Re: [Dots] TLS APLN extension

Hi Ben,

The DOTS signal spec calls for CoAP secured by running over (D)TLS (either
UDP and/or TCP), and CoAP over TLS is coaps+tcp.  So, yes, both coaps and
coaps+tcp have to be supported.

For example, I can use the github libcoap coap-client (Pull Request #176
installed) and do "coap-client -c cert.pem
coaps+tcp://127.0.0.1:4646/.well-known/dots/v1/config" against my DOTS
server and get back binary data (it is CBOR encoded).

Regards

Jon

-----Original Message-----
From: Dots [mailto: dots-bounces@ietf.org] On Behalf Of Benjamin Kaduk
Sent: 23 May 2018 01:35
To: mohamed.boucadair@orange.com
Cc: Jon Shallow; dots@ietf.org
Subject: Re: [Dots] TLS APLN extension

The dedicated port number is only somewhat relevant, I think -- the
main question is whether the coaps+tcp URI scheme is in use.  The
RFC 8323 requirements only come into play for that URI scheme.

-Ben

On Tue, May 22, 2018 at 07:54:39AM +0000, mohamed.boucadair@orange.com
wrote:
> Re-,
> 
> Do we need this given that DOTS is using a dedicated port number?
> 
> Cheers,
> Med
> 
> De : Dots [mailto:dots-bounces@ietf.org] De la part de Jon Shallow
> Envoyé : lundi 21 mai 2018 09:55
> À : dots@ietf.org
> Objet : [Dots] TLS APLN extension
> 
> Hi there,
> 
> As per RFC 8323: 8.2.  coaps+tcp URI Scheme
> 
> ....
> 
>    o  If a TLS server does not support the Application-Layer Protocol
>       Negotiation (ALPN) extension [RFC7301] or wishes to accommodate
>       TLS clients that do not support ALPN, it MAY offer a coaps+tcp
>       endpoint on TCP port 5684.  This endpoint MAY also be ALPN
>       enabled.  A TLS server MAY offer coaps+tcp endpoints on ports
>       other than TCP port 5684, which MUST be ALPN enabled.
> 
>    o  For TCP ports other than port 5684, the TLS client MUST use the
>       ALPN extension to advertise the "coap" protocol identifier (see
>       Section 11.7) in the list of protocols in its ClientHello.  If the
>       TCP server selects and returns the "coap" protocol identifier
>       using the ALPN extension in its ServerHello, then the connection
>       succeeds.  If the TLS server either does not negotiate the ALPN
>       extension or returns a no_application_protocol alert, the TLS
>       client MUST close the connection.
> 
> Do we need to refer to the requirement for ALPN as we are not hosting on
port 5684?
> 
> Regards
> 
> Jon

> _______________________________________________
> Dots mailing list
> Dots@ietf.org
> https://www.ietf.org/mailman/listinfo/dots

_______________________________________________
Dots mailing list
Dots@ietf.org
https://www.ietf.org/mailman/listinfo/dots