Eclipse Community Forums: Californium (Cf) CoAP Framework » CoAP via DTLS with secure transport only

Help

Home

Home » Eclipse Projects » Californium (Cf) CoAP Framework » CoAP via DTLS with secure transport only

Show: Today's Messages :: Show Polls :: Message Navigator

CoAP via DTLS with secure transport only [message #1718283]

Tue, 22 December 2015 06:19

Klaus Schroiff

Messages: 4
Registered: December 2015

Junior Member

Hi,

I am a bit confused regarding the way how CoAP works over DTLS - probably also because of the research papers out there suggesting what could be done so I'm now in a state where I don't know anymore what has been done actually.

The thing that produces headaches on my side is the definition of authentication. Is it the authentication solely on packet level for creating the secure transport or is it the authentication on tenant (application-) level ?

During testing I created two separate keystores for client and server (client key not stored in the server keystore). Now whatever I set as "ClientAuthenticationRequired" on the server - it doesn't make a difference - the request comes through anyway (which is good enough for us as long as the connection is encrypted).

Our problem scenario:
We are offering a multi-tenant cloud service. The idea is to use a CoAP cross proxy (farm) to map from CoAP(s) to HTTP for further processing. The Cross-Proxy instances have _no_ tenant notion so I'd like to use DTLS for secure transport only. The credentials will be provided in the (encrypted) payload.

Thanks

Klaus

[Updated on: Wed, 23 December 2015 04:50]

Report message to a moderator

Re: CoAP via DTLS with secure transport only [message #1718453 is a reply to message #1718283]

Thu, 24 December 2015 00:08

Klaus Schroiff

Messages: 4
Registered: December 2015

Junior Member

Ok, I had a look at the following paper and it seems as if I misunderstood a couple of things (sorry this is usually not my layer).
"A DTLS Based End-To-End Security Architecture for the Internet of Things with Two-Way Authentication"

Still there are aspects that I do not understand on code level. Looking at the sample implementations here ...

Github - Scandium - Examples (sorry can't post the links due to forum policy):
ExampleDTLSServer.java
ExampleDTLSClient.java

So this is using PSK it seems.

In the client I can spot this (line 74):
builder.setPskStore(new StaticPskStore("Client_identity", "secretPSK".getBytes()));

In the server I can spot this (line 57):
pskStore.setKey("Client_identity", "secretPSK".getBytes());

I can delete this line (either on the server or client (empty pskstore) or both) and it doesn't make a difference - the request goes through.

Citing the doc about:
"Constrained publishers perform a variation of the TLS Pre-Shared Key (PSK) cipher suite. As discussed earlier, the publisher has a number of random bytes pre-installed before deployment. These are called protokeys and are used to derive the PSK for a session. The publisher sends its identity (e.g., IPv6 address) during the ClientKeyExchange message of the handshake, as described in Section III, instead of in a certificate. It also appends a few randomly generated bytes to its PSK identity to form a session identity. "

So I reckon the client identity is generated anyway ? How is this related to the "Client_identity" key ?
What is the purpose of those keys in the pskstores on the client and server ?

Thanks

Report message to a moderator

Re: CoAP via DTLS with secure transport only [message #1718456 is a reply to message #1718453]

Thu, 24 December 2015 02:47

Klaus Schroiff

Messages: 4
Registered: December 2015

Junior Member

Ok, can it be that this is all a big text adventure at this stage?

In order to use PSK the client has to set the supported CipherSuite to TLS_PSK_WITH_AES_128_CCM_8 _explicitly_.
Otherwise TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 will be used which also explains why the pskStore was ignored in my previous example.
Well, TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 is fine for me anyway.

When setting the client to TLS_PSK_WITH_AES_128_CCM_8 I am running into a handshake failure despite identical PSK store on the client and server side.\
Any idea why?

[Updated on: Thu, 24 December 2015 03:23]

Report message to a moderator

Re: CoAP via DTLS with secure transport only [message #1718458 is a reply to message #1718456]

Thu, 24 December 2015 05:08

Klaus Schroiff

Messages: 4
Registered: December 2015

Junior Member

So in the meanwhile I got a bit further with PSK.

Instead of just adding the identity to the PskStore on the client, I had to use
pskStore.addKnownPeer(peerAddress, identity, key);
Thereafter the PSK handshake worked fine with a local DTLS/CoAP server. This code is from the californium toolbox (console client).
It is not used in the sample SecureClient (californium core) .

However. a request to coaps://vs0.inf.ethz.ch:5684/ still failed (with their specified identity/key).

Report message to a moderator

Previous Topic:	Using CoAP to control master-slave structure
Next Topic:	dynamic web project with californium

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Fri Apr 26 11:44:36 GMT 2024

.:: Contact :: Home ::.

Breadcrumbs

Sign up to our Newsletter