authentication protocols, wherein at least one is uncompromised, jointly authenticates all protocols.  Authenticating with an externally provisioned PSK, therefore, should ideally authenticate <del> both the TLS connection and the external provision process. </del> <ins> both the TLS connection and the external provisioning process. </ins> Typically, the external provision process produces a PSK and corresponding context from which the PSK was derived and in which it <del> should be used.  We refer to an external PSK without such context as "context free". </del> <ins> should be used.  If available, this is used as the ImportedIdentity.context value.  We refer to an external PSK without such context as "context-free". </ins> Thus, in considering the source-independence and compound <del> authentication requirements, the Key Import API described in this document aims to achieve the following goals: </del> <ins> authentication requirements, the PSK Import interface described in this document aims to achieve the following goals: </ins> <del> Externally provisioned PSKs imported into TLS achieve compound authentication of the provision step(s) and connection. </del> <ins> Externally provisioned PSKs imported into a TLS connection achieve compound authentication of the provisioning process and connection. </ins> Context-free PSKs only achieve authentication within the context of a single connection. <del> Imported PSKs are used as IKM for two different KDFs. </del> <ins> Imported PSKs are not used as IKM for two different KDFs. </ins> Imported PSKs do not collide with existing PSKs used for TLS 1.2 and below.


way in which the same external PSK might produce related output in TLS 1.3 and prior versions, only limited analysis has been done. Applications SHOULD provision separate PSKs for TLS 1.3 and prior <del> versions. </del> <ins> versions.  In cases where this is not possible, e.g., there are already deployed external PSKs or provisioning is otherwise limited, re-using external PSKs across different versions of TLS may produce related outputs, which may in turn lead to security problems; see RFC8446, Section E.7. </ins> <del> To mitigate against any interference, this document specifies a PSK </del> <ins> To mitigate against such problems, this document specifies a PSK </ins> Importer interface by which external PSKs may be imported and subsequently bound to a specific key derivation function (KDF) and hash function for use in TLS 1.3 RFC8446 and DTLS 1.3 DTLS13.  In


and imported PSKs are distinct since their identities are different on the wire.  See rollout for more details. <del> Endpoints which import external keys MUST NOT use either the external keys or the derived keys for any other purpose.  Moreover, each external PSK MUST be associated with at most one hash function, as per the rules in Section 4.2.11 from RFC8446.  See security- considerations for more discussion. </del> <ins> Endpoints which import external keys MUST NOT use the keys that are input to the import process for any purpose other than the importer, and MUST NOT use the derived keys for any purpose other than TLS PSKs.  Moreover, each external PSK fed to the importer process MUST be associated with at most one hash function.  This is analogous to the rules in Section 4.2.11 of RFC8446.  See security-considerations for more discussion. </ins> 3.1. <ins> The following terms are used throughout this document: </ins> External PSK (EPSK): A PSK established or provisioned out-of-band, i.e., not from a TLS connection, which is a tuple of (Base Key, External Identity, Hash).


Target KDF: The KDF for which a PSK is imported for use. <del> Imported PSK (IPSK): A PSK derived from an EPSK, External Identity, optional context string, target protocol, and target KDF. </del> <ins> Imported PSK (IPSK): A PSK derived from an EPSK, optional context string, target protocol, and target KDF. </ins> Imported Identity: A sequence of bytes used to identify an IPSK. <ins> This document uses presentation language from RFC8446, Section 3. </ins> 4. This section describes the PSK Importer interface and its underlying


PSKs for TLS 1.3 and non-imported PSKs for earlier versions co-exist for incremental deployment. <del> ImportedIdentity.context MUST include the context used to derive the EPSK, if any exists.  For example, ImportedIdentity.context may </del> <ins> ImportedIdentity.context MUST include the context used to determine the EPSK, if any exists.  For example, ImportedIdentity.context may </ins> include information about peer roles or identities to mitigate Selfie-style reflection attacks Selfie.  See mitigate-selfie for more details.  If the EPSK is a key derived from some other protocol or


L corresponds to the KDF output length of ImportedIdentity.target_kdf as defined in IANA.  For hash-based KDFs, such as HKDF_SHA256(0x0001), this is the length of the hash function output, <del> i.e., 32 octets.  This is required for the IPSK to be of length suitable for supported ciphersuites. </del> <ins> e.g., 32 octets for SHA256.  This is required for the IPSK to be of length suitable for supported ciphersuites.  Internally, HKDF-Expand- Label uses a label corresponding to ImportedIdentity.target_protocol, e.g., "tls13" for TLS 1.3, as per RFC8446, Section 7.1, or "dtls13" for DTLS 1.3, as per I-D.ietf-tls-dtls13, Section 5.10. </ins> The identity of "ipskx" as sent on the wire is ImportedIdentity, i.e., the serialized content of ImportedIdentity is used as the content of PskIdentity.identity in the PSK extension.  The <del> corresponding TLS 1.3 binder key is "ipskx". </del> <ins> corresponding PSK input for the TLS 1.3 key schedule is 'ipskx'. </ins> As the maximum size of the PSK extension is 2^16 - 1 octets, an Imported Identity that exceeds this size is likely to cause a


The hash function used for HKDF RFC5869 is that which is associated with the EPSK.  It is not the hash function associated with ImportedIdentity.target_kdf.  If no hash function is specified, <del> SHA-256 SHA2 MUST be used.  Diversifying EPSK by </del> <ins> SHA-256 SHA2 SHOULD be used.  Diversifying EPSK by </ins> ImportedIdentity.target_kdf ensures that an IPSK is only used as input keying material to at most one KDF, thus satisfying the requirements in RFC8446.  See security-considerations for more


TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384 would yield two PSKs, one for HKDF-SHA256 and another for HKDF-SHA384.  In contrast, if TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256 are <del> supported, only one derived key is necessary. </del> <ins> supported, only one derived key is necessary.  Each ciphersuite uniquely identifies the target KDF.  Future specifications that change the way the KDF is negotiated will need to update this specification to make clear how target KDFs are determined for the import process. </ins> EPSKs MAY be imported before the start of a connection if the target KDFs, protocols, and context string(s) are known a priori.  EPSKs MAY <del> also be imported for early data use if they are bound to protocol settings and configurations that would otherwise be required for early data with normal (ticket-based PSK) resumption.  Minimally, that means Application-Layer Protocol Negotiation RFC7301, QUIC transport parameters (if used for QUIC), and any other relevant parameters that are negotiated for early data MUST be provisioned alongside these EPSKs. </del> <ins> also be imported for early data use if they are bound to the protocol settings and configuration that are required for sending early data. Minimally, that means Application-Layer Protocol Negotiation value RFC7301, QUIC transport parameters (if used for QUIC), and any other relevant parameters that are negotiated for early data MUST be provisioned alongside these EPSKs. </ins> 4.2.


6. <del> Recall that TLS 1.2 permits computing the TLS PRF with any hash algorithm and PSK.  Thus, an EPSK may be used with the same KDF (and underlying HMAC hash algorithm) as TLS 1.3 with importers.  However, critically, the derived PSK will not be the same since the importer differentiates the PSK via the identity and target KDF and protocol. Thus, PSKs imported for TLS 1.3 are distinct from those used in TLS 1.2, and thereby avoid cross-protocol collisions.  Note that this does not preclude endpoints from using non-imported PSKs for TLS 1.2. Indeed, this is necessary for incremental deployment.  Specifically, existing applications using TLS 1.2 with non-imported PSKs can safely enable TLS 1.3 with imported PSKs in clients and servers without interoperability risk. </del> <ins> The mechanism defined in this document requires that an EPSK is only ever used as an EPSK and not for any other purpose.  In particular, this requirement disallows direct use of the EPSK as a PSK in TLS 1.2.  The importer process produces distinct IPSKs derived from the target protocol and KDF, which in turn protects against cross- protocol collisions for protocol versions using this process by ensuring that each IPSK can only be used with one protocol and KDF. This is a distinct contrast to TLS 1.2, where a given PSK might be used with multiple KDFs in different handshakes, and importers are not available.  Furthermore, the KDF used in TLS 1.2 might be the same KDF used by the importer mechanism itself. In deployments that already have PSKs provisioned and in use with TLS 1.2, attempting to incrementally deploy the importer mechanism would then result in concurrent use of the already provisioned PSK both directly as a TLS 1.2 PSK and as an EPSK, which in turn could mean that the same KDF and key would be used in two different protocol contexts.  There are no known related outputs or security issues that would arise from this arrangement.  However, only limited analysis has been done, and as such is not a recommended configuration. However, the benefits of using TLS 1.3 and of using PSK importers may prove sufficiently compelling that existing deployments choose to enable this noncompliant configuration for a brief transition period while new software (using TLS 1.3 and importers) is deployed. Operators are advised to make any such transition period as short as possible. </ins> 7.


Imported PSKs do not collide with future protocol versions and KDFs. <del> There is no known interference between the process for computing Imported PSKs from an external PSK and the processing of existing external PSKs used in (D)TLS 1.2 and below.  However, only limited analysis has been done, which is an additional reason why applications SHOULD provision separate PSKs for (D)TLS 1.3 and prior versions, even when the importer interface is used in (D)TLS 1.3. </del> <ins> There are no known related outputs or security issues caused from the process for computing Imported PSKs from an external PSK and the processing of existing external PSKs used in (D)TLS 1.2 and below, as noted in rollout.  However, only limited analysis has been done, which is an additional reason why applications SHOULD provision separate PSKs for (D)TLS 1.3 and prior versions, even when the importer interface is used in (D)TLS 1.3. </ins> The PSK Importer does not prevent applications from constructing non- importer PSK identities that collide with imported PSK identities.


systems and use cases, this identity may become a persistent tracking identifier. <ins> Note also that ImportedIdentity.context is visible in cleartext on the wire as part of the PSK identity.  Unless otherwise protected by a mechanism such as TLS Encrypted ClientHello ECH, applications SHOULD not put sensitive information in this field. </ins> 9. This specification introduces a new registry for TLS KDF identifiers,


track documents need to be marked as recommended. If an item is marked as not recommended it does not necessarily mean <del> that it is flawed, rather, it indicates that either the item has not </del> <ins> that it is flawed; rather, it indicates that either the item has not </ins> been through the IETF consensus process, has limited applicability, or is intended only for specific use cases.


Update the "Reference" to also refer to this document. <del> Add the following notes: Experts are to verify that there is in fact a publicly available standard.  An Internet Draft that is posted and never published or a standard in another standards body, industry consortium, university site, etc. suffices. As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available. </del> See expert-pool for additional information about the designated expert pool.


extension with the value "Yes", a Standards Track document RFC8126 is REQUIRED.  IESG Approval is REQUIRED for a Yes->No transition. <ins> IANA [SHALL update/has added] the following notes: Experts are to verify that there is in fact a publicly available specification.  An Internet Draft that is posted and never published or a specification in another standards body, industry consortium, university site, etc. suffices. As specified in RFC8126, assignments made in the Private Use space are not generally useful for broad interoperability.  It is the responsibility of those making use of the Private Use range to ensure that no conflicts occur (within the intended scope of use). For widespread experiments, temporary reservations are available. Extensions marked as "Yes" are those allocated via Standards Track RFCs.  Extensions marked as "No" are not. If an item is not marked as recommended it does not necessarily mean that it is flawed; rather, it indicates that either the item has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. </ins> The following is from I-D.ietf-tls-tls13 and is included here to ensure alignment between these specifications.


represents a security trade-off that may not be appropriate for general environments. <ins> If an item is not marked as recommended it does not necessarily mean that it is flawed; rather, it indicates that either the item has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. </ins> IANA [SHALL add/has added] the following notes for additional information:


groups marked "No" range from "good" to "bad" from a cryptographic standpoint. <ins> If an item is not marked as recommended it does not necessarily mean that it is flawed; rather, it indicates that either the item has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. </ins> The designated expert RFC8126 only ensures that the specification is publicly available.  An Internet Draft that is posted and never published or a standard in another standards body, industry


allocated via Standards Track RFCs.  ClientCertificateTypes marked as "No" are not. <ins> If an item is not marked as recommended it does not necessarily mean that it is flawed; rather, it indicates that either the item has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. </ins> 12. To align with TLS implementations and to align the naming


Exporters Labels marked as "Yes" are those allocated via Standards Track RFCs.  Exporter Labels marked as "No" are not. <ins> If an item is not marked as recommended it does not necessarily mean that it is flawed; rather, it indicates that either the item has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. </ins> IANA [SHALL update/has updated] the reference for this registry to also refer to this document.


Certificate Types marked as "Yes" are those allocated via Standards Track RFCs.  Certificate Types marked as "No" are not. <ins> If an item is not marked as recommended it does not necessarily mean that it is flawed; rather, it indicates that either the item has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases. </ins> IANA [SHALL update/has updated] the reference for this registry to also refer this document.


SignatureAlgorithm registries to also refer to this document. [SHALL update/has updated] the TLS HashAlgorithm Registry to list <del> values 7-223 as "Reserved" and the TLS SignatureAlgorithm registry to list values 4-223 as "Reserved". </del> <ins> values 7 and 9-223 as "Reserved" and the TLS SignatureAlgorithm registry to list values 4-6 and 9-223 as "Reserved". </ins> Despite the fact that the HashAlgorithm and SignatureAlgorithm registries are orphaned, it is still important to warn implementers


4. Servers MUST NOT include MD5 and SHA-1 in ServerKeyExchange messages. <del> If no other signature algorithms are available (for example, if the client does not send a signature_algorithms extension), the server MUST abort the handshake with a handshake_failure alert or select a different cipher suite. </del> <ins> If the client receives a ServerKeyExchange message indicating MD5 or SHA-1, then it MUST abort the connection with an illegal_parameter alert. </ins> 5. Clients MUST NOT include MD5 and SHA-1 in CertificateVerify messages. If a server receives a CertificateVerify message with MD5 or SHA-1 it <del> MUST abort the connection with handshake_failure or insufficient_security alert. </del> <ins> MUST abort the connection with an illegal_parameter alert. </ins> 6.


Connection racing: Happy Eyeballs V2 RFC8305 describes techniques for performing connection racing.  The Transport Services <del> Architecture implementation from I-D.ietf-taps-impl also describes how connections may race across interfaces and address families. In cases where clients have early data to send and want to minimize or avoid ticket re-use, unique tickets for each unique connection attempt are useful.  Moreover, as some servers may implement single-use tickets (and even session ticket encryption keys), distinct tickets will be needed to prevent premature ticket </del> <ins> Architecture implementation from TAPS also describes how connections may race across interfaces and address families.  In cases where clients have early data to send and want to minimize or avoid ticket re-use, unique tickets for each unique connection attempt are useful.  Moreover, as some servers may implement single-use tickets (and even session ticket encryption keys), distinct tickets will be needed to prevent premature ticket </ins> invalidation by racing. Connection priming: In some systems, connections may be primed or


e.g., public key cryptographic operations, avoiding waste is desirable. <ins> Decline resumption: Clients may indicate they have no intention of resuming connections by sending a ticket request with count of zero. </ins> 3. <del> Clients may indicate to servers their desired number of tickets via the following "ticket_request" extension: </del> <ins> Clients may indicate to servers their desired number of tickets for a single connection via the following "ticket_request" extension: </ins> Clients may send this extension in ClientHello.  It contains the following structure:


send more than 255 tickets to clients. Servers that support ticket requests MUST NOT echo "ticket_request" <del> in the EncryptedExtensions. </del> <ins> in the EncryptedExtensions message.  A client MUST abort the connection with an "illegal_parameter" alert if the "ticket_request" extension is present in the EncryptedExtensions message. Clients MUST NOT change the value of TicketRequestContents.count in second ClientHello messages sent in response to a HelloRetryRequest. </ins> 4.


meaning that the server is not willing to receive any WebTransport sessions. <ins> Because WebTransport over HTTP/3 requires support for HTTP/3 datagrams and the Capsule Protocol, both the client and the server MUST indicate support for HTTP/3 datagrams by sending a SETTINGS_H3_DATAGRAM value set to 1 in their SETTINGS frame (see Section 2.1.1 of HTTP-DATAGRAM). WebTransport over HTTP/3 also requires support for QUIC datagrams. To indicate support, both the client and the server MUST send a max_datagram_frame_size transport parameter with a value greater than 0 (see Section 3 of QUIC-DATAGRAM). </ins> 3.2. RFC8441 defines an extended CONNECT method in Section 4, enabled by


From the client's perspective, a WebTransport session is established when the client receives a 200 response.  From the server's perspective, a session is established once it sends a 200 response. <del> Both endpoints MUST NOT open any streams or send any datagrams on a given session before that session is established.  WebTransport over HTTP/3 does not support 0-RTT. </del> <ins> WebTransport over HTTP/3 does not support 0-RTT. </ins> 3.4.


MTUs can vary.  TODO: Describe how the path MTU can be computed, specifically propagation across HTTP proxies. <ins> 4.5. In WebTransport over HTTP/3, the client MAY send its SETTINGS frame, as well as multiple WebTransport CONNECT requests, WebTransport data streams and WebTransport datagrams, all within a single flight.  As those can arrive out of order, a WebTransport server could be put into a situation where it receives a stream or a datagram without a corresponding session.  Similarly, a client may receive a server- initiated stream or a datagram before receiving the CONNECT response headers from the server. To handle this case, WebTransport endpoints SHOULD buffer streams and datagrams until those can be associated with an established session. To avoid resource exhaustion, the endpoints MUST limit the number of buffered streams and datagrams.  When the number of buffered streams is exceeded, a stream SHALL be closed by sending a RESET_STREAM and/ or STOP_SENDING with the "H3_WEBTRANSPORT_BUFFERED_STREAM_REJECTED" error code.  When the number of buffered datagrams is exceeded, a datagram SHALL be dropped.  It is up to an implementation to choose what stream or datagram to discard. </ins> 5. An WebTransport session over HTTP/3 is terminated when either


This document Both <ins> 7.5. The following entry is added to the "HTTP/3 Error Code" registry established by HTTP3: H3_WEBTRANSPORT_BUFFERED_STREAM_REJECTED 0x3994bd84 WebTransport data stream rejected due to lack of associated session. This document. </ins>


encoded using the QUIC variable length integer scheme described in RFC9000. <ins> If at any point a session ID is received that cannot a valid ID for a client-initiated bidirectional stream, the recepient MUST close the connection with an H3_ID_ERROR error code. </ins> 4.1. Once established, both endpoints can open unidirectional streams.


may be using a version of WebTransport extension that is different from the one used by the server. <ins> In addition to the setting above, the server MUST send a SETTINGS_MAX_WEBTRANSPORT_SESSIONS parameter indicating the maximum number of concurrent sessions it is willing to receive.  The default value for the SETTINGS_MAX_WEBTRANSPORT_SESSIONS parameter is "0", meaning that the server is not willing to receive any WebTransport sessions. </ins> 3.2. RFC8441 defines an extended CONNECT method in Section 4, enabled by


3.4. <del> From the flow control perspective, WebTransport sessions count against the stream flow control just like regular HTTP requests, since they are established via an HTTP CONNECT request.  This document does not make any effort to introduce a separate flow control mechanism for sessions, nor to separate HTTP requests from WebTransport data streams.  If the server needs to limit the rate of incoming requests, it has alternative mechanisms at its disposal: "HTTP_REQUEST_REJECTED" error code defined in HTTP3 indicates to the receiving HTTP/3 stack that the request was not processed in any way. </del> <ins> This document defines a SETTINGS_MAX_WEBTRANSPORT_SESSIONS parameter that allows the server to limit the maximum number of concurrent WebTransport sessions on a single HTTP/3 connection.  The client MUST NOT open more sessions than indicated in the server SETTINGS parameters.  The server MUST NOT close the connection if the client opens sessions exceeding this limit, as the client and the server do not have a consistent view of how many sessions are open due to the asynchronous nature of the protocol; instead, it MUST reset all of the CONNECT streams it is not willing to process with the "HTTP_REQUEST_REJECTED" status defined in HTTP3. Just like other HTTP requests, WebTransport sessions, and data sent on those sessions, are counted against flow control limits.  This document does not introduce additional mechanisms for endpoints to limit the relative amount of flow control credit consumed by different WebTransport sessions, however servers that wish to limit the rate of incoming requests on any particular session have alternative mechanisms: The "HTTP_REQUEST_REJECTED" error code defined in HTTP3 indicates to the receiving HTTP/3 stack that the request was not processed in any way. </ins> HTTP status code 429 indicates that the request was rejected due to rate limiting RFC6585.  Unlike the previous method, this signal


8.2. <del> The following entry is added to the "HTTP/3 Settings" registry </del> <ins> The following entries are added to the "HTTP/3 Settings" registry </ins> established by HTTP3: The "SETTINGS_ENABLE_WEBTRANSPORT" parameter indicates that the


This document <ins> The "SETTINGS_WEBTRANSPORT_MAX_SESSIONS" parameter indicates that the specified HTTP/3 server is WebTransport-capable and the number of concurrent sessions it is willing to receive. WEBTRANSPORT_MAX_SESSIONS 0x2b603743 0 This document </ins> 8.3. The following entry is added to the "HTTP/3 Frame Type" registry


WebTransport application error codes. This document. <ins> 8.6. The following entries are added to the "HTTP Capsule Types" registry established by HTTP-DATAGRAM: The "CLOSE_WEBTRANSPORT_SESSION" capsule. 0x2843 CLOSE_WEBTRANSPORT_SESSION permanent This document IETF WebTransport Working Group webtransport@ietf.org [1] None 9.  References 9.1.  URIs [1] mailto:webtransport@ietf.org </ins>


set to "webtransport", the HTTP/3 server can check if it has a WebTransport server associated with the specified ":authority" and ":path" values.  If it does not, it SHOULD reply with status code 404 <del> (Section 15.5.4, HTTP).  If it does, it MAY accept the session by replying with a 2xx series status code, as defined in Section 15.3 of HTTP.  The WebTransport server MUST verify the "Origin" header to </del> <ins> (Section 15.5.5 of HTTP).  When the request contains the "Origin" header, the WebTransport server MUST verify the "Origin" header to </ins> ensure that the specified origin is allowed to access the server in <del> question. </del> <ins> question.  If the verification fails, the WebTransport server SHOULD reply with status code 403 (Section 15.5.4 of HTTP).  If all checks pass, the WebTransport server MAY accept the session by replying with a 2xx series status code, as defined in Section 15.3 of HTTP. </ins> From the client's perspective, a WebTransport session is established when the client receives a 2xx response.  From the server's


the radio resource has been in the core design of SATellite COMmunication (SATCOM) systems.  The trade-off often resided in how much redundancy a system adds to cope from link impairments, without <del> reducing the good-put when the channel quality is high.  There is </del> <ins> reducing the good-put when the channel quality is good.  There is </ins> usually enough redundancy to guarantee a Quasi-Error Free <del> transmission.  However, physical layer reliability mechanisms may not recover transmission losses (e.g. with a mobile user) and layer 2 (or above) re-transmissions induce 500 ms one-way delay with a geostationary satellite.  Further exploiting coding schemes at higher OSI-layers is an opportunity for releasing constraints on the physical layer in such cases and improving the performance of SATCOM systems. </del> <ins> transmission.  The recovery time depends on the encoding block size. Considering for instance geostationary satellite system (GEO), physical or link layers erasure coding mechanisms recover transmission losses within a negligible delay compared to link delay. However, when retransmissions are triggered, this leads to an non- negligible additional delay in particular over GEO link.  Further exploiting coding schemes at application or transport layers is an opportunity for releasing constraints on the physical layer and improving the performance of SATCOM systems. </ins> We have noticed an active research activity on coding and SATCOM in the past.  That being said, not much has actually made it to


A research challenge would be the optimization of the NFV service function chaining, considering a virtualized infrastructure and other SATCOM specific functions, to guarantee an efficient radio usage and <del> easy-to-deploy SATCOM services. </del> <ins> easy-to-deploy SATCOM services.  Moreover, another challenge related to a virtualized SATCOM terminals is the management of limited buffered equipments. </ins> 5.3.


5. <del> This document discuses some opportunities to introduce these </del> <ins> This document discuses some opportunities to introduce coding </ins> techniques at a wider scale in satellite telecommunications systems. Even though this document focuses on satellite systems, it is worth


An endpoint uses a frame (type=0x04) to abruptly terminate the sending part of a stream. <del> After sending a , an endpoint ceases transmission and retransmission of frames on the identified stream.  A receiver of can discard any data that it already received on that stream. </del> <ins> After sending a , an endpoint ceases transmission of frames on the identified stream.  A receiver of can discard any data that it already received on that stream. </ins> The frame defines the following fields:


during the lifetime of an ongoing DTLS session then the receiver will be unable to locate the correct security context. <ins> The new ciphertext record format with CID also provides content type encryption and record-layer padding. </ins> 1. The Datagram Transport Layer Security (DTLS) RFC6347 protocol was


(CID) to the DTLS record layer.  The presence of the CID is negotiated via a DTLS extension. <ins> Adding a CID to the ciphertext record format presents an opportunity to make other changes to the record format.  In keeping with the best practices established by TLS 1.3, the type of the record is encrypted, and a mechanism provided for adding padding to obfuscate the plaintext length. </ins> 2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",


With multi-homing, an adversary is able to correlate the communication interaction over the two paths, which adds further <del> privacy concerns. </del> <ins> privacy concerns.  The lack of a CID update mechanism makes this extension unsuitable for mobility scenarios where correlation must be considered. </ins> Importantly, the sequence number makes it possible for a passive attacker to correlate packets across CID changes.  Thus, even if a


Connection Identifiers for DTLS 1.2 <del> draft-ietf-tls-dtls-connection-id-07 </del> <ins> draft-ietf-tls-dtls-connection-id-latest </ins> Abstract


1. <del> The Datagram Transport Layer Security (DTLS) protocol was designed for securing connection-less transports, like UDP.  DTLS, like TLS, starts with a handshake, which can be computationally demanding (particularly when public key cryptography is used).  After a successful handshake, symmetric key cryptography is used to apply </del> <ins> The Datagram Transport Layer Security (DTLS) RFC6347 protocol was designed for securing connection-less transports, like UDP.  DTLS, like TLS, starts with a handshake, which can be computationally demanding (particularly when public key cryptography is used).  After a successful handshake, symmetric key cryptography is used to apply </ins> data origin authentication, integrity and confidentiality protection. This two-step approach allows endpoints to amortize the cost of the initial handshake across subsequent application data protection. Ideally, the second phase where application data is protected lasts <del> over a longer period of time since the established keys will only need to be updated once the key lifetime expires. </del> <ins> over a long period of time since the established keys will only need to be updated once the key lifetime expires. </ins> <del> In the current version of DTLS, the IP address and port of the peer </del> <ins> In DTLS as specified in RFC 6347, the IP address and port of the peer </ins> are used to identify the DTLS association.  Unfortunately, in some cases, such as NAT rebinding, these values are insufficient.  This is a particular issue in the Internet of Things when devices enter


an endpoint to use a globally constant length for such connection identifiers.  This can in turn ease parsing and connection lookup, for example by having the length in question be a compile-time <del> constant.  Implementations, which want to use variable-length CIDs, are responsible for constructing the CID in such a way that its length can be determined on reception.  Such implementations must still be able to send CIDs of different length to other parties. Note that there is no CID length information included in the record itself. </del> <ins> constant.  Such implementations MUST still be able to send CIDs of different length to other parties.  Implementations that want to use variable-length CIDs are responsible for constructing the CID in such a way that its length can be determined on reception.  Note that there is no CID length information included in the record itself. </ins> In DTLS 1.2, CIDs are exchanged at the beginning of the DTLS session only.  There is no dedicated "CID update" message that allows new


record is found in DTLSInnerPlaintext.real_type after decryption. The CID value, cid_length bytes long, as agreed at the time the <del> extension has been negotiated. </del> <ins> extension has been negotiated.  Recall that (as discussed previously) each peer chooses the CID value it will receive and use to identify the connection, so an implementation can choose to always recieve CIDs of a fixed length.  If, however, an implementation chooses to receive different lengths of CID, the assigned CID values must be self-delineating since there is no other mechanism available to determine what connection (and thus, what CID length) is in use. </ins> The encrypted form of the serialized DTLSInnerPlaintext structure.


5. Several types of ciphers have been defined for use with TLS and DTLS <del> and the MAC calculation for those ciphers differs slightly. </del> <ins> and the MAC calculations for those ciphers differ slightly. </ins> <del> This specification modifies the MAC calculation defined in RFC6347 and RFC7366 as well as the definition of the additional data used with AEAD ciphers provided in RFC6347 for records with content type </del> <ins> This specification modifies the MAC calculation as defined in RFC6347 and RFC7366, as well as the definition of the additional data used with AEAD ciphers provided in RFC6347, for records with content type </ins> tls12_cid.  The modified algorithm MUST NOT be applied to records that do not carry a CID, i.e., records with content type other than tls12_cid.


The following fields are defined in this document; all other fields are as defined in the cited documents. <del> Value of the negotiated CID. </del> <ins> Value of the negotiated CID (variable length). </ins> 1 byte field indicating the length of the negotiated CID. <del> The length (in bytes) of the serialised DTLSInnerPlaintext. </del> <ins> The length (in bytes) of the serialised DTLSInnerPlaintext (two- byte integer). </ins> The length MUST NOT exceed 2^14. Note "+" denotes concatenation.


The above is necessary to protect against attacks that use datagrams with spoofed addresses or replayed datagrams to trigger attacks. <del> Note that there is no requirement to use of the anti-replay window </del> <ins> Note that there is no requirement for use of the anti-replay window </ins> mechanism defined in Section 4.1.2.6 of DTLS 1.2.  Both solutions, <del> the "anti-replay window" or "newer algorithm" will prevent address </del> <ins> the "anti-replay window" or "newer" algorithm, will prevent address </ins> updates from replay attacks while the latter will only apply to peer address updates and the former applies to any application layer traffic. <ins> Note that datagrams that pass the DTLS cryptographic verification procedures but do not trigger a change of peer address are still valid DTLS records and are still to be passed to the application. </ins> Application protocols that implement protection against these attacks depend on being aware of changes in peer addresses so that they can engage the necessary mechanisms.  When delivered such an event, an application layer-specific address validation mechanism can be <del> triggered, for example one that is based on successful exchange of </del> <ins> triggered, for example one that is based on successful exchange of a </ins> minimal amount of ping-pong traffic with the peer.  Alternatively, an DTLS-specific mechanism may be used, as described in I-D.tschofenig- tls-dtls-rrc.


dtls-example2 shows an example exchange where a CID is used uni- directionally from the client to the server.  To indicate that a <del> zero-length CID we use the term 'connection_id=empty'. </del> <ins> zero-length CID is present in the "connection_id" extension we use the notation 'connection_id=empty'. </ins> Note: In the example exchange the CID is included in the record layer once encryption is enabled.  In DTLS 1.2 only one handshake message is encrypted, namely the Finished message.  Since the example shows <del> how to use the CID for payloads sent from the client to the server only the record layer payloads containing the Finished messages include a CID.  Application data payloads sent from the client to the server contain a CID in this example as well. </del> <ins> how to use the CID for payloads sent from the client to the server, only the record layer payloads containing the Finished message or application data include a CID. </ins> 8.


details about record padding can be found in Section 5.4 and Appendix E.3 of RFC 8446. <del> Finally, endpoints can use the CID to attach arbitrary metadata to each record they receive.  This may be used as a mechanism to communicate per-connection information to on-path observers.  There is no straightforward way to address this concern with CIDs that contain arbitrary values.  Implementations concerned about this aspects SHOULD refuse to use CIDs. </del> <ins> Finally, endpoints can use the CID to attach arbitrary per-connection metadata to each record they receive on a given connection.  This may be used as a mechanism to communicate per-connection information to on-path observers.  There is no straightforward way to address this concern with CIDs that contain arbitrary values.  Implementations concerned about this aspect SHOULD refuse to use CIDs. </ins> 9.


asymmetry of request/response message sizes. Additionally, an attacker able to observe the data traffic exchanged <del> between two DTLS peers is able to replay datagrams with modified IP address/port numbers. </del> <ins> between two DTLS peers is able to modify IP address/port numbers. When the optional DTLS replay detection is not in use, such an attacker can also replay the observed packets, and the multiple copies of each packet can have different IP address/port numbers as well. </ins> The topic of peer address updates is discussed in peer-address- update.


"ExtensionType Values" registry, defined in RFC5246, for connection_id(TBD1) as described in the table below.  IANA is requested to add an extra column to the TLS ExtensionType Values <del> registry to indicate whether an extension is only applicable to DTLS. </del> <ins> registry to indicate whether an extension is only applicable to DTLS and to include this document as an additional reference for the registry. </ins> Note: The value "N" in the Recommended column is set because this extension is intended only for specific use cases.  This document <del> describes an extension for DTLS 1.2 only; it is not to TLS (1.3). The DTLS 1.3 functionality is described in I-D.ietf-tls-dtls13. </del> <ins> describes the behavior of this extension for DTLS 1.2 only; it is not applicable to TLS, and its usage for DTLS 1.3 is described in I- D.ietf-tls-dtls13. </ins> IANA is requested to allocate tls12_cid(TBD2) in the "TLS ContentType Registry".  The tls12_cid ContentType is only applicable to DTLS 1.2.


confidence to the receiving peer that the sending peer is reachable at the indicated address and port. <ins> Note however that, irrespective of CID, if RRC has been successfully negotiated by the peers, path validation can be used at any time by either endpoint.  For instance, an endpoint might use RRC to check that a peer is still in possession of its address after a period of quiescence. </ins> 2. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",


I-D.ietf-tls-dtls13.  The presentation language used in this document is described in Section 4 of RFC8446. <ins> This document reuses the definition of "anti-amplification limit" from RFC9000 to mean three times the amount of data received from an unvalidated address.  This includes all DTLS records originating from that source address, excluding discarded ones. </ins> 3. The use of RRC is negotiated via the "rrc" DTLS-only extension.  On


The "return_routability_check" message MUST be authenticated and encrypted using the currently active security context. <del> The receiver that observes the peer's address and or port update MUST </del> <ins> 5. The receiver that observes the peer's address or port update MUST </ins> stop sending any buffered application data (or limit the data sent to <del> a TBD threshold) and initiate the return routability check that proceeds as follows: </del> <ins> the unvalidated address to the anti-amplification limit) and initiate the return routability check that proceeds as follows: </ins> <del> A cookie is placed in a "return_routability_check" message of type path_challenge; </del> <ins> An unpredictable cookie is placed in a "return_routability_check" message of type path_challenge; </ins> <del> The message is sent to the observed new address and a timeout T is started; </del> <ins> The message is sent to the observed new address and a timer T (see timer-choice) is started; </ins> The peer endpoint, after successfully verifying the received <del> "return_routability_check" message echoes the cookie value in a "return_routability_check" message of type path_response; </del> <ins> "return_routability_check" message responds by echoing the cookie value in a "return_routability_check" message of type path_response; </ins> When the initiator receives and verifies the "return_routability_check" message contains the sent cookie, it


After this point, any pending send operation is resumed to the bound peer address. <del> 5. </del> <ins> path-challenge-reqs and path-response-reqs contain the requirements for the initiator and responder roles, broken down per protocol phase. 5.1. The initiator MAY send multiple "return_routability_check" messages of type path_challenge to cater for packet loss on the probed path. Each path_challenge SHOULD go into different transport packets. (Note that the DTLS implementation may not have control over the packetization done by the transport layer.) The transmission of subsequent path_challenge messages SHOULD be paced to decrease the chance of loss. Each path_challenge message MUST contain random data. The initiator MAY use padding using the record padding mechanism available in DTLS 1.3 (and in DTLS 1.2, when CID is enabled on the sending direction) up to the anti-amplification limit to probe if the path MTU (PMTU) for the new path is still acceptable. 5.2. The responder MUST NOT delay sending an elicited path_response message. The responder MUST send exactly one path_response messages for each received path_request. The responder MUST send the path_response on the network path where the corresponding path_challenge has been received, so that validation succeeds only if the path is functional in both directions. The initiator MUST NOT enforce this behaviour The initiator MUST silently discard any invalid path_response it receives. Note that RRC does not cater for PMTU discovery on the reverse path. If the responder wants to do PMTU discovery using RRC, it should initiate a new path validation procedure. 5.3. When setting T, implementations are cautioned that the new path could have a longer round-trip time (RTT) than the original. In settings where there is external information about the RTT of the active path, implementations SHOULD use T = 3xRTT. If an implementation has no way to obtain information regarding the RTT of the active path, a value of 1s SHOULD be used. Profiles for specific deployment environments - for example, constrained networks I-D.ietf-uta-tls13-iot-profile - MAY specify a different, more suitable value. 6. </ins> The example TLS 1.3 handshake shown in fig-handshake shows a client and a server negotiating the support for CID and for the RRC


However, the server wants to test the reachability of the client at his new IP address. <del> 6. </del> <ins> 7. </ins> Note that the return routability checks do not protect against flooding of third-parties if the attacker is on-path, as the attacker


those datagrams are cryptographically authenticated).  On-path adversaries can, in general, pose a harm to connectivity. <del> 7. </del> <ins> 8. </ins> IANA is requested to allocate an entry to the TLS "ContentType" registry, for the "return_routability_check(TBD2)" defined in this


"rrc" extension to the "TLS ExtensionType Values" registry as described in tbl-ext. <del> 8. </del> <ins> 9. </ins> Issues against this document are tracked at https://github.com/tlswg/ dtls-rrc/issues <del> 9. </del> <ins> 10. </ins> We would like to thank Achim Kraus, Hanno Becker, Hanno Boeck, Manuel Pegourie-Gonnard, Mohit Sahni and Rich Salz for their input to this


upper layer protocol MUST NOT write any record that exceeds the maximum record size of 2^14 bytes. <ins> The DTLS record layer SHOULD also allow the upper layer protocol to discover the amount of record expansion expected by the DTLS processing; alternately it MAY report PMTU estimates minus the estimated expansion from the transport layer and DTLS record framing. </ins> Note that DTLS does not defend against spoofed ICMP messages; implementations SHOULD ignore any such messages that indicate PMTUs below the IPv4 and IPv6 minimums of 576 and 1280 bytes respectively <del> The DTLS record layer SHOULD allow the upper layer protocol to discover the amount of record expansion expected by the DTLS processing. If there is a transport protocol indication (either via ICMP or via a refusal to send the datagram as in Section 14 of RFC4340), then the DTLS record layer MUST inform the upper layer protocol of the error. </del> <ins> If there is a transport protocol indication that the PMTU was exceeded (either via ICMP or via a refusal to send the datagram as in Section 14 of RFC4340), then the DTLS record layer MUST inform the upper layer protocol of the error. </ins> The DTLS record layer SHOULD NOT interfere with upper layer protocols performing PMTU discovery, whether via RFC1191 or RFC4821 mechanisms.


DTLS implementations SHOULD follow the following rules: If the DTLS record layer informs the DTLS handshake layer that a <del> message is too big, it SHOULD immediately attempt to fragment it, using any existing information about the PMTU. </del> <ins> message is too big, the handshake layer SHOULD immediately attempt to fragment the message, using any existing information about the PMTU. </ins> If repeated retransmissions do not result in a response, and the PMTU is unknown, subsequent retransmissions SHOULD back off to a


EndOfEarlyData is not necessary to determine when the early data is complete, and because DTLS is lossy, attackers can trivially mount the deletion attacks that EndOfEarlyData prevents in TLS.  Servers <del> SHOULD aggressively age out the epoch 1 keys upon receiving the first epoch 2 record and SHOULD NOT accept epoch 1 data after the first epoch 3 record is received.  (See dtls-epoch for the definitions of each epoch.) </del> <ins> SHOULD NOT accept records from epoch 1 indefinitely once they are able to process records from epoch 3.  Though reordering of IP packets can result in records from epoch 1 arriving after records from epoch 3, this is not likely to persist for very long relative to the round trip time.  Servers could discard epoch 1 keys after the first epoch 3 data arrives, or retain keys for processing epoch 1 data for a short period.  is received.  (See dtls-epoch for the definitions of each epoch.) </ins> 5.6.


provided.  Endpoints MUST NOT have more than one NewConnectionId message outstanding. <del> If the client and server have negotiated use of the "connection_id" extension, either side can request a new CID using the RequestConnectionId message.  In general, implementations SHOULD use a new CID whenever sending on a new path, and SHOULD request new CIDs for this purpose if path changes are anticipated. </del> <ins> Implementations which either did not negotiate the "connection_id" extension or which have negotiated receiving an empty CID MUST NOT send NewConnectionId.  Implementations MUST NOT send RequestConnectionId when sending an empty connection ID. Implementations which detect a violation of these rules MUST terminate the connection with an "unexpected_message" alert. Implementations SHOULD use a new CID whenever sending on a new path, and SHOULD request new CIDs for this purpose if path changes are anticipated. </ins> The number of CIDs desired.


endpoint: Either the client or server of the connection. <ins> epoch: one set of cryptographic keys used for encryption and decryption. </ins> handshake: An initial negotiation between client and server that establishes the parameters of the connection.


MSL: Maximum Segment Lifetime <del> The reader is assumed to be familiar with the TLS 1.3 specification. As in TLS 1.3 the HelloRetryRequest has the same format as a ServerHello message but for convenience we use the term HelloRetryRequest throughout this document as if it were a distinct message. </del> <ins> The reader is assumed to be familiar with TLS13.  As in TLS 1.3, the HelloRetryRequest has the same format as a ServerHello message, but for convenience we use the term HelloRetryRequest throughout this document as if it were a distinct message. </ins> The reader is also assumed to be familiar with I-D.ietf-tls-dtls- connection-id as this document applies the CID functionality to DTLS


The sn_key is computed as follows: [sender] denotes the sending side.  The Secret value to be used is <del> described in Section 7.3 of TLS13. </del> <ins> described in Section 7.3 of TLS13.  Note that a new key is used for each epoch: because the epoch is in the clear, this does not result in ambiguity. </ins> The encrypted sequence number is computed by XORing the leading bytes <del> of the Mask with the sequence number.  Decryption is accomplished by the same process. </del> <ins> of the Mask with the on-the-wire representation of the sequence number.  Decryption is accomplished by the same process. </ins> This procedure requires the ciphertext length be at least 16 bytes. Receivers MUST reject shorter records as if they had failed


configured not to perform a cookie exchange.  The default SHOULD be that the exchange is performed, however.  In addition, the server MAY choose not to do a cookie exchange when a session is resumed or, more <del> generically, when the DTLS handshake uses a PSK-based key exchange. Servers which process 0-RTT requests and send 0.5-RTT responses without a cookie exchange risk being used in an amplification attack if the size of outgoing messages greatly exceeds the size of those that are received.  A server SHOULD limit the amount of data it sends toward a client address before it verifies that the client is able to receive data at that address.  A client address is valid after a cookie exchange or handshake completion.  A server MAY apply a higher limit based on heuristics, such as if the client uses the same IP address as the connection on which the cookie was created.  Clients MUST be prepared to do a cookie exchange with every handshake. </del> <ins> generically, when the DTLS handshake uses a PSK-based key exchange and the IP address matches one associated with the PSK.  Servers which process 0-RTT requests and send 0.5-RTT responses without a cookie exchange risk being used in an amplification attack if the size of outgoing messages greatly exceeds the size of those that are received.  A server SHOULD limit the amount of data it sends toward a client address to three times the amount of data sent by the client before it verifies that the client is able to receive data at that address.  A client address is valid after a cookie exchange or handshake completion.  Clients MUST be prepared to do a cookie exchange with every handshake.  Note that cookies are only valid for the existing handshake and cannot be stored for future handshakes. </ins> If a server receives a ClientHello with an invalid cookie, it MUST terminate the handshake with an "illegal_parameter" alert.  This


where a flight is very large and the receiver is forced to elide acknowledgements for records which have already been ACKed.  As noted above, the receipt of any record responding to a given flight MUST be <del> taken as an implicit acknowledgement for the entire flight. </del> <ins> taken as an implicit acknowledgement for the entire flight to which it is responding. </ins> 7.3.


to "cid_spare", then either existing or new CID MAY be used. Endpoints SHOULD use receiver-provided CIDs in the order they were <del> provided.  Endpoints MUST NOT have more than one NewConnectionId message outstanding. </del> <ins> provided.  Implementations which receive more spare CIDs than they wish to maintain MAY simply discard any extra CIDs.  Endpoints MUST NOT have more than one NewConnectionId message outstanding. </ins> Implementations which either did not negotiate the "connection_id" extension or which have negotiated receiving an empty CID MUST NOT


When a DTLS implementation receives a handshake message fragment corresponding to the next expected handshake message sequence number, <del> it MUST buffer it until it has the entire handshake message.  DTLS implementations MUST be able to handle overlapping fragment ranges. This allows senders to retransmit handshake messages with smaller fragment sizes if the PMTU estimate changes.  Senders MUST NOT change handshake message bytes upon retransmission.  Receivers MAY check that retransmitted bytes are identical and SHOULD abort the handshake with an "illegal_parameter" alert if the value of a byte changes. </del> <ins> it MUST process it, either by buffering it until it has the entire handshake message or by processing any in-order portions of the message.  DTLS implementations MUST be able to handle overlapping fragment ranges.  This allows senders to retransmit handshake messages with smaller fragment sizes if the PMTU estimate changes. Senders MUST NOT change handshake message bytes upon retransmission. Receivers MAY check that retransmitted bytes are identical and SHOULD abort the handshake with an "illegal_parameter" alert if the value of a byte changes. </ins> Note that as with TLS, multiple handshake messages may be placed in the same DTLS record, provided that there is room and that they are


Because the integrity check indirectly depends on a sequence number, if record N is not received, then the integrity check on record N+1 will be based on the wrong sequence number and thus <del> will fail.  DTLS solves this problem by adding explicit sequence numbers. </del> <ins> will fail.  DTLS solves this problem by adding sequence numbers. </ins> The TLS handshake is a lock-step cryptographic handshake. Messages must be transmitted and received in a defined order; any


The DTLSCiphertext structure omits the superfluous version number and type fields. <del> DTLS adds an explicit epoch and sequence number to the TLS record header.  This sequence number allows the recipient to correctly verify the DTLS MAC.  However, the number of bits used for the epoch and sequence number fields in the DTLSCiphertext structure have been reduced. </del> <ins> DTLS adds an epoch and sequence number to the TLS record header. This sequence number allows the recipient to correctly verify the DTLS MAC.  However, the number of bits used for the epoch and sequence number fields in the DTLSCiphertext structure have been reduced. </ins> The DTLSCiphertext structure has a variable length header.


4.2.1. <del> DTLS uses an explicit sequence number, rather than an implicit one, carried in the sequence_number field of the record.  Sequence numbers are maintained separately for each epoch, with each sequence_number initially being 0 for each epoch. </del> <ins> DTLS uses an explicit or partly explicit sequence number, rather than an implicit one, carried in the sequence_number field of the record. Sequence numbers are maintained separately for each epoch, with each sequence_number initially being 0 for each epoch. </ins> The epoch number is initially zero and is incremented each time keying material changes and a sender aims to rekey.  More details are


7.4. <del> The Initiator and the Responder must make sure that unprotected data and metadata do not reveal any sensitive information.  In particular, this applies to AT_KDF, AT_KDF_FS, AT_PUB_ECDHE, and AT_KDF_INPUT. AT_KDF, AT_KDF_FS, and AT_PUB_ECDHE reveals the used cryptographic </del> <ins> Unprotected data and metadata can reveal sensitive information and need to be selected with care.  In particular, this applies to AT_KDF, AT_KDF_FS, AT_PUB_ECDHE, and AT_KDF_INPUT.  AT_KDF, AT_KDF_FS, and AT_PUB_ECDHE reveals the used cryptographic </ins> algorithms, if these depend on the peer identity they leak <del> information about the peer.  AT_KDF_INPUT reveals the network name. An attacker observing network traffic may use such information for traffic flow analysis or to track an endpoint. </del> <ins> information about the peer.  AT_KDF_INPUT reveals the network name, although that is done on purpose to bind the authentication to a particular context. An attacker observing network traffic may use the above types of information for traffic flow analysis or to track an endpoint. </ins> 7.5.


RECOMMENDED to not trust a single source of randomness and to not put unaugmented random numbers on the wire. <ins> Implementations might consider deriving secret and non-secret randomness from different PNRG/PRF/KDF instances to limit the damage if the PNRG/PRF/KDF turns out to be fundamentally broken.  NIST generally forbids deriving secret and non-secret randomness from the same KDF instance, but this decision has been criticized by Krawczyk HKDFpaper and doing so is common practice.  In addition to IVs, other examples are the challenge in EAP-TTLS, the RAND in 3GPP AKAs, and the Session-Id in EAP-TLS 1.3.  Note that part of KEYSTREAM_2 is also non-secret randomness as it is known or predictable to an attacker. As explained by Krawczyk, if any attack is mitigated by the NIST requirement it would mean that the KDF is fully broken and would have to be replaced anyway. </ins> If ECDSA is supported, "deterministic ECDSA" as specified in RFC6979 MAY be used.  Pure deterministic elliptic-curve signatures such as deterministic ECDSA and EdDSA have gained popularity over randomized


payload = MAC_2 CIPHERTEXT_2 is calculated by using the Expand function as a <del> binary additive stream cipher. </del> <ins> binary additive stream cipher over the following plaintext: </ins> <del> plaintext = ( ? PAD, ID_CRED_R / bstr / -24..23, </del> <ins> PLAINTEXT_2 = ( ? PAD, ID_CRED_R / bstr / -24..23, </ins> Signature_or_MAC_2, ? EAD_2 ) If ID_CRED_R contains a single 'kid' parameter, i.e.,


Compute KEYSTREAM_2 = EDHOC-KDF( PRK_2e, TH_2, "KEYSTREAM_2", h'', plaintext_length ), where plaintext_length is the length <del> of the plaintext. </del> <ins> of PLAINTEXT_2. </ins> <del> CIPHERTEXT_2 = plaintext XOR KEYSTREAM_2 </del> <ins> CIPHERTEXT_2 = PLAINTEXT_2 XOR KEYSTREAM_2 </ins> Encode message_2 as a sequence of CBOR encoded data items as specified in asym-msg2-form.


The Initiator SHALL compose message_3 as follows: <del> Compute the transcript hash TH_3 = H(TH_2, CIPHERTEXT_2) where H() </del> <ins> Compute the transcript hash TH_3 = H(TH_2, PLAINTEXT_2) where H() </ins> is the EDHOC hash algorithm of the selected cipher suite.  The transcript hash TH_3 is a CBOR encoded bstr and the input to the <del> hash function is a CBOR Sequence.  Note that H(TH_2, CIPHERTEXT_2) </del> <ins> hash function is a CBOR Sequence.  Note that H(TH_2, PLAINTEXT_2) </ins> can be computed and cached already in the processing of message_2. Compute MAC_3 = EDHOC-KDF( PRK_4x3m, TH_3, "MAC_3", << ID_CRED_I,


Compute a COSE_Encrypt0 object as defined in Sections 5.2 and 5.3 of I-D.ietf-cose-rfc8152bis-struct, with the EDHOC AEAD algorithm of the selected cipher suite, using the encryption key K_3, the <del> initialization vector IV_3, the plaintext P, and the following parameters as input (see COSE): </del> <ins> initialization vector IV_3, the plaintext PLAINTEXT_3, and the following parameters as input (see COSE): </ins> protected = h''


iv_length - length of the initialization vector of the EDHOC AEAD algorithm <del> P = ( ? PAD, ID_CRED_I / bstr / -24..23, Signature_or_MAC_3, ? EAD_3 ) </del> <ins> PLAINTEXT_3 = ( ? PAD, ID_CRED_I / bstr / -24..23, Signature_or_MAC_3, ? EAD_3 ) </ins> If ID_CRED_I contains a single 'kid' parameter, i.e., ID_CRED_I = { 4 : kid_I }, then only the byte string kid_I


Compute a COSE_Encrypt0 as defined in Sections 5.2 and 5.3 of I- D.ietf-cose-rfc8152bis-struct, with the EDHOC AEAD algorithm of the selected cipher suite, using the encryption key K_4, the <del> initialization vector IV_4, the plaintext P, and the following parameters as input (see COSE): </del> <ins> initialization vector IV_4, the plaintext PLAINTEXT_4, and the following parameters as input (see COSE): </ins> protected = h''


iv_length - length of the initialization vector of the EDHOC AEAD algorithm <del> P = ( ? PAD, ? EAD_4 ) </del> <ins> PLAINTEXT_4 = ( ? PAD, ? EAD_4 ) </ins> PAD = 1*true is padding that may be used to hide the length of the unpadded plaintext.


typically that which is not possible to infer from routing information in the lower layers. <ins> EDHOC messages might change in transit due to a noisy channel or through modification by an attacker.  Changes in message_1 and message_2 (except PAD_2) are detected when verifying Signature_or_MAC_2.  Changes to PAD_2 and message_3 are detected when verifying CIPHERTEXT_3.  Changes to message_4 are detected when verifying CIPHERTEXT_4. </ins> Compared to SIGMA, EDHOC adds an explicit method type and expands the message authentication coverage to additional elements such as algorithms, external authorization data, and previous plaintext


4.1.3. <del> The pseudorandom key PRK_out, derived as shown in fig-edhoc-kdf, is the only secret key shared between Initiator and Responder that needs to be stored after a successful EDHOC exchange, see m3.  Keys for applications are derived from PRK_out, see exporter. </del> <ins> The pseudorandom key PRK_out, derived as shown in fig-edhoc-kdf is the output of a successful EDHOC exchange.  Keys for applications are derived from PRK_out, see exporter.  An application using EDHOC- KeyUpdate needs to store PRK_out.  If EDHOC-KeyUpdate is not used, an application only needs to store PRK_out or PRK_exporter as long as EDHOC-Exporter is used.  (Note that the word "store" used here does not imply that the application has access to the plaintext PRK_out since that may be reserved for code within a TEE, see impl-cons). </ins> 4.2.


PRK_exporter is derived from PRK_out: where hash_length denotes the output size in bytes of the EDHOC hash <del> algorithm of the selected cipher suite. PRK_exporter MUST be derived anew from PRK_out if EDHOC-KeyUpdate is used, see keyupdate. </del> <ins> algorithm of the selected cipher suite.  Note that PRK_exporter changes every time EDHOC-KeyUpdate is used, see keyupdate. </ins> The (label, context) pair used in EDHOC-Exporter must be unique, i.e., a (label, context) MUST NOT be used for two different purposes.


4.2.2. To provide forward secrecy in an even more efficient way than re- <del> running EDHOC, EDHOC provides the function EDHOC-KeyUpdate.  When EDHOC-KeyUpdate is called, the old PRK_out is deleted and the new PRK_out is calculated as a "hash" of the old key using the Expand function as illustrated by the following pseudocode: </del> <ins> running EDHOC, EDHOC provides the optional function EDHOC-KeyUpdate. When EDHOC-KeyUpdate is called, a new PRK_out is calculated as a "hash" of the old PRK_out using the Expand function as illustrated by the following pseudocode.  The change of PRK_out causes a change to PRK_exporter and derived keys using EDHOC-Exporter. </ins> where hash_length denotes the output size in bytes of the EDHOC hash algorithm of the selected cipher suite.


The EDHOC-KeyUpdate takes a context as input to enable binding of the updated PRK_out to some event that triggered the keyUpdate.  The Initiator and the Responder need to agree on the context, which can, <del> e.g., be a counter or a pseudorandom number such as a hash.  The Initiator and the Responder also need to cache the old PRK_out until it has verfied that the other endpoint has the correct new PRK_out. </del> <ins> e.g., be a counter or a pseudorandom number such as a hash.  To provide forward secrecy the old PRK_out and derived keys must be deleted as soon as they are not needed.  When to delete the old keys and how to verify that they are not needed is up to the application. </ins> I-D.ietf-core-oscore-key-update describes key update for OSCORE using EDHOC-KeyUpdate.


identifiers from EDHOC SHOULD provide mechanisms to update the connection identifier and MAY provide mechanisms to issue several simultaneously active connection identifiers.  See RFC9000 for a non- <del> constrained example of such mechanisms.  Connection identifiers SHOULD be unpredictable.  Using the same identifier several times is not a problem as long as it is chosen randomly.  Connection identity privacy mechanisms are only useful when there are not fixed identifiers such as IP address or MAC address in the lower layers. </del> <ins> constrained example of such mechanisms.  Connection identifiers can e.g., be chosen randomly among the set of unused 1-byte connection identifiers.  Connection identity privacy mechanisms are only useful when there are not fixed identifiers such as IP address or MAC address in the lower layers. </ins> 8.6.


With static Diffie-Hellman key authentication, the authenticating endpoint can deny having participated in the protocol. <del> Two earlier versions of EDHOC have been formally analyzed Norrman20 Bruni18 and the specification has been updated based on the analysis. </del> <ins> Three earlier versions of EDHOC have been formally analyzed Jacomme23 Norrman20 Bruni18 and the specification has been updated based on the analysis. </ins> 8.2.


member impersonate another group member, but a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways.  A naive sharing of PSKs, even assuming only <del> honest but curious participants know the key, does not enforce any of these properties, bar one.  Endpoint Identity Protection holds vacuously, because the client and server do not use certificates in PSK mode.  (This is not true with use of the "tls_cert_with_extern_psk" extension I-D.ietf-tls-tls13-cert-with- extern-psk.) </del> <ins> honest but curious participants know the key, can violate all these properties, bar one.  Endpoint Identity Protection holds vacuously, because the client and server do not use certificates in PSK mode. (This is not true with use of the "tls_cert_with_extern_psk" extension I-D.ietf-tls-tls13-cert-with-extern-psk.) </ins> In the following sub-sections, we list attacks that demonstrate violations of these properties when the fundamental PSK assumption <del> does not hold.  This list is not exhaustive, but merely highlights a number of potential pitfalls. </del> <ins> does not hold. </ins> 3.1.1.


The attacker intercepts the message and redirects it to "C". <del> "C" responds with to "A". </del> <ins> "C" responds with a "ServerHello" to "A". </ins> "A" sends a "Finished" message to "B".  "A" has completed the handshake, ostensibly with "B".


Let the group of peers who know the key be "A", "B", and "C".  The attack proceeds as follows: <del> "A" sends a "ClientHello" to "B", without including a key share. </del> <ins> "A" sends a "ClientHello" to "B", without including a key share extension. </ins> The handshake completes as expected.


properties outlined above.  The attack violates the same session keys property, as "A" and "B" have each completed a session, ostensibly with each other, and yet do not agree on the session key.  If "A" <del> does not send a key share, then the attacker can have a session with "A" and a separate session with "B", where both sessions have the same key.  This violates the uniqueness of session keys property.  In the case of KCI resistance, where we assume the attacker has compromised "A", the attacker can successfully impersonate "B" to "A" using this pattern. </del> <ins> does not send a key share extension, then the attacker can have a session with "A" and a separate session with "B", where both sessions have the same key.  Since the attacker has knowledge of all of the messages and their content, the nonce in the handshake does not prevent the attacker from computing the full key schedule.  This violates the uniqueness of session keys property.  In the case of KCI resistance, where we assume the attacker has compromised "A", the attacker can successfully impersonate "B" to "A" using this pattern. </ins> 4. <del> Given the desired security goals from sec-properties, applications which make use of external PSKs MUST adhere to the following requirements: </del> <ins> To achieve the security goals from sec-properties when the external PSK will not be combined with a pairwise secret value, applications MUST use external PSKs that adhere to the following requirements: </ins> Each PSK MUST NOT be shared between with more than two logical nodes.  As a result, an agent that acts as both a client and a


Each PSK MUST be at least 128-bits long. <del> Each PSK SHOULD be seeded from a source with at least 128-bits of entropy. </del> 5. PSK privacy properties are orthogonal to security properties


appearing in cleartext in a ClientHello.  As a result, a passive adversary can link two or more connections together that use the same external PSK on the wire.  Applications should take precautions when <del> using external PSKs if these risks are a concern. </del> <ins> using external PSKs if these risks. </ins> In addition to linkability in the network, external PSKs are intrinsically linkable by PSK receivers.  Specifically, servers can


First Use (TOFU) approach with a device completely unprotected before the first login did take place).  Many devices have very limited UI.  For example, they may only have a numeric keypad or <del> perhaps an interface with even fewer buttons.  When the TOFU approach is not suitable, entering the key may require typing it on a very constrained UI.  Moreover, PSK production lacks guidance unlike user passwords. </del> <ins> even less number of buttons.  When the TOFU approach is not suitable, entering the key would require typing it on a constrained UI.  Moreover, PSK production lacks guidance unlike user passwords. </ins> Some devices are provisioned PSKs via an out-of-band, cloud-based syncing protocol.


1. <del> This document provides usage guidance for external Pre-Shared Keys (PSKs) in TLS.  It lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks.  This document also discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions. </del> <ins> There are many resources that provide guidance for password generation and verification aimed towards improving security. However, there is no such equivalent for external Pre-Shared Keys (PSKs) in TLS.  This document aims to reduce that gap.  It lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks. This document also discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  It provides advice for applications in various use cases to help meet these assumptions. </ins> The guidance provided in this document is applicable across TLS RFC8446, DTLS I-D.ietf-tls-dtls13, and Constrained TLS I-D.ietf-tls-


6. <del> Pre-shared Key (PSK) ciphersuites were first specified for TLS in 2005.  Now, PSK is an integral part of the TLS version 1.3 specification RFC8446.  TLS 1.3 also uses PSKs for session resumption.  It distinguishes these resumption PSKs from external PSKs which have been provisioned out-of-band (OOB).  Below, we list some example use-cases where pair-wise external PSKs (i.e., external PSKs that are shared between only one server and one client) have been used for authentication in TLS. </del> <ins> PSK ciphersuites were first specified for TLS in 2005.  Now, PSKs are an integral part of the TLS version 1.3 specification RFC8446.  TLS 1.3 also uses PSKs for session resumption.  It distinguishes these resumption PSKs from external PSKs which have been provisioned out- of-band (OOB).  Below, we list some example use-cases where pair-wise external PSKs (i.e., external PSKs that are shared between only one server and one client) have been used for authentication in TLS. </ins> Device-to-device communication with out-of-band synchronized keys. PSKs provisioned out-of-band for communicating with known


limited UI.  For example, they may only have a numeric keypad or even less number of buttons.  When the TOFU approach is not suitable, entering the key would require typing it on a <del> constrained UI.  Moreover, PSK production lacks guidance unlike user passwords. </del> <ins> constrained UI. </ins> Some devices provision PSKs via an out-of-band, cloud-based syncing protocol.


Keys (PSKs) in Transport Layer Security (TLS) 1.3 RFC8446.  This guidance also applies to Datagram TLS (DTLS) 1.3 I-D.ietf-tls-dtls13 and Compact TLS 1.3 I-D.ietf-tls-ctls.  For readability, this <del> document uses the term TLS to refer to all such versions.  External PSKs are symmetric secret keys provided to the TLS protocol </del> <ins> document uses the term TLS to refer to all such versions. External PSKs are symmetric secret keys provided to the TLS protocol </ins> implementation as external inputs.  External PSKs are provisioned <del> out-of-band.  This document lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks.  This document discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  This document also provides advice for applications in various use cases to help meet these assumptions. </del> <ins> out-of-band. This document lists TLS security properties provided by PSKs under certain assumptions and demonstrates how violations of these assumptions lead to attacks.  This document discusses PSK use cases, provisioning processes, and TLS stack implementation support in the context of these assumptions.  This document also provides advice for applications in various use cases to help meet these assumptions. </ins> There are many resources that provide guidance for password generation and verification aimed towards improving security.


This document provides usage guidance for external Pre-Shared Keys (PSKs) in Transport Layer Security (TLS) 1.3 as defined in RFC 8446. <del> This document lists TLS security properties provided by PSKs under certain assumptions, and then demonstrates how violations of these assumptions lead to attacks.  This document discusses PSK use cases and provisioning processes.  This document provides advice for applications to help meet these assumptions.  This document also lists the privacy and security properties that are not provided by TLS 1.3 when external PSKs are used. </del> <ins> It lists TLS security properties provided by PSKs under certain assumptions, and then demonstrates how violations of these assumptions lead to attacks.  Advice for applications to help meet these assumptions is provided.  It also discusses PSK use cases and provisioning processes.  Finally, it lists the privacy and security properties that are not provided by TLS 1.3 when external PSKs are used. </ins> 1.


If PSK is not combined with fresh ephemeral key exchange, then compromise of any group member allows the attacker to passively <del> read (and actively modify) all traffic. </del> <ins> read (and actively modify) all traffic, including past traffic. </ins> Additionally, a malicious non-member can reroute handshakes between honest group members to connect them in unintended ways, as described


value and the receiving member's known identity.  See Selfie for details. <del> To illustrate the rerouting attack, consider the group of peers who know the PSK be "A", "B", and "C".  The attack proceeds as follows: </del> <ins> To illustrate the rerouting attack, consider three peers, "A", "B", and "C", who all know the PSK.  The attack proceeds as follows: </ins> "A" sends a "ClientHello" to "B".


Entropy properties of external PSKs may also affect TLS security properties.  For example, if a high entropy PSK is used, then PSK- only key establishment modes provide expected security properties for <del> TLS, including, for example, including establishing the same session keys between peers, secrecy of session keys, peer authentication, and downgrade protection.  See RFC8446, Section E.1 for an explanation of these properties.  However, these modes lack forward security. Forward security may be achieved by using a PSK-DH mode, or, alternatively, by using PSKs with short lifetimes. </del> <ins> TLS, including establishing the same session keys between peers, secrecy of session keys, peer authentication, and downgrade protection.  See RFC8446, Section E.1 for an explanation of these properties.  However, these modes lack forward security.  Forward security may be achieved by using a PSK-DH mode, or, alternatively, by using PSKs with short lifetimes. </ins> In contrast, if a low entropy PSK is used, then PSK-only key establishment modes are subject to passive exhaustive search attacks


This section lists some example use-cases where pair-wise external PSKs, i.e., external PSKs that are shared between only one server and <del> one client, have been used for authentication in TLS. </del> <ins> one client, have been used for authentication in TLS.  There was no attempt to prioritize the examples in any particular order. </ins> Device-to-device communication with out-of-band synchronized keys. PSKs provisioned out-of-band for communicating with known


different online protocol. Intra-data-center communication.  Machine-to-machine communication <del> within a single data center or PoP may use externally provisioned PSKs, primarily for the purposes of supporting TLS connections with early data; see security-con for considerations when using early data with external PSKs. </del> <ins> within a single data center or point-of-presence (PoP) may use externally provisioned PSKs, primarily for the purposes of supporting TLS connections with early data; see security-con for considerations when using early data with external PSKs. </ins> Certificateless server-to-server communication.  Machine-to- machine communication may use externally provisioned PSKs,


PSK into the devices, or using a Trust On First Use (TOFU) approach with a device completely unprotected before the first login did take place.  Many devices have very limited UI.  For <del> example, they may only have a numeric keypad or even less number of buttons.  When the TOFU approach is not suitable, entering the key would require typing it on a constrained UI. </del> <ins> example, they may only have a numeric keypad or even fewer buttons.  When the TOFU approach is not suitable, entering the key would require typing it on a constrained UI. </ins> Some devices provision PSKs via an out-of-band, cloud-based syncing protocol. <del> Some secrets may be baked into or hardware or software device </del> <ins> Some secrets may be baked into hardware or software device </ins> components.  Moreover, when this is done at manufacturing time, secrets may be printed on labels or included in a Bill of Materials for ease of scanning or import.


identifiers have privacy implications; see endpoint-privacy. Each endpoint SHOULD know the identifier of the other endpoint with <del> which its wants to connect and SHOULD compare it with the other </del> <ins> which it wants to connect and SHOULD compare it with the other </ins> endpoint's identifier used in ImportedIdentity.context.  It is however important to remember that endpoints sharing the same group PSK can always impersonate each other.


The method the client instance uses to send an access token depends on whether the token is bound to a key, and if so which proofing method is associated with the key.  This information is conveyed in <del> the "key" and "proof" parameters in response-token-single. </del> <ins> the "bound" and "key" parameters in response-token-single and response-token-multiple responses. </ins> <del> If the "key" value is the boolean "false", the access token is a bearer token sent using the HTTP Header method defined in RFC6750. </del> <ins> If the "bound" value is the boolean "true" and the "key" is absent, the access token MUST be sent using the same key and proofing mechanism that the client instance used in its initial request (or its most recent rotation). </ins> <del> The form parameter and query parameter methods of RFC6750 MUST NOT be used. </del> <ins> If the "bound" value is the boolean "true" and the "key" value is an object as described in key-format, the access token MUST be sent using the key and proofing mechanism defined by the value of the "proof" field within the key object. </ins> <del> If the "key" value is the boolean "true", the access token MUST be sent using the same key and proofing mechanism that the client instance used in its initial request (or its most recent rotation). </del> <ins> The access token MUST be sent using the HTTP "Authorization" request header field and the "GNAP" authorization scheme along with a key proof as described in binding-keys for the key bound to the access token.  For example, a "jwsd"-bound access token is sent as follows: </ins> <del> If the "key" value is an object as described in key-format, the value of the "proof" field within the key indicates the particular proofing mechanism to use.  The access token is sent using the HTTP authorization scheme "GNAP" along with a key proof as described in binding-keys for the key bound to the access token.  For example, a "jwsd"-bound access token is sent as follows: </del> <ins> If the "bound" value is the boolean "false", the access token is a bearer token that MUST be sent using the "Authorization Request Header Field" method defined in RFC6750. The "Form-Encoded Body Parameter" and "URI Query Parameter" methods of RFC6750 MUST NOT be used. </ins> [[ See issue #104 [47] ]] <ins> The client software MUST reject as an error a situation where the "bound" value is the boolean "false" and the "key" is present. </ins> 7.3. Any keys presented by the client instance to the AS or RS MUST be


REQUIRED.  A unique access token for continuing the request, in the format specified in response-token-single.  This access token MUST be bound to the client instance's key used in the request and <del> MUST NOT be a "bearer" token.  As a consequence, the "bound" field of this access token is always the boolean value "true" and the </del> <ins> MUST NOT be a "bearer" token.  As a consequence, the "flags" array of this access token MUST NOT contain the string "bearer" and the </ins> "key" field MUST be omitted.  This access token MUST NOT be usable at resources outside of the AS.  The client instance MUST present the access token in all requests to the continuation URI as


ASCII characters to facilitate transmission over HTTP headers within other protocols without requiring additional encoding. <del> RECOMMENDED.  Flag indicating if the token is bound to the client instance's key.  If the boolean value is "true" or the field is omitted, and the "key" field is omitted, the token is bound to the request-client in its request for access.  If the boolean value is "true" or the field is omitted, and the "key" field is present, the token is bound to the key and proofing mechanism indicated in the "key" field.  If the boolean value is "false", the token is a bearer token with no key bound to it and the "key" field MUST be omitted. </del> REQUIRED for multiple access tokens, OPTIONAL for single access token.  The value of the "label" the client instance provided in the associated request-token, if present.  If the token has been


MUST be able to dereference or process the key information in order to be able to sign the request. <ins> OPTIONAL.  A set of flags that represent attributes or behaviors of the access token issued by the AS. The values of the "flags" field defined by this specification are as follows: This flag indicates whether the token is bound to the client instance's key.  If the "bearer" flag is present, the access token is a bearer token, and the "key" field in this response MUST be omitted.  If the "bearer" flag is omitted and the "key" field in this response is omitted, the token is bound the request-client in its request for access.  If the "bearer" flag is omitted, and the "key" field is present, the token is bound to the key and proofing mechanism indicated in the "key" field. </ins> OPTIONAL.  Flag indicating a hint of AS behavior on token <del> rotation.  If this flag is set to the value "true", then the client instance can expect a previously-issued access token to continue to work after it has been rotate-access-token or the underlying grant request has been continue-modify, resulting in the issuance of new access tokens.  If this flag is set to the boolean value "false" or is omitted, the client instance can </del> <ins> rotation.  If this flag is present, then the client instance can expect a previously-issued access token to continue to work after it has been rotate-access-token or the underlying grant request has been continue-modify, resulting in the issuance of new access tokens.  If this flag is omitted, the client instance can </ins> anticipate a given access token will stop working after token rotation or grant request modification.  Note that a token flagged as "durable" can still expire or be revoked through any normal


unless the client instance has specifically requested it by use of the "split" flag. <ins> Flag values MUST NOT be included more than once. Additional flags can be defined by extensions using IANA. </ins> The following non-normative example shows a single access token bound to the client instance's key used in the initial request, with a management URL, and that has access to three described resources (one


sends the "split" flag as described in request-token-single. If the AS has split the access token response, the response MUST <del> include the "split" flag set to "true". </del> <ins> include the "split" flag. </ins> [[ See issue #69 [17] ]]


multiple access token structure containing one access token. If the AS has split the access token response, the response MUST <del> include the "split" flag set to "true". </del> <ins> include the "split" flag in the "flags" array. </ins> Each access token MAY be bound to different keys with different proofing mechanisms.


Indicates that interaction through some set of defined mechanisms needs to take place. <del> Claims about the RO as known and declared by the AS. </del> <ins> Claims about the RO as known and declared by the AS, as described in response-subject. </ins> An identifier this client instance can use to identify itself when making future requests. <del> An identifier this client instance can use to identify its current end-user when making future requests. </del> An error code indicating that something has gone wrong. In this example, the AS is returning an response-interact-redirect, a


If information about the RO is requested and the AS grants the client instance access to that data, the AS returns the approved information <del> in the "subject" response field.  This field is an object with the following OPTIONAL properties. </del> <ins> in the "subject" response field.  The AS MUST return the "subject" field only in cases where the AS is sure that the RO and the end-user are the same party.  This can be accomplished through some forms of authorization. This field is an object with the following OPTIONAL properties. </ins> An array of subject identifiers for the RO, as defined by I- D.ietf-secevent-subject-identifiers.


information through an identity API.  The definition of such an identity API is out of scope for this specification. <del> The AS MUST return the "subject" field only in cases where the AS is sure that the RO and the end-user are the same party.  This can be accomplished through some forms of authorization. </del> Subject identifiers returned by the AS SHOULD uniquely identify the RO at the AS.  Some forms of subject identifier are opaque to the client instance (such as the subject of an issuer and subject pair),


All dynamically generated handles are returned as fields in the root JSON object of the response.  This specification defines the <del> following dynamic handle returns, additional handles can be defined in IANA. </del> <ins> following dynamic handle return, additional handles can be defined in IANA. </ins> A string value used to represent the information in the "client" object that the client instance can use in a future request, as described in request-instance. <del> A string value used to represent the current user.  The client instance can use in a future request, as described in request- user-reference. This non-normative example shows two handles along side an issued </del> <ins> This non-normative example shows one handle along side an issued </ins> access token. [[ See issue #77 [23] ]]


REQUIRED.  The URI at which the client instance can make continuation requests.  This URI MAY vary per request, or MAY be <del> stable at the AS if the AS includes an access token.  The client instance MUST use this value exactly as given when making a continue-request. </del> <ins> stable at the AS.  The client instance MUST use this value exactly as given when making a continue-request. </ins> RECOMMENDED.  The amount of time in integer seconds the client instance SHOULD wait after receiving this continuation handle and


If the AS determines that the request cannot be issued for any reason, it responds to the client instance with an error message. <del> The error code is one of the following, with additional values available in IANA: </del> [[ See issue #79 [15] ]] 3.7.


Any keys presented by the client instance to the AS or RS MUST be validated as part of the request in which they are presented.  The <del> type of binding used is indicated by the proof parameter of the key object in key-format.  Values defined by this specification are as follows: </del> <ins> type of binding used is indicated by the "proof" parameter of the key object in key-format.  This parameter is formally specified by an object with at least the following member: Individual methods MAY define additional parameters as members in this object. Values for the "method" defined by this specification are as follows: </ins> Additional proofing methods are defined by IANA. <ins> For example, the "httpsig" method can be specified with its parameters as: If additional parameters are not required or used for a specific method, the method MAY be passed as a string instead of an object. For example, the "mtls" method with no additional parameters could be sent by the client instance as: The AS would map this to the equivalent expanded form as follows: </ins> All key binding methods used by this specification MUST cover all relevant portions of the request, including anything that would change the nature of the request, to allow for secure validation of


7.3.1. <del> This method is indicated by "httpsig" in the "proof" field.  The signer creates an HTTP Message Signature as described in I-D.ietf- httpbis-message-signatures. </del> <ins> This method is indicated by the method value "httpsig".  The signer creates an HTTP Message Signature as described in I-D.ietf-httpbis- message-signatures.  This method defines the following parameters: </ins> The covered components of the signature MUST include the following:


7.3.2. <del> This method is indicated by "mtls" in the "proof" field.  The signer presents its TLS client certificate during TLS negotiation with the verifier. </del> <ins> This method is indicated by the method value "mtls".  This method defines no additional parameters.  The signer presents its TLS client certificate during TLS negotiation with the verifier. </ins> In this example, the certificate is communicated to the application through the "Client-Cert" header from a TLS reverse proxy, leading to


7.3.3. <del> This method is indicated by "jwsd" in the "proof" field.  A JWS RFC7515 object is created as follows: </del> <ins> This method is indicated by the method value "jwsd".  This method defines no additional parameters.  A JWS RFC7515 object is created as follows: </ins> To protect the request, the JOSE header of the signature contains the following claims:


7.3.4. <del> This method is indicated by "jws" in the "proof" field.  A JWS RFC7515 object is created as follows: </del> <ins> This method is indicated by the method value "jws".  This method defines no additional parameters.  A JWS RFC7515 object is created as follows: </ins> To protect the request, the JWS header contains the following claims.


This document contains non-normative examples of partial and complete HTTP messages, JSON structures, URLs, query components, keys, and <del> other elements.  Some examples use a single trailing backslash '' to </del> <ins> other elements.  Some examples use a single trailing backslash "" to </ins> indicate line wrapping for long values, as per RFC8792.  The "" character and leading spaces on wrapped lines are not part of the value.


This section defines how proxies operate in a group communication scenario.  In particular, sec-proxy-forward defines operations of forward-proxies, while sec-proxy-reverse defines operations of <del> reverse-proxies. </del> <ins> reverse-proxies.  Security operations for a proxy are discussed later in chap-proxy-security. </ins> 3.5.1.


groupcomm, and it is RECOMMENDED to perform them according to the approach described in I-D.ietf-ace-key-groupcomm-oscore. <ins> 5.3. Different solutions may be selected for secure group communication via a proxy depending on proxy type, use case and deployment requirements.  In this section the options based on Group OSCORE are listed. For a client performing a group communication request via a forward- proxy, end-to-end security should be implemented.  The client then creates a group request protected with Group OSCORE and unicasts this to the proxy.  The proxy adapts the request from a forward-proxy request to a regular request and multicasts this adapted request to the indicated CoAP group.  During the adaptation, the security provided by Group OSCORE persists, in either case of using the group mode or using the pairwise mode.  The first leg of communication from client to proxy can optionally be further protected, e.g., by using (D)TLS and/or OSCORE. For a client performing a group communication request via a reverse- proxy, either end-to-end-security or hop-by-hop security can be implemented.  The case of end-to-end security is the same as for the forward-proxy case. The case of hop-by-hop security is only possible if the proxy can be completely trusted and it is configured as a member of the OSCORE security group(s) that it needs to access, on behalf of clients.  The first leg of communication between client and proxy is then protected with a security method for CoAP unicast, such as (D)TLS, OSCORE or a combination of such methods.  The second leg between proxy and servers is protected using Group OSCORE.  This can be useful in applications where for example the origin client does not implement Group OSCORE, or the group management operations are confined to a particular network domain and the client is outside this domain. For all the above cases, more details on using Group OSCORE are defined in I-D.tiloca-core-groupcomm-proxy. </ins> 6. This section provides security considerations for CoAP group


secure delegation.  The zone signing and secure delegation may be performed either by the Homenet Naming Authority or by the Outsourcing Infrastructure. sec-dnssec-deplyment discusses these two <del> alternatives. sec-views discusses the consequences of publishing multiple representations of the same zone also commonly designated as views.  This section provides guidance to limit the risks associated with multiple views.  sec-reverse discusses management of the reverse zone. sec-renumbering discusses how renumbering should be handled. </del> <ins> alternatives. sec-reverse discusses management of the reverse zone. sec-renumbering discusses how renumbering should be handled. </ins> Finally, sec-privacy and sec-security respectively discuss privacy and security considerations when outsourcing the Homenet Zone. <ins> The Homenet Zone is expected to host public information only.  It is not the scope of this DNS service to define local home network boundaries.  Instead, local scope information is expected to be provided to the home network using local scope naming services. mDNS RFC6762 DNS-SD RFC6763 are two examples of these services.  Currently mDNS is limited to a single link network.  However, future protocols are expected to leverage this constraint as pointed out in RFC7558. </ins> 3. Customer Premises Equipment: (CPE) is a router providing