]> Ericsson AB

Sweden goran.selander@ericsson.com

Ericsson AB

Sweden john.mattsson@ericsson.com

INRIA

France malisa.vucinic@inria.fr

INRIA

France geovane.fedrecheski@inria.fr

Sandelman Software Works

Canada mcr+ietf@sandelman.ca

Security LAKE Working Group Internet-Draft This document describes a procedure for authorizing enrollment of new devices using the lightweight authenticated key exchange protocol Ephemeral Diffie-Hellman Over COSE (EDHOC). The procedure is applicable to zero-touch onboarding of new devices to a constrained network leveraging trust anchors installed at manufacture time. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the Lightweight Authenticated Key Exchange Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction For constrained IoT deployments the overhead and processing contributed by security protocols may be significant which motivates the specification of lightweight protocols that are optimizing, in particular, message overhead (see ). This document describes a procedure for augmenting the lightweight authenticated Diffie-Hellman key exchange EDHOC with third party-assisted authorization. The procedure involves a device, a domain authenticator, and an enrollment server. The device and domain authenticator perform mutual authentication and authorization, assisted by the enrollment server which provides relevant authorization information to the device (a "voucher") and to the authenticator. The high-level model is similiar to BRSKI . In this document we consider the target interaction for which authorization is needed to be "enrollment", for example joining a network for the first time (e.g., ), but it can be applied to authorize other target interactions. The enrollment server may represent the manufacturer of the device, or some other party with information about the device from which a trust anchor has been pre-provisioned into the device. The (domain) authenticator may represent the service provider or some other party controlling access to the network in which the device is enrolling. The protocol assumes that authentication between device and authenticator is performed with EDHOC , and defines the integration of a lightweight authorization procedure using the External Authorization Data (EAD) fields defined in EDHOC. The protocol enables a low message count by performing authorization and enrollment in parallel with authentication, instead of in sequence which is common for network access. It further reuses protocol elements from EDHOC leading to reduced message sizes on constrained links. This protocol is applicable to a wide variety of settings, and can be mapped to different authorization architectures.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. Readers are expected to have an understanding of CBOR and EDHOC . Appendix C.1 of contains some basic info about CBOR.

Problem Description The (potentially constrained) device (U) wants to enroll into a domain over a constrained link. The device authenticates and enforces authorization of the (non-constrained) domain authenticator (V) with the help of a voucher conveying authorization information. The voucher has a similar role as in but should be considerably more compact. The domain authenticator, in turn, authenticates the device and authorizes its enrollment into the domain. The procedure is assisted by a (non-constrained) enrollment server (W) located in a non-constrained network behind the domain authenticator, e.g. on the Internet, providing information to the device (the voucher) and to the domain authenticator as part of the protocol. The objective of this document is to specify such a protocol which is lightweight over the constrained link by reusing elements of EDHOC and by shifting message overhead to the non-constrained side of the network. See illustration in . Note the cardinality of the involved parties. It is expected that the authenticator needs to handle a large unspecified number of devices, but for a given device type or manufacturer it is expected that one or a few nodes host enrollment servers.

Overview of message flow. EDHOC is used on the constrained link between U and V. Voucher Info and Voucher are sent in EDHOC External Authorization Data (EAD). The link between V and W is not constrained. | Domain +---------->| Enrollment | | |<---o-------+ Authenticator |<----------+ Server | | (U) +----+------>| (V) | Voucher | (W) | | | | | | Response | | +----------+ | +---------------+ +---------------+ Voucher ]]>

Assumptions The protocol is based on the following pre-existing relations between the device (U), the domain authenticator (V) and the enrollment server (W), see .

• U and W have an explicit relation: U is configured with a public key of W, see .
• V and W have an implicit relation, e.g., based on web PKI with trusted CA certificates, see .
• U and V need not have any previous relation, this protocol establishes a relation between U and V.

Each of the three parties can gain protected communication with the other two during the protocol. V may be able to access credentials over non-nonstrained networks, but U may be limited to constrained networks. Implementations wishing to leverage the zero-touch capabilities of this protocol are expected to support transmission of credentials from V to U by value during the EDHOC exchange, which will impact the message size depending on type of credential used.

Overview of pre-existing relations. | | | +----+-----+ +---------------+ +-------+-------+ | | | | | | | Device | con- | Domain | not con- | Enrollment | | | strained | Authenticator | strained | Server | | (U) | network | (V) | network | (W) | | | | | | | +----+-----+ +-------+-------+ +-------+-------+ | | | | <----------------------> | <------------------------> | No previous relation Implicit relation (e.g., web PKI based) ]]>

Device (U) To authenticate to V, the device (U) runs EDHOC in the role of Initiator with authentication credential CRED_U, for example, an X.509 certificate or a CBOR Web Token (CWT, ). CRED_U may, for example, be carried in ID_CRED_I of EDHOC message_3 or be provisioned to V over a non-constrained network, see bottom of . U also needs to identify itself to W, this device identifier is denoted by ID_U. The purpose of ID_U is for W to be able to determine if the device with this identifier is authorized to enroll with V. ID_U may be a reference to CRED_U, like ID_CRED_I in EDHOC (see ), or a device identifier from a different name space, such as EUI-64 identifiers. U is also provisioned with information about W:

• A static public DH key of W (G_W) used to establish secure communication with the enrollment server (see ).
• Location information about the enrollment server (LOC_W) that can be used by V to reach W. This is typically a URI but may alternatively be only the domain name.

Domain Authenticator (V) To authenticate to U, the domain authenticator (V) runs EDHOC in the role of Responder with an authentication credential CRED_V, which is a CWT Claims Set containing a public key of V, see . This proves to U the possession of the private key corresponding to the public key of CRED_V. CRED_V typically needs to be transported to U in EDHOC (using ID_CRED_R = CRED_V, see ) since there is no previous relation between U and V. V and W need to establish a secure (confidentiality and integrity protected) connection for the Voucher Request/Response protocol. Furthermore, W needs access the same credential CRED_V as V used with U, and V needs to prove to W the possession of the private key corresponding to the public key of CRED_V. It is RECOMMENDED that V authenticates to W using the same credential CRED_V as with U.

• V and W may protect the Voucher Request/Response protocol using TLS 1.3 with client authentication if CRED_V is an X.509 certificate of a signature public key. However, note that CRED_V may not be a valid credential to use with TLS 1.3, e.g., when U and V run EDHOC with method 1 or 3, where the public key of CRED_V is a static Diffie-Hellman key.
• V may run EDHOC with W using ID_CRED_I = CRED_V. In this case the secure connection between V and W may be based on OSCORE .

Note that both TLS 1.3 and EDHOC may be run between V and W during this setup procedure. For example, W may authenticate to V using TLS 1.3 with server certificates signed by a CA trusted by V, and then V may run EDHOC using CRED_V over the secure TLS connection to W, see . Note also that the secure connection between V and W may be long lived and reused for multiple voucher requests/responses. Other details of proof-of-possession related to CRED_V and transport of CRED_V are out of scope of this document.

Enrollment Server (W) The enrollment server (W) is assumed to have the private DH key corresponding to G_W, which is used to establish secure communication with the device (see ). W provides to U the authorization decision for enrollment with V in the form of a voucher (see ). Authorization policies are out of scope for this document. Authentication credentials and communication security with V is described in . To calculate the voucher, W needs access to message_1 and CRED_V as used in the EDHOC session between U and V, see .

• W MUST verify that CRED_V is bound to the secure connection between W and V
• W MUST verify that V is in possession of the private key corresponding to the public key of CRED_V

W needs to be available during the execution of the protocol between U and V.

The Protocol

Overview The protocol consist of three security sessions going on in parallel:

1. The EDHOC session between device (U) and (domain) authenticator (V)
2. Voucher Request/Response between authenticator (V) and enrollment server (W)
3. An exchange of voucher-related information, including the voucher itself, between device (U) and enrollment server (W), mediated by the authenticator (V).

provides an overview of the message flow detailed in this section. An outline of EDHOC is given in .

Overview of the protocol: W-assisted authorization of U and V to each other: EDHOC between U and V, and Voucher Request/Response between V and W. Before the protocol, V and W are assumed to have established a secure channel and performed proof-of-possession of relevant keys. Credential lookup of CRED_U may involve W or other credential database. | | | (e.g., TLS with server cert.) | | | | | | Proof of possession w.r.t. CRED | | +<--- --- --- --- --- --- --- -->| | | (e.g., EDHOC) | | | | | | | | | | ------------------------------------------------------------------------ CORE PROTOCOL | | | | EDHOC message_1 | | +----------------------------->| | | (EAD_1 = LOC_W, ENC_U_INFO) | | | | | | | Voucher Request (VREQ) | | +-------------------------------------->| | | (message_1, ?opaque_state) | | | | | | Voucher Response (VRES) | | |<--------------------------------------+ | | (message_1, Voucher, ?opaque_state) | | | | | EDHOC message_2 | | |<-----------------------------+ | | (EAD_2 = Voucher) | | | | | | | | | EDHOC message_3 | | +----------------------------->| | | | | ------------------------------------------------------------------------ | | | | Credential | | Database | | | | | ID_CRED_I from message_3 | | +--- --- --- --- --- --- --- -->| | | | | | CRED_U | | |<-- --- --- --- --- --- --- ---+ | | | | | | ]]>

Reuse of EDHOC The protocol illustrated in reuses several components of EDHOC:

• G_X, the ephemeral public Diffie-Hellman key of U, is also used in the protocol between U and W.
• SUITES_I includes the cipher suite for EDHOC selected by U, and also defines the algorithms used between U and W (see ):
  • EDHOC AEAD algorithm: used to encrypt ID_U
  • EDHOC hash algorithm: used for key derivation and to calculate the voucher
  • EDHOC MAC length in bytes: length of the voucher
  • EDHOC key exchange algorithm: used to calculate the shared secret between U and W
• EAD_1, EAD_2 are the External Authorization Data message fields of message_1 and message_2, respectively, see . This document specifies the EAD items with ead_label = TBD1, see ).
• ID_CRED_I and ID_CRED_R are used to identify the authentication credentials CRED_U and CRED_V, respectively. As shown at the bottom of , V may use W to obtain CRED_U. CRED_V is transported in ID_CRED_R in message_2, see .

The protocol also reuses the EDHOC-Extract and EDHOC-Expand key derivation from EDHOC (see ).

• The intermediate pseudo-random key PRK is derived using EDHOC-Extract():
  • PRK = EDHOC-Extract(salt, IKM)
    • where salt = 0x (the zero-length byte string)
    • IKM is computed as an ECDH cofactor Diffie-Hellman shared secret from the public key of W, G_W, and the private key corresponding to G_X (or v.v.), see Section 5.7.1.2 of .

The output keying material OKM is derived from PRK using EDHOC-Expand(), which is defined in terms of the EDHOC hash algorithm of the selected cipher suite, see :

• OKM = EDHOC-Expand(PRK, info, length) where

Stateless Operation of V V may act statelessly with respect to U: the state of the EDHOC session started by U may be dropped at V until authorization from W is received. Once V has received EDHOC message_1 from U and extracted LOC_W from EAD_1, message_1 is forwarded unmodified to W in the form of a Voucher Request. V encapsulates the internal state that it needs to later respond to U, and sends that to W together with EDHOC message_1. This state typically contains U's IP address and port number, together with any other implementation-specific parameter needed by V to respond to U. At this point, V can drop the EDHOC session that was initiated by U. V MUST encrypt and integrity protect the encapsulated state using a uniformly-distributed (pseudo-)random key, known only to itself. How V serializes and encrypts its internal state is out of scope of this specification. For example, V may use the existing CBOR and COSE libraries. Editor's note: Consider to include an example of serialized internal state. W sends to V the voucher together with echoed message_1, as received from U, and V's internal state. This allows V to act as a simple message relay until it has obtained the authorization from W to enroll U. The reception of a successful Voucher Response at V from W implies the authorization for V to enroll U. At this point, V can initialize a new EDHOC session with U, based on the message and the state retrieved from the Voucher Response from W.

Device <-> Enrollment Server (U <-> W) The protocol between U and W is carried between U and V in message_1 and message_2 (), and between V and W in the Voucher Request/Response (). The data is protected between the endpoints using secret keys derived from a Diffie-Hellman shared secret (see ) as further detailed in this section.

Voucher Info The external authorization data EAD_1 contains an EAD item with ead_label = TBD1 and ead_value = Voucher_Info, which is a CBOR byte string: where

• LOC_W is a text string used by V to locate W, e.g., a URI or a domain name.
• ENC_U_INFO is a byte string containing an encrypted identifier of U and, optionally, opaque application data prepared by U. It is calculated as follows:

ENC_U_INFO is 'ciphertext' of COSE_Encrypt0 () computed from the following:

• The encryption key K_1 and nonce IV_1 are derived as specified below.
• 'protected' is a byte string of size 0
• 'plaintext' and 'external_aad' as below:

where

• ID_U is an identifier of the device, see .
• OPAQUE_INFO is an opaque field provided by the application. If present, it will contain application data that U may want to convey to W, e.g., enrollment hints, see . Note that OPAQUE_INFO is opaque when viewed as an information element in EDHOC. It is opaque to V, while the application in U and W can read its contents. The same applies to other references of OPAQUE_INFO throughout this document.
• SS is the selected cipher suite in SUITES_I of EDHOC message_1, see .

The external_aad is wrapped in an enc_structure as defined in . Editor's note: Add more context to external_aad. The derivation of K_1 = EDHOC-Expand(PRK, info, length) uses the following input to the info struct (see OKM in ):

• info_label = 0
• context = h'' (the empty CBOR string)
• length is length of key of the EDHOC AEAD algorithm in bytes (which is the length of K_1)

The derivation of IV_1 = EDHOC-Expand(PRK, info, length) uses the following input to the info struct (see OKM in ):

• info_label = 1
• context = h'' (the empty CBOR string)
• length is length of nonce of the EDHOC AEAD algorithm in bytes (which is the length of IV_1)

Voucher The voucher is an assertion to U that W has authorized V. The voucher consists of the 'ciphertext' field of a COSE_Encrypt0 object: Its corresponding plaintext value consists of an opaque field that can be used by W to convey information to U, such as a voucher scope. The authentication tag present in the ciphertext is also bound to message_1 and the credential of V. The external authorization data EAD_2 contains an EAD item with ead_label = TBD1 and ead_value = Voucher, which is computed from the following:

• The encryption key K_2 and nonce IV_2 are derived as specified below.
• 'protected' is a byte string of size 0
• 'plaintext' and 'external_aad' as below:

where

• OPAQUE_INFO is an opaque field provided by the application.
• H(message_1) is the hash of EDHOC message_1, calculated from the associated voucher request, see .
• CRED_V is the CWT Claims Set containing the public authentication key of V, see

The derivation of K_2 = EDHOC-Expand(PRK, info, length) uses the following input to the info struct (see ):

• info_label = 2
• context = h'' (the empty CBOR string)
• length is length of key of the EDHOC AEAD algorithm in bytes

The derivation of IV_2 = EDHOC-Expand(PRK, info, length) uses the following input to the info struct (see ):

• info_label = 3
• context = h'' (the empty CBOR string)
• length is length of nonce of the EDHOC AEAD algorithm in bytes

Device <-> Authenticator (U <-> V) This section describes the processing in U and V, which include the EDHOC protocol, see . Normal EDHOC processing is omitted here.

Message 1

Processing in U U composes EDHOC message_1 using authentication method, identifiers, etc. according to an agreed application profile, see . The selected cipher suite, in this document denoted SS, applies also to the interaction with W as detailed in , in particular, with respect to the Diffie Hellman key agreement algorithm used between U and W. As part of the normal EDHOC processing, U generates the ephemeral public key G_X which is reused in the interaction with W, see . The device sends EDHOC message_1 with EAD item (-TBD1, Voucher_Info) included in EAD_1, where Voucher_Info is specified in . The negative sign indicates that the EAD item is critical, see .

Processing in V V receives EDHOC message_1 from U and processes it as specified in , with the additional step of processing the EAD item in EAD_1. Since the EAD item is critical, if V does not recognize it or it contains information that V cannot process, then V MUST abort the EDHOC session, see . Otherwise, the ead_label = TBD1, triggers the voucher request to W as described in . The exchange between V and W needs to be completed successfully for the EDHOC session to be continued.

Message 2

Processing in V V receives the voucher response from W as described in . V sends EDHOC message_2 to U with the critical EAD item (-TBD1, Voucher) included in EAD_2, where the Voucher is specified in . CRED_V is a CWT Claims Set containing the public authentication key of V encoded as a COSE_Key in the 'cnf' claim, see . ID_CRED_R contains the CWT Claims Set with 'kccs' as COSE header_map, see .

Processing in U U receives EDHOC message_2 from V and processes it as specified in , with the additional step of processing the EAD item in EAD_2. If U does not recognize the EAD item or the EAD item contains information that U cannot process, then U MUST abort the EDHOC session, see . Otherwise U MUST verify the Voucher by performing the same calculation as in using H(message_1) and CRED_V received in ID_CRED_R of message_2. If the voucher calculated in this way is not identical to what was received in message_2, then U MUST abort the EDHOC session.

Message 3

Processing in U If all verifications are passed, then U sends EDHOC message_3. EDHOC message_3 may be combined with an OSCORE request, see .

Processing in V V performs the normal EDHOC verifications of message_3. V may retrieve CRED_U from a Credential Database, after having learnt ID_CRED_I from U.

Authenticator <-> Enrollment Server (V <-> W) It is assumed that V and W have set up a secure connection, W has accessed the authentication credential CRED_V to be used in the EDHOC session between V and with U, and that W has verified that V is in possession of the private key corresponding to CRED_V, see and . V and W run the Voucher Request/Response protocol over the secure connection.

Voucher Request

Processing in V V sends the voucher request to W. The Voucher Request SHALL be a CBOR array as defined below: where

• message_1 is the EDHOC message_1 as it was received from U.
• opaque_state is OPTIONAL and represents the serialized and encrypted opaque state needed by V to statelessly respond to U after the reception of Voucher_Response.

Processing in W W receives and parses the voucher request received over the secure connection with V. The voucher request essentially contains EDHOC message_1 as sent by U to V. W SHALL NOT process message_1 as if it was an EDHOC message intended for W. W extracts from message_1:

• SS - the selected cipher suite, which is the (last) integer of SUITES_I.
• G_X - the ephemeral public key of U
• ENC_U_INFO - the encryption of (1) the device identifier ID_U and (2) the optional OPAQUE_INFO field, contained in the Voucher_Info field of the EAD item with ead_label = TBD1 (with minus sign indicating criticality)

W verifies and decrypts ENC_U_INFO using the relevant algorithms of the selected cipher suite SS (see ), and obtains ID_U. In case OPAQUE_INFO is present, it is made available to the application. W calculates the hash of message_1 H(message_1), and associates this session identifier to the device identifier ID_U. If H(message_1) is not unique among session identifiers associated to this device identifier of U, the EDHOC session SHALL be aborted. W uses ID_U to look up the associated authorization policies for U and enforces them. This is out of scope for the specification.

Voucher Response

Processing in W W retrieves CRED_V associated to the secure connection with V, and constructs the the Voucher for the device with identifier ID_U (see ). W generates the voucher response and sends it to V over the secure connection. The Voucher_Response SHALL be a CBOR array as defined below: where

• message_1 is the EDHOC message_1 as it was received from V.
• The Voucher is defined in .
• opaque_state is the echoed byte string opaque_state from Voucher_Request, if present.

Processing in V V receives the voucher response from W over the secure connection. If present, V decrypts and verifies opaque_state as received from W. If that verification fails then EDHOC is aborted. If the voucher response is successfully received from W, then V responds to U with EDHOC message_2 as described in .

Error Handling This section specifies a new EDHOC error code and how it is used in the proposed protocol.

EDHOC Error "Access denied" This section specifies the new EDHOC error "Access denied", see .

EDHOC error code and error information for ‘Access denied’.

Error code TBD3 is used to indicate to the receiver that access control has been applied and the sender has aborted the EDHOC session. The ERR_INFO field contains error_content which is a CBOR Sequence consisting of an integer and an optional byte string. The purpose of REJECT_INFO is for the sender to provide verifiable and actionable information to the receiver about the error, so that an automated action may be taken to enable access.

REJECT_TYPE and REJECT_INFO for ‘Access denied’.

Error handling in W, V, and U This protocol uses the EDHOC Error "Access denied" in the following way:

• W generates error_content and transfers it to V via the secure connection. If REJECT_TYPE is 1, then REJECT_INFO is encrypted from W to U using the EDHOC AEAD algorithm.
• V receives error_content, prepares an EDHOC "Access denied" error, and sends it to U.
• U receives the error message and extracts the error_content. If REJECT_TYPE is 1, then U decrypts REJECT_INFO, based on which it may retry to gain access.

The encryption of REJECT_INFO follows a procedure analogous to the one defined in , with the following differences: where

• OPAQUE_INFO is an opaque field that contains actionable information about the error. It may contain, for example, a list of suggested Vs through which U should join instead.
• H(message_1) is the hash of EDHOC message_1, calculated from the associated voucher request, see .

REST Interface at W The interaction between V and W is enabled through a RESTful interface exposed by W. This RESTful interface MAY be implemented using either HTTP or CoAP. V SHOULD access the resources exposed by W through the protocol indicated by the scheme in LOC_W URI.

Scheme "https" In case the scheme indicates "https", V MUST perform a TLS handshake with W and use HTTP. If the authentication credential CRED_V can be used in a TLS handshake, e.g. an X.509 certificate of a signature public key, then V SHOULD use it to authenticate to W as a client. If the authentication credential CRED_V cannot be used in a TLS handshake, e.g. if the public key is a static Diffie-Hellman key, then V SHOULD first perform a TLS handshake with W using available compatible keys. V MUST then perform an EDHOC session over the TLS connection proving to W the possession of the private key corresponding to CRED_V. Performing the EDHOC session is only necessary if V did not authenticate with CRED_V in the TLS handshake with W. Editor's note: Clarify that performing TLS handshake is not necessary for each device request; if there already is a TLS connection between V and W that should be reused. Similar considerations for 5.2 and 5.3.

Scheme "coaps" In case the scheme indicates "coaps", V SHOULD perform a DTLS handshake with W and access the resources defined in using CoAP. The normative requirements in on performing the DTLS handshake and EDHOC session remain the same, except that TLS is replaced with DTLS.

Scheme "coap" In case the scheme indicates "coap", V SHOULD perform an EDHOC session with W, as specified in and access the resources defined in using OSCORE and CoAP. The authentication credential in this EDHOC session MUST be CRED_V.

URIs The URIs defined below are valid for both HTTP and CoAP. W MUST support the use of the path-prefix "/.well-known/", as defined in , and the registered name "lake-authz". A valid URI in case of HTTP thus begins with

• "https://www.example.com/.well-known/lake-authz"

In case of CoAP with DTLS:

• "coaps://example.com/.well-known/lake-authz"

In case of EDHOC and OSCORE:

• "coap://example.com/.well-known/lake-authz"

Each operation specified in the following is indicated by a path-suffix.

Voucher Request (/voucherrequest) To request a voucher, V MUST issue a request:

• Method is POST
• Payload is the serialization of the Voucher Request object, as specified in .
• Content-Format (Content-Type) is set to "application/lake-authz-voucherrequest+cbor"

In case of successful processing at W, W MUST issue a 200 OK response with payload containing the serialized Voucher Response object, as specified in .

Certificate Request (/certrequest) V requests the public key certificate of U from W through the "/certrequest" path-suffix. To request U's authentication credential, V MUST issue a request:

• Method is POST
• Payload is the serialization of the ID_CRED_I object, as received in EDHOC message_3.

In case of a successful lookup of the authentication credential at W, W MUST issue 200 OK response with payload containing the serialized CRED_U.

Security Considerations This specification builds on and reuses many of the security constructions of EDHOC, e.g., shared secret calculation and key derivation. The security considerations of EDHOC apply with modifications discussed here. EDHOC provides identity protection of the Initiator, here the device. The encryption of the device identifier ID_U in the first message should consider potential information leaking from the length of ID_U, either by making all identifiers having the same length or the use of a padding scheme. Although W learns about the identity of U after receiving VREQ, this information must not be disclosed to V, until U has revealed its identity to V with ID_CRED_I in message_3. W may be used for lookup of CRED_U from ID_CRED_I, or this credential lookup function may be separate from the authorization function of W, see . The trust model used here is that U decides to which V it reveals its identity. In an alternative trust model where U trusts W to decide to which V it reveals U's identity, CRED_U could be sent in Voucher Response. As noted in an ephemeral key may be used to calculate several ECDH shared secrets. In this specification the ephemeral key G_X is also used to calculate G_XW, the shared secret with the enrollment server. The private ephemeral key is thus used in the device for calculations of key material relating to both the authenticator and the enrollment server. There are different options for where to implement these calculations, one option is as an addition to EDHOC, i.e., to extend the EDHOC API in the device with input of public key of W (G_W) and device identifier of U (ID_U), and produce the encryption of ID_U which is included in Voucher_Info in EAD_1.

IANA Considerations

EDHOC External Authorization Data Registry IANA has registered the following entry in the "EDHOC External Authorization Data" registry under the group name "Ephemeral Diffie- Hellman Over COSE (EDHOC)". The ead_label = TBD1 corresponds to the ead_value Voucher_Info in EAD_1, and Voucher in EAD_2 with processing specified in and , respectively, of this document. Addition to the EDHOC EAD registry

Label	Value Type	Description
TBD1	bstr	Voucher related information

The Well-Known URI Registry IANA has registered the following entry in "The Well-Known URI Registry", using the template from :

• URI suffix: lake-authz
• Change controller: IETF
• Specification document: [[this document]]
• Related information: None

Well-Known Name Under ".arpa" Name Space This document allocates a well-known name under the .arpa name space according to the rules given in and . The name "lake-authz.arpa" is requested. No subdomains are expected, and addition of any such subdomains requires the publication of an IETF Standards Track RFC. No A, AAAA, or PTR record is requested.

Media Types Registry IANA has added the media types "application/lake-authz-voucherrequest+cbor" to the "Media Types" registry.

application/lake-authz-voucherrequest+cbor Media Type Registration

• Type name: application
• Subtype name: lake-authz-voucherrequest+cbor
• Required parameters: N/A
• Optional paramaters: N/A
• Encoding considerations: binary
• Security cosniderations: See of this document.
• Interoperability considerations: N/A
• Published specification: [[this document]] (this document)
• Application that use this media type: To be identified
• Fragment identifier considerations: N/A
• Additional information:
  • Magic number(s): N/A
  • File extension(s): N/A
  • Macintosh file type code(s): N/A
• Person & email address to contact for further information: See "Authors' Addresses" section.
• Intended usage: COMMON
• Restrictions on usage: N/A
• Author: See "Authors' Addresses" section.
• Change Controller: IESG

CoAP Content-Formats Registry IANA has added the media type "application/lake-authz-voucherrequest+cbor" to the "CoAP Content-Formats" registry under the registry group "Constrained RESTful Environments (CoRE) Parameters". Addition to the CoAP Content-Formats registry

Media Type	Encoding	ID	Reference
application/lake-authz-voucherrequest+cbor	-	TBD2	[[this document]]

References Normative References This document defines a strategy to securely assign a pledge to an owner using an artifact signed, directly or indirectly, by the pledge's manufacturer. This artifact is known as a "voucher". This document defines an artifact format as a YANG-defined JSON document that has been signed using a Cryptographic Message Syntax (CMS) structure. Other YANG-derived formats are possible. The voucher artifact is normally generated by the pledge's manufacturer (i.e., the Manufacturer Authorized Signing Authority (MASA)). This document only defines the voucher artifact, leaving it to other documents to describe specialized protocols for accessing it. CBOR Web Token (CWT) is a compact means of representing claims to be transferred between two parties. The claims in a CWT are encoded in the Concise Binary Object Representation (CBOR), and CBOR Object Signing and Encryption (COSE) is used for added application-layer security protection. A claim is a piece of information asserted about a subject and is represented as a name/value pair consisting of a claim name and a claim value. CWT is derived from JSON Web Token (JWT) but uses CBOR rather than JSON. The Concise Binary Object Representation (CBOR) is a data format whose design goals include the possibility of extremely small code size, fairly small message size, and extensibility without the need for version negotiation. These design goals make it different from earlier binary serializations such as ASN.1 and MessagePack. This document obsoletes RFC 7049, providing editorial improvements, new details, and errata fixes while keeping full compatibility with the interchange format of RFC 7049. It does not create a new version of the format. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need to be able to define basic security services for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. This document, along with RFC 9053, obsoletes RFC 8152. This document defines Object Security for Constrained RESTful Environments (OSCORE), a method for application-layer protection of the Constrained Application Protocol (CoAP), using CBOR Object Signing and Encryption (COSE). OSCORE provides end-to-end protection between endpoints communicating using CoAP or CoAP-mappable HTTP. OSCORE is designed for constrained nodes and networks supporting a range of proxy operations, including translation between different transport protocols. Although an optional functionality of CoAP, OSCORE alters CoAP options processing and IANA registration. Therefore, this document updates RFC 7252. Ericsson AB Ericsson AB Ericsson AB This document specifies Ephemeral Diffie-Hellman Over COSE (EDHOC), a very compact and lightweight authenticated Diffie-Hellman key exchange with ephemeral keys. EDHOC provides mutual authentication, forward secrecy, and identity protection. EDHOC is intended for usage in constrained scenarios and a main use case is to establish an OSCORE security context. By reusing COSE for cryptography, CBOR for encoding, and CoAP for transport, the additional code size can be kept very low. Informative References In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This memo describes the management and operational requirements for the address and routing parameter area ("arpa") domain. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. This document describes what it means to say that a Domain Name (DNS name) is reserved for special use, when reserving such a name is appropriate, and the procedure for doing so. It establishes an IANA registry for such domain names, and seeds it with entries for some of the already established special domain names. The Internet Protocol Suite is increasingly used on small devices with severe constraints on power, memory, and processing resources, creating constrained-node networks. This document provides a number of basic terms that have been useful in the standardization work for constrained-node networks. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. This memo defines a path prefix for "well-known locations", "/.well-known/", in selected Uniform Resource Identifier (URI) schemes. In doing so, it obsoletes RFC 5785 and updates the URI schemes defined in RFC 7230 to reserve that space. It also updates RFC 7595 to track URI schemes that support well-known URIs in their registry. This document specifies automated bootstrapping of an Autonomic Control Plane. To do this, a Secure Key Infrastructure is bootstrapped. This is done using manufacturer-installed X.509 certificates, in combination with a manufacturer's authorizing service, both online and offline. We call this process the Bootstrapping Remote Secure Key Infrastructure (BRSKI) protocol. Bootstrapping a new device can occur when using a routable address and a cloud service, only link-local connectivity, or limited/disconnected networks. Support for deployment models with less stringent security requirements is included. Bootstrapping is complete when the cryptographic identity of the new key infrastructure is successfully deployed to the device. The established secure connection can be used to deploy a locally issued certificate to the device as well. This document describes the minimal framework required for a new device, called a "pledge", to securely join a 6TiSCH (IPv6 over the Time-Slotted Channel Hopping mode of IEEE 802.15.4) network. The framework requires that the pledge and the JRC (Join Registrar/Coordinator, a central entity), share a symmetric key. How this key is provisioned is out of scope of this document. Through a single CoAP (Constrained Application Protocol) request-response exchange secured by OSCORE (Object Security for Constrained RESTful Environments), the pledge requests admission into the network, and the JRC configures it with link-layer keying material and other parameters. The JRC may at any time update the parameters through another request-response exchange secured by OSCORE. This specification defines the Constrained Join Protocol and its CBOR (Concise Binary Object Representation) data structures, and it describes how to configure the rest of the 6TiSCH communication stack for this join process to occur in a secure manner. Additional security mechanisms may be added on top of this minimal framework. Ericsson RISE AB RISE AB Fraunhofer AISEC Ericsson The lightweight authenticated key exchange protocol Ephemeral Diffie- Hellman Over COSE (EDHOC) can be run over the Constrained Application Protocol (CoAP) and used by two peers to establish a Security Context for the security protocol Object Security for Constrained RESTful Environments (OSCORE). This document details this use of the EDHOC protocol, by specifying a number of additional and optional mechanisms. These especially include an optimization approach for combining the execution of EDHOC with the first OSCORE transaction. This combination reduces the number of round trips required to set up an OSCORE Security Context and to complete an OSCORE transaction using that Security Context. Inria Ericsson AB Ericsson AB Odin Solutions S.L. This document compiles the requirements for a lightweight authenticated key exchange protocol for OSCORE. This draft has completed a working group last call (WGLC) in the LAKE working group. Post-WGLC, the requirements are considered sufficiently stable for the working group to proceed with its work. It is not currently planned to publish this draft as an RFC. n.d.

Use with Constrained Join Protocol (CoJP) This section outlines how the protocol is used for network enrollment and parameter provisioning. An IEEE 802.15.4 network is used as an example of how a new device (U) can be enrolled into the domain managed by the domain authenticator (V).

Use of draft-ietf-lake-authz with CoJP. | | | Optional network solicitation | | |<-----------------------------------+ | | Network discovery | | | | | +----------------------------------->| | | EDHOC message_1 | | | +----------------------------->| | | Voucher Request (VREQ) | | |<-----------------------------+ | | Voucher Response (VRES) | |<-----------------------------------+ | | EDHOC message_2 | | | | | | | | +----------------------------------->| | | EDHOC message_3 + CoJP request | | | | | +<-----------------------------------| | | CoJP response | | | ]]>

Network Discovery When a device first boots, it needs to discover the network it attempts to join. The network discovery procedure is defined by the link-layer technology in use. In case of Time-slotted Channel Hopping (TSCH) networks, a mode of , the device scans the radio channels for Enhanced Beacon (EB) frames, a procedure known as passive scan. EBs carry the information about the network, and particularly the network identifier. Based on the EB, the network identifier, the information pre-configured into the device, the device makes the decision on whether it should join the network advertised by the received EB frame. This process is described in . In case of other, non-TSCH modes of IEEE 802.15.4 it is possible to use the active scan procedure and send solicitation frames. These solicitation frames trigger the nearest network coordinator to respond by emitting a beacon frame. The network coordinator emitting beacons may be multiple link-layer hops away from the domain authenticator (V), in which case it plays the role of a Join Proxy (see ). Join Proxy does not participate in the protocol and acts as a transparent router between the device and the domain authenticator. For simplicity, illustrates the case when the device and the domain authenticator are a single hop away and can communicate directly.

The Enrollment Protocol with Parameter Provisioning

Flight 1 Once the device has discovered the network it wants to join, it constructs the EDHOC message_1, as described in . The device SHALL map the message to a CoAP request:

• The request method is POST.
• The type is Confirmable (CON).
• The Proxy-Scheme option is set to "coap".
• The Uri-Host option is set to "lake-authz.arpa". This is an anycast type of identifier of the domain authenticator (V) that is resolved to its IPv6 address by the Join Proxy.
• The Uri-Path option is set to ".well-known/edhoc".
• The payload is the (true, EDHOC message_1) CBOR sequence, where EDHOC message_1 is constructed as defined in .

Flight 2 The domain authenticator receives message_1 and processes it as described in . The message triggers the exchange with the enrollment server, as described in . If the exchange between V and W completes successfully, the domain authenticator prepares EDHOC message_2, as described in . The authenticator SHALL map the message to a CoAP response:

• The response code is 2.04 Changed.
• The payload is the EDHOC message_2, as defined in .

Flight 3 The device receives EDHOC message_2 and processes it as described in }. Upon successful processing of message_2, the device prepares flight 3, which is an OSCORE-protected CoJP request containing an EDHOC message_3, as described in . EDHOC message_3 is prepared as described in . The OSCORE-protected payload is the CoJP Join Request object specified in . OSCORE protection leverages the OSCORE Security Context derived from the EDHOC session, as specified in Appendix A of . To that end, specifies that the Sender ID of the client (device) must be set to the connection identifier selected by the domain authenticator, C_R. OSCORE includes the Sender ID as the kid in the OSCORE option. The network identifier in the CoJP Join Request object is set to the network identifier obtained from the network discovery phase. In case of IEEE 802.15.4 networks, this is the PAN ID. The device SHALL map the message to a CoAP request:

• The request method is POST.
• The type is Confirmable (CON).
• The Proxy-Scheme option is set to "coap".
• The Uri-Host option is set to "lake-authz.arpa".
• The Uri-Path option is set to ".well-known/edhoc".
• The EDHOC option is set and is empty.
• The payload is prepared as described in , with EDHOC message_3 and the CoJP Join Request object as the OSCORE-protected payload.

Note that the OSCORE Sender IDs are derived from the connection identifiers of the EDHOC session. This is in contrast with where ID Context of the OSCORE Security Context is set to the device identifier (pledge identifier). Since the device identity is exchanged during the EDHOC session, and the certificate of the device is communicated to the authenticator as part of the Voucher Response message, there is no need to transport the device identity in OSCORE messages. The authenticator playing the role of the JRC obtains the device identity from the execution of the authorization protocol.

Flight 4 Flight 4 is the OSCORE response carrying CoJP response message. The message is processed as specified in .

Enrollment Hints This section defines items that can be used in the OPAQUE_INFO field of either EAD_1 or the Access Denied error response. The purpose of the proposed items is to improve protocol scalability, aiming to reduce battery usage and enrollment delay. The main use case is when several potential gateways (V) are detected by U's radio, which can lead to U trying to enroll (and failing) several times until it finds a suitable V.

Domain Authenticator hints In case W denies the enrollment of U to a given V, a list of Domain Authenticator hints (v_hint) can be sent from W to U. The hint is optional and is included in the REJECT_INFO item in the Access Denied error message. It consists of a list of application-defined identifiers of V (e.g. MAC addresses, SSIDs, PAN IDs, etc.), as defined below: v_hint = [ 1* bstr ]

Device Hints U may send a Device hint (u_hint) so that it can help W to select which Vs to include in v_hint. This can be useful in large scale scenarios with many gateways (V). The hint is an optional field included in the OPAQUE_INFO field within EAD_1, and it must be encrypted. The hint itself is application dependent, and can contain GPS coordinates, application-specific tags, the list of Vs detected by U, or other relevant information. It is defined as follows: u_hint: [ 1* bstr ]

Examples This section presents high level examples of the protocol execution. Note: the examples below include samples of access policies used by W. These are provided for the sake of completeness only, since the authorization mechanism used by W is out of scope in this document.

Minimal This is a simple example that demonstrates successful execution of the protocol. Premises:

• device u1 has ID_U = key id = 14
• the access policy in W specifies, via a list of ID_U, that device u1 can enroll via any domain authenticator, i.e., the list contains ID_U = 14. In this case, the policy only specifies a restriction in terms of U, effectively allowing enrollment via any V.

Execution:

1. device u1 discovers a gateway (v1) and tries to enroll
2. gateway v1 identifies the zero-touch join attempt by checking that the label of EAD_1 = TBD1, and prepares a Voucher Request using the information contained in the value of EAD_1
3. upon receiving the request, W obtains ID_U = 14, authorizes the access, and replies with Voucher Response

Wrong gateway In this example, a device u1 tries to enroll a domain via gateway v1, but W denies the request because the pairing (u1, v1) is not configured in its access policies. This example also illustrates how the REJECT_INFO field of the EDHOC error Access Denied could be used, in this case to suggest that the device should select another gateway for the join procedure. Premises:

• devices and gateways communicate via Bluetooth Low Energy (BLE), therefore their network identifers are MAC addresses (EUI-48)
• device u1 has ID_U = key id = 14
• there are 3 gateways in the radio range of u1:
  • v1 with MAC address = A2-A1-88-EE-97-75
  • v2 with MAC address = 28-0F-70-84-51-E4
  • v3 with MAC address = 39-63-C9-D0-5C-62
• the access policy in W specifies, via a mapping of shape (ID_U; MAC1, MAC2, ...) that device u1 can only join via gateway v3, i.e., the mapping is: (14; 39-63-C9-D0-5C-62)
• W is able to map the PoP key of the gateways to their respective MAC addresses

Execution:

1. device u1 tries to join via gateway v1, which forwards the request to W
2. W verifies that MAC address A2-A1-88-EE-97-75 is not in the access policy mapping, and replies with an error. The error_content has REJECT_TYPE = 1, and the plaintext of REJECT_INFO contains a list of suggested gateways = [h'3963C9D05C62']. The single element in the list is the 6-byte MAC address of v3, serialized as a bstr.
3. gateway v1 assembles an EDHOC error "Access Denied" with error_content, and sends it to u1
4. device u1 processes the error, decrypts REJECT_INFO, and retries the protocol via gateway v3

Acknowledgments The authors sincerely thank for his contribution in the initial phase of this work.