk+OHMQxd5Jsdc0n/wH6g1ESRb8F5D hmu80xINK8+lD8IrhWYo7r3cYlZClAaESInwKgI9PaXCaqOlgeMrrKpkaaCMgxEC IGk3DbgYhtPrxOzrGv9gRDq5GhDkZ+3RB48gJIXWDMrRfWdsV5RM1FPLHjPsxHDN XO+HQemCd5uiuC8jEbgP8/m5K2qHKVrl5yM7x7sukPGV7v2X0MJ2woHIdoQaBWo= =wf8v -----END PGP SIGNATURE----- --dWXF23kQ8DdlQ79Er8RTL2Ol7gkooInqc-- From nobody Wed May 27 10:51:09 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D61E51A8757; Wed, 27 May 2015 10:51:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jYdiOv2UFzAr; Wed, 27 May 2015 10:51:04 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 42B2D1A88BC; Wed, 27 May 2015 10:51:04 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.0.3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150527175104.19279.66976.idtracker@ietfa.amsl.com> Date: Wed, 27 May 2015 10:51:04 -0700 Archived-At: Cc: dtls-iot@ietf.org Subject: [Dtls-iot] I-D Action: draft-ietf-dice-profile-11.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 May 2015 17:51:06 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DTLS In Constrained Environments Working Group of the IETF. Title : A TLS/DTLS Profile for the Internet of Things Authors : Hannes Tschofenig Thomas Fossati Filename : draft-ietf-dice-profile-11.txt Pages : 55 Date : 2015-05-27 Abstract: A common design pattern in Internet of Things (IoT) deployments is the use of a constrained device that collects data via sensor or controls actuators for use in home automation, industrial control systems, smart cities and other IoT deployments. This document defines a Transport Layer Security (TLS) and Datagram TLS (DTLS) 1.2 profile that offers communications security for this data exchange thereby preventing eavesdropping, tampering, and message forgery. The lack of communication security is a common vulnerability in Internet of Things products that can easily be solved by using these well-researched and widely deployed Internet security protocols. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dice-profile/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-dice-profile-11 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-dice-profile-11 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu May 28 03:35:47 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 140DC1A87E1; Thu, 28 May 2015 03:35:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IWrZtqc8T2sJ; Thu, 28 May 2015 03:35:45 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E25B21A7021; Thu, 28 May 2015 03:35:45 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: X-Test-IDTracker: no X-IETF-IDTracker: 6.0.3.p1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20150528103545.24491.81166.idtracker@ietfa.amsl.com> Date: Thu, 28 May 2015 03:35:45 -0700 Archived-At: Cc: dtls-iot@ietf.org Subject: [Dtls-iot] I-D Action: draft-ietf-dice-profile-12.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 May 2015 10:35:47 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DTLS In Constrained Environments Working Group of the IETF. Title : A TLS/DTLS Profile for the Internet of Things Authors : Hannes Tschofenig Thomas Fossati Filename : draft-ietf-dice-profile-12.txt Pages : 55 Date : 2015-05-28 Abstract: A common design pattern in Internet of Things (IoT) deployments is the use of a constrained device that collects data via sensor or controls actuators for use in home automation, industrial control systems, smart cities and other IoT deployments. This document defines a Transport Layer Security (TLS) and Datagram TLS (DTLS) 1.2 profile that offers communications security for this data exchange thereby preventing eavesdropping, tampering, and message forgery. The lack of communication security is a common vulnerability in Internet of Things products that can easily be solved by using these well-researched and widely deployed Internet security protocols. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-dice-profile/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-ietf-dice-profile-12 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-dice-profile-12 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Thu May 28 03:36:50 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D4421A87F1 for ; Thu, 28 May 2015 03:36:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.91 X-Spam-Level: X-Spam-Status: No, score=-1.91 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1oBdluTSZ3Lr for ; Thu, 28 May 2015 03:36:46 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.15.19]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45DA61A87EB for ; Thu, 28 May 2015 03:36:46 -0700 (PDT) Received: from [192.168.131.131] ([80.92.122.44]) by mail.gmx.com (mrgmx002) with ESMTPSA (Nemesis) id 0Mfn88-1YjZBQ2dJk-00NBVB for ; Thu, 28 May 2015 12:36:44 +0200 Message-ID: <5566EFBB.4060709@gmx.net> Date: Thu, 28 May 2015 12:36:43 +0200 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: "dtls-iot@ietf.org" OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="VTr3VrN8b1psFTx5oUqo2mfCfpsqVngbP" X-Provags-ID: V03:K0:M1GiiA4BHmGtI7xln0ugXwyhtmsSKAQiGiFsw/SRfp+LZES1S3e o6XQneLh9MZUby/sSaOJijc6jCVnSqsxdmqq7nEfNnvtYh/7n7aK9faWA18pfPNOUPA/Zcu 0VGI75yZxvno8C1hrlPRzrzOcbBI2740AarfYza38vxq2zcf9Mo5MtbsOyXglGPWHYF452J XNqQsueRwHuo1xgqqMapg== X-UI-Out-Filterresults: notjunk:1;V01:K0:vaSbHOBbZTs=:F7hkzafIzvNKOPfAyMPADg Po01X/9ACqsJeipVsFJZ+02WPFgXGCPWdXWfh5VxkDfoZyyWuBMmUZSp6wGCyi4obl8QzO7nc QJyxsN4vwgCHOXmyiJhj9xfwJbLhCvt5ksiFzYOwOJkOatQVuDA3jJaHmrp4q8V2bzpD1t5f1 BDOEp0hJ4p4IZw1Q8KImnXVST0rY8ntkZweMITPk/f4tmNZCipJQA+6VxjUrfexakN91udTCE oT6GIDXaENDQCVoRz+FwJTRY1QUq0FUyUsnljLSHg2LKReI/K08NYpoZyypWzj/FKbN1c+M1K km3/ffguTS+XTw3XuVapZUDsvwgYi207517mQ2x/XwFvXVIZjBcafl1eINqW6ASSVXcViLfYA uKQgcxBI118rJxxGO//hmMJis30aaGS4VH39X/fAq9w0+kADPpdXanqtQz0XZ4jRzxTFaA1q8 1+tEqEi/aNA0l1gAlDcL+QRxfgYqhSYzOxXeu4k+0zGkIhNtYXXqeUg5/AzYPNLC/Q60tYJGe YqS/YDd9+zIUSe6bROvzgo3x83f8li+b/q3Na8+nyRKNaTVzskYYU4i+HAyQLYMDMN1o9oJY5 vpi0PXfpX43p7JuNcC/vS20MxDMaZCUr1q/WGqKAIy7COPA0RERju1rPLYT9nP5M4jmpVIUB6 VHY4wwfNIh9G5FbdQR29zfl9Z+9pCTomzuxSF+WSrt9Ju5Q== Archived-At: Subject: [Dtls-iot] draft-ietf-dice-profile-12.txt X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 May 2015 10:36:49 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --VTr3VrN8b1psFTx5oUqo2mfCfpsqVngbP Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable I submitted version -12 to correct references. Ciao Hannes --VTr3VrN8b1psFTx5oUqo2mfCfpsqVngbP Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJVZu+8AAoJEGhJURNOOiAtWKUH/20h4ifLS+n05bpbNA8iUZ83 2S1aX+2w8QT1P8Ha1e6H1aWKDrp5JzddRRegHGRA51zNSGnzy9K+ZTgQcYDViFqD Cr9SNV9/K36Tedg2tv4TqBq4vGjP6EBnPFgMNsdZrJq+8Dw/BJgoj5GyjRSY5Ng6 XYNHno6SYx8QrtuwQtB7bXap2CMvIXYFZod1dQfcFyTMtfFKEE1ncGScaA201w7a RG29kUvVYIbNwljyApbrb/Ysv0kwaygovrA+qhv3I8pc5/ZpMNPvNcP52ICDDOZY qqJNxWLMTs9BYhLUXs6hS1tSu1sc7HQxPXlHbKa1TIXekHcKck5Mi6qcAXF5/2U= =07NW -----END PGP SIGNATURE----- --VTr3VrN8b1psFTx5oUqo2mfCfpsqVngbP-- From nobody Thu May 28 09:16:47 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78F711B2B9F for ; Thu, 28 May 2015 09:16:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.389 X-Spam-Level: X-Spam-Status: No, score=-1.389 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_ORG=0.611] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rGNLPekapReC for ; Thu, 28 May 2015 09:16:41 -0700 (PDT) Received: from mail2.ihtfp.org (MAIL2.IHTFP.ORG [204.107.200.7]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7FF1A1A00CA for ; Thu, 28 May 2015 09:16:40 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mail2.ihtfp.org (Postfix) with ESMTP id CC430E2036; Thu, 28 May 2015 12:16:38 -0400 (EDT) Received: from mail2.ihtfp.org ([127.0.0.1]) by localhost (mail2.ihtfp.org [127.0.0.1]) (amavisd-maia, port 10024) with ESMTP id 14508-05; Thu, 28 May 2015 12:16:36 -0400 (EDT) Received: from securerf.ihtfp.org (unknown [IPv6:fe80::ea2a:eaff:fe7d:235]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mocana.ihtfp.org", Issuer "IHTFP Consulting Certification Authority" (verified OK)) by mail2.ihtfp.org (Postfix) with ESMTPS id 6C566E2035; Thu, 28 May 2015 12:16:36 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ihtfp.com; s=default; t=1432829796; bh=o7p98gnxZEBdHt72i2QTg57FNBrIVFZjEEU/N4CjTSk=; h=From:To:Cc:Subject:References:Date:In-Reply-To; b=GZMzi7xjsJ2nZ18x0Hi1bGAg4CoCbqVftMj7ao6FVQR/1IfxDDOGw4wMnufEagVcl chtvyddCsfBOG52wPZqWfsGi6e/5SG7onSa7Qto4E0ErBZxeEDOAFt2Gm0bn8hk7gB E9l8Iu8rHF1X4wcI8yvuEOvtP5V3piH47GxXV3wg= Received: (from warlord@localhost) by securerf.ihtfp.org (8.14.8/8.14.8/Submit) id t4SGGZpW025246; Thu, 28 May 2015 12:16:35 -0400 From: Derek Atkins To: Hannes Tschofenig References: <55196612.9060004@gmx.net> <5565E8DA.7060207@gmx.net> Date: Thu, 28 May 2015 12:16:35 -0400 In-Reply-To: <5565E8DA.7060207@gmx.net> (Hannes Tschofenig's message of "Wed, 27 May 2015 17:55:06 +0200") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Virus-Scanned: Maia Mailguard 1.0.2a Archived-At: Cc: Derek Atkins , "dtls-iot@ietf.org" Subject: Re: [Dtls-iot] Certificate Profiling X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 May 2015 16:16:43 -0000 Thanks, Hannes. I was also trying to keep an open mind about, for example, Algebraic Eraser (AEDH) for key agreement. It's significantly faster and less power-hungry than ECC so might be interesting for IoT applications where speed and power consumption are important considerations. -derek Hannes Tschofenig writes: > Hi Derek, > > I added text to take your comment into account. Here is the new text: > > " > TLS/DTLS offers a lot of freedom for the use with ECC. This document > restricts the use of ECC ciphersuites to named curves defined in RFC > 4492 [RFC4492]. At the time of writing the recommended curve is > secp256r1 and the use of uncompressed points to follow the > recommendation in CoAP. Note that standardization for Curve25519 > (for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for > this curve will likely be required in the future. To offer elliptic- > curve signatures using the Edwards-curve Digital Signature Algorithm > (EdDSA) standardization work on Ed25519 is also ongoing (see > [I-D.josefsson-eddsa-ed25519]). > " > > Ciao > Hannes > > > On 04/01/2015 10:17 PM, Derek Atkins wrote: >> Hannes Tschofenig writes: >> >>> Hi all, >>> >>> Section 6.3 of draft-ietf-dice-profile-10 discusses the recommendations >>> for use with certificates. >>> While the current text restricts the use of certificates quite a bit I >>> got feedback that the current text still leaves several aspects untouched. >>> >>> Here is a proposal of further recommendations: >>> >>> * TLS/DTLS offers a lot of freedom for using ECC curves. I would suggest >>> to restrict the use of RFC4492-defined ECC ciphersuites to named curves >>> only. >> >> Do we want to consider alternate key agreement schemes that may enable >> lower-powered devices to have lower overhead? >> >> -derek >> > > _______________________________________________ > dtls-iot mailing list > dtls-iot@ietf.org > https://www.ietf.org/mailman/listinfo/dtls-iot -- Derek Atkins 617-623-3745 derek@ihtfp.com www.ihtfp.com Computer and Internet Security Consultant From nobody Sun May 31 12:25:24 2015 Return-Path: X-Original-To: dtls-iot@ietfa.amsl.com Delivered-To: dtls-iot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 99E111A8957 for ; Sun, 31 May 2015 12:25:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.83 X-Spam-Level: X-Spam-Status: No, score=0.83 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, DATE_IN_PAST_24_48=1.34, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ul4Dr5_2Qtd9 for ; Sun, 31 May 2015 12:25:22 -0700 (PDT) Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0B071A8956 for ; Sun, 31 May 2015 12:25:21 -0700 (PDT) Received: from [192.168.131.131] ([80.92.122.44]) by mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0LdKs1-1ZPN0M3hXF-00iTYU; Sun, 31 May 2015 21:25:16 +0200 Message-ID: <5568D80D.1080803@gmx.net> Date: Fri, 29 May 2015 23:20:13 +0200 From: Hannes Tschofenig User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0 MIME-Version: 1.0 To: Derek Atkins References: <55196612.9060004@gmx.net> <5565E8DA.7060207@gmx.net> In-Reply-To: OpenPGP: id=4D776BC9 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="RBQqI826csmQdNU0Fn2egmUIow8C1MQV8" X-Provags-ID: V03:K0:ODWpM+SwEkSbL7d2QTM4CobLEGpnQK4RkndB+vm1eknFlxtzObf qmTsW/hLcELEUhKNXQ982ctjCAFZH80e3f+rEiTas2zLhV8iIjnn0auLK8budqGd7MvfJxF SG+GZSU1G53KaU8AN7Z4jzmlvUIk+Byk2xZxTptTPjA6MUL6f5nJWFjzQpexG6ZMOBsfmqO nN5ZpYb38Pubr14I7qyew== X-UI-Out-Filterresults: notjunk:1;V01:K0:1NmpbXlpm1M=:BZp0tNAzJp4s9UnjVhz7LE V7lGRVWgY0CuBzDruUd7EA+vt9JDlrDBTR63Fhxof8GK2279VuqcHRqUj3GuNFaK0c4ognetf 1o0ybtWOz5ToCV0tDa1zch7XgDPz3AqiBGeCS0AR5JAStXMDm+TGW1V7RB5dLN/iZtPhn/NkS 32ozMwcZc8wrf/g6tsD4eN0B98K1KrbLrRylqrvAQvYeUzRWoqmsNOwTtR31hsbfD9NaN+H2o blTvjDLcjDcZdIQ8+PiU2Mt+UjeqZGpbQZOrwYydFcpLaDM6tKvEfeD10cDVfE0Qlj9XbErnD nZJ5jq208UAbkBSmn6lXKD8vVFuwBIFDxg1fQ4/Fe1uItxaAJ18xpzKceh+IDQU8IEDU4wX9m T+yWgfxIkRTEb+b5SSdz/L4DrGriwwW55VmrP6eLLRCb/NJFZgG4QmKWhKc9NMvuNcztadQc/ 5DZbcUegctjPviLZrEXBj0mGoHYHGGkX+KRoWx9OorCmiZ4iUf0TudDfo2yMCuQLGj1eFLdmo BV/xPPz6csdNuswZJKlDfPJ6eWM1m+9WaCxv6Ytbxx66DxcI6Q4LttgRujnY10w0z6oyRuqtR WT9LjD1oXjPP5CDPcER0KL+jC9KrbKkxW+m40Jn6LgiDmgSV9x7yNVAi3CJ60CQiSJklVsLsI LF9RnF/PRYHLSQGI0OiBmupYVa7xRwUZRNZO4K+/E4ZwB8Q== Archived-At: Cc: "dtls-iot@ietf.org" Subject: Re: [Dtls-iot] Certificate Profiling X-BeenThere: dtls-iot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DTLS for IoT discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 31 May 2015 19:25:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --RBQqI826csmQdNU0Fn2egmUIow8C1MQV8 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: quoted-printable Hi Derek, I got it. With the way the document is currently written it is not prohibited to use other cryptographic algorithms with TLS. However, the mandatory-to-implement algorithms are currently focusing on other algorithms, which depend a bit on the type of credential being used. We have taken a somewhat conservative approach in the selection since we re-use the algorithm from previously published specifications. So far, nobody had complained about that approach. Ciao Hannes On 05/28/2015 06:16 PM, Derek Atkins wrote: > Thanks, Hannes. >=20 > I was also trying to keep an open mind about, for example, Algebraic > Eraser (AEDH) for key agreement. It's significantly faster and less > power-hungry than ECC so might be interesting for IoT applications wher= e > speed and power consumption are important considerations. >=20 > -derek >=20 > Hannes Tschofenig writes: >=20 >> Hi Derek, >> >> I added text to take your comment into account. Here is the new text: >> >> " >> TLS/DTLS offers a lot of freedom for the use with ECC. This docume= nt >> restricts the use of ECC ciphersuites to named curves defined in RF= C >> 4492 [RFC4492]. At the time of writing the recommended curve is >> secp256r1 and the use of uncompressed points to follow the >> recommendation in CoAP. Note that standardization for Curve25519 >> (for ECDHE) is ongoing (see [I-D.irtf-cfrg-curves]) and support for= >> this curve will likely be required in the future. To offer ellipti= c- >> curve signatures using the Edwards-curve Digital Signature Algorith= m >> (EdDSA) standardization work on Ed25519 is also ongoing (see >> [I-D.josefsson-eddsa-ed25519]). >> " >> >> Ciao >> Hannes >> >> >> On 04/01/2015 10:17 PM, Derek Atkins wrote: >>> Hannes Tschofenig writes: >>> >>>> Hi all, >>>> >>>> Section 6.3 of draft-ietf-dice-profile-10 discusses the recommendati= ons >>>> for use with certificates. >>>> While the current text restricts the use of certificates quite a bit= I >>>> got feedback that the current text still leaves several aspects unto= uched. >>>> >>>> Here is a proposal of further recommendations: >>>> >>>> * TLS/DTLS offers a lot of freedom for using ECC curves. I would sug= gest >>>> to restrict the use of RFC4492-defined ECC ciphersuites to named cur= ves >>>> only. >>> >>> Do we want to consider alternate key agreement schemes that may enabl= e >>> lower-powered devices to have lower overhead? >>> >>> -derek >>> >> >> _______________________________________________ >> dtls-iot mailing list >> dtls-iot@ietf.org >> https://www.ietf.org/mailman/listinfo/dtls-iot >=20 --RBQqI826csmQdNU0Fn2egmUIow8C1MQV8 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBCgAGBQJVaNgNAAoJEGhJURNOOiAtKS0H/1t+1QXL+kC0PzPtyo4g39v7 K1IPZJoS/NNDhXRYCq1fBfXi/rzHN/nckEtHdQY9CDelnJ1ytJAkldShZhQL/P79 aqk77QlFmbMcCrIadOWM0uvTknBhYXxE/9N+EYTa0UgoSEh/3WX7ui9z4A5onnu/ 1zcmwARkGSpQpZuApQsc+Augv0wnu1DKRURgpAk74Ia5qdWlS8hlZg7ScXcTMLQp TrwDgb7997qHvd2JOLuyYyODmQblseGjqFPo8F2cunhJyBFNGJsXjcmmWXDQpN6n qByGgyeh+xjSpuKwC1ajjLkd80/jAJ5epMpyyZbRw/pTVbyaKVskjQk1pJZCJ0A= =Y/Vj -----END PGP SIGNATURE----- --RBQqI826csmQdNU0Fn2egmUIow8C1MQV8--