Draft: draft-ietf-tls-dtls-connection-id

Commentary: Remove 1.3 references ( based on Hannes 's PR ) ; Protect CID ; Initial sketch for explicit marking of CID records using ad hoc CTs . 
 I also do not understand that 
 Sorry , you 're right . It needs to be in the MAC , but not the key derivation 
 I do n't think we need to include the CID in the MAC since the CID is just the key name . In regular DTLS the 5 tuple is the key name and we do n't include it in the MAC calculation either . If someone fakes a packet and places a wrong CID in there then they MAC will just fail since either ( a ) the wrong key will be looked up or ( b ) no key is found at all . In either case there is no issue .
Paragraph (version B):
This document specifies the Connection ID construct for the Datagram
Transport Layer Security (DTLS) protocol.  I-D.ietf-tls-dtls13
specifies the Connection ID for DTLS version 1.3.
Paragraph (version A):
In the current version of DTLS, the IP address and port of the peer
is used to identify the DTLS association.  Unfortunately, in some
cases, such as NAT rebinding, these values are insufficient.  This is
a particular issue in the Internet of Things when the device needs to
enter extended sleep periods to increase the battery lifetime and is
therefore subject to rebinding.  This leads to connection failure,
with the resulting cost of a new handshake.
Paragraph (version A):
This document defines an extension to DTLS to add a connection ID to
each DTLS record.  The presence of the connection ID is negotiated
via a DTLS extension.  It also defines a DTLS 1.3 post-handshake
message to change connection ids.
Paragraph (version B):
In the current version of DTLS, the IP address and port of the peer
are used to identify the DTLS association.  Unfortunately, in some
cases, such as NAT rebinding, these values are insufficient.  This is
a particular issue in the Internet of Things when devices enter
extended sleep periods to increase their battery lifetime.  The NAT
rebinding leads to connection failure, with the resulting cost of a
new handshake.
Paragraph (version B):
This document defines an extension to DTLS to add a connection ID to
the DTLS record layer.  The presence of the connection ID is
negotiated via a DTLS extension.
Paragraph (version A):
The reader is assumed to be familiar with the DTLS specifications
since this document defines an extension to DTLS 1.2 and DTLS 1.3.
Paragraph (version B):
The reader is assumed to be familiar with DTLS RFC6347.
Paragraph (version A):
The extension_data field of this extension, when included in the
ClientHello, MUST contain the CID structure, which contains the CID
which the client wishes the server to use when sending messages
towards it.  A zero-length value indicates that the client is
prepared to send with a connection ID but does not wish the server to
use one when sending (alternately, this can be interpreted as the
client wishes the server to use a zero-length CID; the result is the
same).
Paragraph (version B):
The extension_data field of this extension, when included in the
ClientHello, MUST contain the CID structure, which carries the CID
which the client wishes the server to use when sending messages
towards it.  A zero-length value indicates that the client is
prepared to send with a connection ID but does not wish the server to
use one when sending (alternately, this can be interpreted as the
client wishes the server to use a zero-length CID; the result is the
same).
Paragraph (version A):
A server which is willing to use CIDs will respond with its own
"connection_id" extension, containing the CID which it wishes the
client to use when sending messages towards it.  A zero-length value
indicates that the server will send with the client's CID but does
not wish the client to use a CID (or again, alternately, to use a
zero-length CID).
Paragraph (version B):
A server which is willing to use CIDs will respond with its own
"connection_id" extension, containing the CID it wishes the client to
use when sending messages towards it.  A zero-length value indicates
that the server will send with the client's CID but does not wish the
client to use a CID (or again, alternately, to use a zero-length
CID).
Paragraph (version A):
This is effectively the simplest possible design that will work.
Previous design ideas for using cryptographically generated session
ids, either using hash chains or public key encryption, were
dismissed due to their inefficient designs.  Note that a client
always has the chance to fall-back to a full handshake or more
precisely to a handshake that uses session resumption (DTLS 1.2
language) or to a PSK-based handshake using the ticket-based
approach.
Paragraph (version B):
This is effectively the simplest possible design that will work.
Previous design ideas for using cryptographically generated session
ids, either using hash chains or public key encryption, were
dismissed due to their inefficient designs.  Note that a client
always has the chance to fall back to a full handshake or more
precisely to a handshake that uses session resumption.
Paragraph (version A):
In DTLS 1.2, connection ids are exchanged at the beginning of the
DTLS session only.  There is no dedicated "connection id update"
message that allows new connection ids to be established mid-session,
because DTLS 1.2 in general does not allow post-handshake messages
that do not themselves begin other handshakes.  In DTLS 1.3, which
does allow such messages, we use post-handshake message to update the
connection ID post-handshake-messages and to request new IDs.
Paragraph (version A):
DTLS 1.2 peers switch to the new record layer format when encryption
is enabled.  The same is true for DTLS 1.3 but since the DTLS 1.3
enables encryption early in the handshake phase the connection ID
will be enabled earlier.  For this reason, the connection ID needs to
go in the DTLS 1.3 ServerHello.
Paragraph (version A):
Indicates the CID which the sender wishes the peer to use.
Paragraph (version A):
Indicates whether the new CID should be used immediately or is a
spare.  If usage is set to "cid_immediate", then the new CID MUST
be used immediately for all future records.  If it is set to
"cid_spare", then either CID MAY be used, as described in sec-
cons.
Paragraph (version A):
If the client and server have negotiated the "connection_id"
extension, either side can request a new CID using the
RequestConnectionId message.
Paragraph (version A):
Endpoints SHOULD respond to RequestConnectionId by sending a
NewConnectionId with usage "cid_spare" as soon as possible.  Note
that an endpoint MAY ignore requests which it considers excessive
(though they MUST be ACKed as usual).
Paragraph (version A):
This extension is applicable for use with DTLS 1.2 and DTLS 1.3.
This extension can be used with the optimized DTLS 1.3 record layer
format.
Paragraph (version A):
dtls-record12 and dtls-record13 illustrate the record formats of DTLS
1.2 and DTLS 1.3, respectively.
Paragraph (version A):
Besides the "cid" field, all other fields are defined in the DTLS 1.2
and DTLS 1.3 specifications.
Paragraph (version A):
Note that for both record formats, it is not possible to parse the
records without knowing if the connection ID is in use and how long
it is.
Paragraph (version A):
Below is an example exchange for DTLS 1.3 using a single connection
id in each direction.
Paragraph (version A):
Below is an example exchange for DTLS 1.2 using a connection id used
uni-directionally from the client to the server.
Paragraph (version B):
In DTLS, connection ids are exchanged at the beginning of the DTLS
session only.  There is no dedicated "connection id update" message
that allows new connection ids to be established mid-session, because
DTLS in general does not allow TLS 1.3-style post-handshake messages
that do not themselves begin other handshakes.  DTLS peers switch to
the new record layer format when encryption is enabled.
Paragraph (version B):
This extension is applicable for use with DTLS and dtls-record12
illustrates the record format.
Paragraph (version B):
Note that for both record formats, it is not possible to parse the
records without knowing how long the Connection ID is.
Paragraph (version B):
dtls-example2 shows an example exchange where a connection id used
uni-directionally from the client to the server in DTLS 1.2.
Paragraph (version A):
An on-path adversary, who is able to observe the DTLS 1.2 protocol
exchanges between the DTLS client and the DTLS server, is able to
link the observed payloads to all subsequent payloads carrying the
same connection id pair (for bi-directional communication).  In DTLS
of course those IDs are immediately used on the wire.  Without multi-
homing and mobility the use of the connection id is not different to
the use of the 5-tuple.
Paragraph (version A):
With multi-homing, an adversary is able to correlate the
communication interaction over the two paths, which adds further
privacy concerns.  In order to prevent this, implementations SHOULD
attempt to use fresh connection IDs whenever they change local
addresses or ports (though this is not always possible to detect).
In DTLS 1.3, The RequestConnectionId message can be used to ask for
new IDs in order to ensure that you have a pool of suitable IDs.
Paragraph (version A):
This document does not change the security properties of DTLS 1.2
RFC6347 and DTLS 1.3 I-D.ietf-tls-dtls13.  It merely provides a more
robust mechanism for associating an incoming packet with a stored
security context.
Paragraph (version B):
An on-path adversary, who is able to observe the DTLS protocol
exchanges between the DTLS client and the DTLS server, is able to
link the observed payloads to all subsequent payloads carrying the
same connection id pair (for bi-directional communication).  Without
multi-homing or mobility, the use of the connection id is not
different to the use of the 5-tuple.
Paragraph (version B):
With multi-homing, an adversary is able to correlate the
communication interaction over the two paths, which adds further
privacy concerns.  In order to prevent this, implementations SHOULD
attempt to use fresh connection IDs whenever they change local
addresses or ports (though this is not always possible to detect).
Paragraph (version B):
This document does not change the security properties of DTLS
RFC6347.  It merely provides a more robust mechanism for associating
an incoming packet with a stored security context.