Subject: [core] DTLS over CoAP

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 16 Nov 2016 06:49:45 +0100

Since we discussed it in the CORE meeting today, here is the link to the
document Carsten mentioned:
https://tools.ietf.org/html/draft-schmertmann-dice-codtls-01

---

From: Göran Selander <[email-masked]>
Date: Wed, 16 Nov 2016 06:32:06 +0000

This is interesting and, as Carsten pointed out in the meeting, may be
used to establish keys for OSCOAP.

But I didn’t understand how this changes the issue that if you mandate
implementation and use of transport layer security, with the use of this,
there would still be double security protocols which may not be applicable
in constrained environments.

Göran

---

From: "weigengyu" <[email-masked]>
Date: Wed, 16 Nov 2016 15:21:02 +0800

Hi,

It is interesting.
We are implementing CoAP/DTLS/SMS and CoAP/DTLS/UDP/SMS by extending Cf. 
CoAP.
And the software has been shifted to test on MI Android.

It needs to point out that DTLS would work better on some reliable datagram 
transport facilities.
So, "DTLS over CoAP" is much like that.
But, we also think that DTLS needs optimizing its handshake efficiencies, 
retransmission mechanism, and ets.

Regards,

Gengyu WEI
Network Technology Center
School of Computer
Beijing University of Posts and Telecommunications
-----原始邮件----- 
From: Göran Selander
Sent: Wednesday, November 16, 2016 2:32 PM
To: Hannes Tschofenig ; [email-masked] WG
Subject: Re: [core] DTLS over CoAP

Göran

>https://tools.ietf.org/html/draft-schmertmann-dice-codtls-01

_______________________________________________
core mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/core

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 16 Nov 2016 17:26:34 +0900

On 16 Nov 2016, at 16:21, weigengyu <[email-masked]> wrote:
> 
> It needs to point out that DTLS would work better on some reliable datagram transport facilities.
> But, we also think that DTLS needs optimizing its handshake efficiencies, retransmission mechanism, and ets.

Indeed — that was the original motivation — getting rid of DTLS retransmissions by using the much better behaved CoAP retransmissions instead.
Only then did we notice that this makes a nice end-to-end key agreement protocol if there is a cipher suite that matches your security requirements.

Göran: I mentioned this as a reaction to Hannes’ idea that we should use TLS at the application layer.  We still need OSCOAP to actually replace the record layer (and provide semantics appropriate to end-to-end security).  And no, I still don’t want to be forced to add transport layer security when application layer security is what my security objectives actually require.

Grüße, Carsten

---

From: "weigengyu" <[email-masked]>
Date: Thu, 24 Nov 2016 16:12:13 +0800

Hi，

>> Indeed — that was the original motivation — getting rid of DTLS 
>> retransmissions by using the much better behaved CoAP retransmissions 
>> instead.
>> Only then did we notice that this makes a nice end-to-end key agreement 
>> protocol if there is a cipher suite that matches your security 
>> requirements.

When considering DTLS over CoAP, another question is why not to have TLS 
over CoAP instead.

CoAP is a reliable protocol and TLS is designed to run over a reliable 
protocol which is TCP as default.
So, having TLS over CoAP seems to be rational.

I wonder that TLS may needs modifing less than DTLS if comparing TLS over 
CoAP than DTLS over CoAP.

>>Göran: I mentioned this as a reaction to Hannes’ idea that we should use 
>>TLS at the application layer.  We still need OSCOAP to actually replace 
>>the record layer (and provide semantics appropriate to end-to-end 
>>security).  And no, I still don’t want to be forced to add transport 
>>layer security when application layer security is what my security 
>>objectives actually require.

The OSCOAP may be required if TLS over CoAP and CoAP connection is not 
end-to-end.

Regards,

Gengyu WEI
-----原始邮件----- 
From: Carsten Bormann
Sent: Wednesday, November 16, 2016 4:26 PM
To: weigengyu
Cc: Göran Selander ; Hannes Tschofenig ; [email-masked]
Subject: Re: [core] DTLS over CoAP

> retransmission mechanism, and ets.

Göran: I mentioned this as a reaction to Hannes’ idea that we should use 
TLS at the application layer.  We still need OSCOAP to actually replace the 
record layer (and provide semantics appropriate to end-to-end security). 
And no, I still don’t want to be forced to add transport layer security 
when application layer security is what my security objectives actually 
require.

Grüße, Carsten

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 24 Nov 2016 14:36:57 +0100

You are correct in your observation that TLS may due the job when the
underlying application protocol already provides reliable transmission.

On 11/24/2016 09:12 AM, weigengyu wrote:
> I wonder that TLS may needs modifing less than DTLS if comparing TLS
> over CoAP than DTLS over CoAP.