Re: [Lwip] [Ace] EDHOC standardization

John Mattsson <john.mattsson@ericsson.com> Wed, 21 November 2018 15:03 UTC

Return-Path: <john.mattsson@ericsson.com>
X-Original-To: lwip@ietfa.amsl.com
Delivered-To: lwip@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 54334127B4C for <lwip@ietfa.amsl.com>; Wed, 21 Nov 2018 07:03:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.861
X-Spam-Level:
X-Spam-Status: No, score=-3.861 tagged_above=-999 required=5 tests=[DKIMWL_WL_HIGH=-1.46, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=c7j5RQwz; dkim=pass (1024-bit key) header.d=ericsson.com header.b=JinS5a5t
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YFP8wKbQZbXE for <lwip@ietfa.amsl.com>; Wed, 21 Nov 2018 07:02:59 -0800 (PST)
Received: from sessmg22.ericsson.net (sessmg22.ericsson.net [193.180.251.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CBECC12426E for <lwip@ietf.org>; Wed, 21 Nov 2018 07:02:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/simple; q=dns/txt; i=@ericsson.com; t=1542812575; x=1545404575; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=vsZIq9w+gy8WWAdL1/fz9uBTXA9RFp2K+6shkX5vy9Y=; b=c7j5RQwznBS8uAexjvxyKh+y8euodXXFWTSltJbXG+ylbCJL7BktA1KUGGBGqqiD 7cV9lMLYkEahkpftbkNsv6lEe4WD1EhneimimUqYc2Vs1Uo6oaksmLqnL3xOh2gK QjNaQmdFAjEgSm4S+wUUXt7zrbILg8U+T1xPP1DUtTM=;
X-AuditID: c1b4fb3a-477ff70000002747-38-5bf5739f459c
Received: from ESESSMB505.ericsson.se (Unknown_Domain [153.88.183.123]) by sessmg22.ericsson.net (Symantec Mail Security) with SMTP id B1.FE.10055.F9375FB5; Wed, 21 Nov 2018 16:02:55 +0100 (CET)
Received: from ESESBMB502.ericsson.se (153.88.183.169) by ESESSMB505.ericsson.se (153.88.183.166) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Wed, 21 Nov 2018 16:02:55 +0100
Received: from EUR02-HE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESBMB502.ericsson.se (153.88.183.169) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Wed, 21 Nov 2018 16:02:55 +0100
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vsZIq9w+gy8WWAdL1/fz9uBTXA9RFp2K+6shkX5vy9Y=; b=JinS5a5tSMU/bWedNtnTI5IQ967GwI15fEoP2y8ZoV4IZxU5JqNxMik66QevR5b83pP6NjaVlwfIvcw4MMPXkVhlwYlaLPnZRJX3OxGUsDxNg3jpVvrPW/eBNyhfxFUN8Db0BuVMBUBqSdBxL27dmGnTph1x5gDCTYwRNNsysnU=
Received: from HE1PR07MB4169.eurprd07.prod.outlook.com (20.176.166.22) by HE1PR07MB3211.eurprd07.prod.outlook.com (10.170.246.14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1361.12; Wed, 21 Nov 2018 15:02:53 +0000
Received: from HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::18ff:fb34:36ea:bd64]) by HE1PR07MB4169.eurprd07.prod.outlook.com ([fe80::18ff:fb34:36ea:bd64%4]) with mapi id 15.20.1361.013; Wed, 21 Nov 2018 15:02:53 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: "ace@ietf.org" <ace@ietf.org>, "lwip@ietf.org" <lwip@ietf.org>
CC: Benjamin Kaduk <kaduk@mit.edu>, "salvador.p.f@um.es" <salvador.p.f@um.es>
Thread-Topic: [Ace] EDHOC standardization
Thread-Index: AQHUcrwmx6N1o4AsH0uz6RMW3Bvpj6U+JgWAgBxb0gA=
Date: Wed, 21 Nov 2018 15:02:53 +0000
Message-ID: <7F78CC92-5C48-4BFC-8087-E25D4D95A74F@ericsson.com>
References: <C79F1336-A297-4E64-AB32-2F5D474A200E@ericsson.com> <20181103145857.GG54966@kduck.kaduk.org>
In-Reply-To: <20181103145857.GG54966@kduck.kaduk.org>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/10.11.0.180909
x-originating-ip: [192.176.1.83]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; HE1PR07MB3211; 6:yeZp81piXg8WLiKecWn6APvGLF0u35/WrQSoPIrXWMWHefepw52dE6vadlawnSDlbHi6MNIkOsUXXcxmRHmJf1bNTjUredqyV0HyhrsR/zEB5WseVaUxYsDOYqaixSb0lMUIayZ22+UrL3lcOAp3xf9vY0J+54YKQYv3SRCcaxVCw2HyHSvgjPwZOs4PcHJOZkicGZ+UqR9TKkW4LF6tI35rJ1Dg5i7cQAkbWd3uweOfoB1ulYOCipfoYnqDpx9Vi7eGL6eulq7CJJC6Ex63tDWPnXbaK8kMAVIZH398F3KZ9dZpObYtLiMF9RVrZ0XS3Go2YOMS8K/WSf24vP7otsmBkaBwxjB6hUaKztmFuNHDEeYlcDxq1/rT7MuKJwU1Da+05DFWVp7wlq9RAVGMX6bK/sElBA3fmjRwS3g1Q15LIlpjSar2mbKsQTKQlnr3XoDjbwy7dMVOwC8ji/iDJw==; 5:AEKHKTIvl+8iSSSkaoY9QUd8H65v/3/w8RHUrdeSZ/JJWs05GUkB6d0+hDQ1W+SLfG+o3wnSOYCMOCiypf7eLxm6tHBJGOYoD1IpnVtIHBd8+3aWnfmfnPr+2I4L9Iq1C/Rg+a6hwktml09fejpIzQOwD6So/OKdpnq8iq+JbVM=; 7:Nu5Qr9ocPWgsiWWlxtEQOCgMXbtE/PKRZMYJO5sYuhdK8oBa5n7ZxbkAGPcd+13AJiqRP7+0tGgJPdwh2fK9C6ryYRLl54cBsKLyrrGxU1ocgjdGEgCkJLN+WpInFYq8/YecPfznvdwi/+eUulFkWg==
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 2aa08f2c-fece-440b-c252-08d64fc269c5
x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390098)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060)(7193020); SRVR:HE1PR07MB3211;
x-ms-traffictypediagnostic: HE1PR07MB3211:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=john.mattsson@ericsson.com;
x-microsoft-antispam-prvs: <HE1PR07MB32116023C8B4A3271641321889DA0@HE1PR07MB3211.eurprd07.prod.outlook.com>
x-ms-exchange-senderadcheck: 1
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(3002001)(93006095)(93001095)(3231442)(944501410)(52105112)(10201501046)(148016)(149066)(150057)(6041310)(20161123562045)(20161123560045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123564045)(201708071742011)(7699051)(76991095); SRVR:HE1PR07MB3211; BCL:0; PCL:0; RULEID:; SRVR:HE1PR07MB3211;
x-forefront-prvs: 08635C03D4
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(366004)(376002)(346002)(136003)(396003)(53754006)(13464003)(199004)(189003)(51914003)(6306002)(106356001)(68736007)(44832011)(105586002)(26005)(25786009)(66066001)(4326008)(3846002)(6116002)(53936002)(82746002)(6246003)(83716004)(102836004)(6506007)(966005)(71190400001)(6436002)(478600001)(256004)(7736002)(305945005)(86362001)(4744004)(6486002)(486006)(76176011)(81156014)(81166006)(11346002)(8936002)(2616005)(2906002)(476003)(36756003)(229853002)(99286004)(97736004)(316002)(53946003)(54906003)(6512007)(186003)(58126008)(33656002)(53546011)(8676002)(2900100001)(71200400001)(14454004)(5660300001)(110136005)(446003)(14444005)(2501003); DIR:OUT; SFP:1101; SCL:1; SRVR:HE1PR07MB3211; H:HE1PR07MB4169.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1;
received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: JCY4KttXnCvusM/6CuBPixSLBQ02bybYFo69m482DB9XUQf074+f3U5pdfsJxmjQyrxbBX2q2dBUZIR4d/ucI574xY5QEGzszkw+w8a6SOqG2yEw0wjGF/sFj4nZMv/gYqEbqUdZRsfJTm3ZPgze1ESKJ+9EJRiVR8X7b+vILeHK1qjmmziDvsvqGH9vm1W4/pU82sVpzDw6xDvl7ZSAmkGMppUiM5Mgd4i5vJ+eEF9+qBsDzxKQVWvv/F94BB6oGd65l7gUFTdmdMtvsUDx4H0C1uiBdpBKFz2WmCC7fVnlF02yYazShBw1JJoIlSGcAi5/oaSEMU2vJ0HqHr14uAl1+1Le2SNScVAxKGJ22CE=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="utf-8"
Content-ID: <65B3EED7F61B8D4485F3C1F591F5612F@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 2aa08f2c-fece-440b-c252-08d64fc269c5
X-MS-Exchange-CrossTenant-originalarrivaltime: 21 Nov 2018 15:02:53.5071 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR07MB3211
X-OriginatorOrg: ericsson.com
X-Brightmail-Tracker: H4sIAAAAAAAAA02Sa0hTYRjHec85c8fp6G1qPmpZrgJTvLRKhomXRbAvUl8CUbqsPKl531FJ /SKZZt6y3EinbYkjwzIz1IWo6SjponkhRcsPaoqXoC1hminStrOgb7//c/k/z/Py0qSoiedN p2TkMMoMRZrYSUDVxxkKg3SsJSG0atlPurlRSUpbOuoJqbbfTVrcOsmPpuR6/RYhvzX8jpR/ Xi2lzpPxgohEJi0lj1GGRF4RJI/PNBJZaz3o5uT6KFmEbnejcuRMAz4Jv6s1/HIkoEX4LQLD rpnkxAYCtWqI4oSegEqVlrAJCteQsGVadGRqCRhY1DnEAoLpqSK+zdkJh8Kj3iInG7tjGRia X9iZxLEw21VC2dgN+0NHeRefqzkG6pVfBMfhMNe1Za+n8FEwPa3l2ViIo2BNNWnvFeEbYJ5u IG3sjE9B+502exzhfbD58TnBzfKEr4s6grsUg753lOTYA1a/79o9PXAI6ObKeFz8EMyq2/gc H4AJXQWyHQZ4yglmhuodRkFgVqsdRrFQ/mCd4IrGEAxY7ludaKsIgI3xEG6hi1BS8tAxIBW2 J+ocvb7QWjVP1SCJ5r9dNdZu0voW7T0hXFgOxS+HeRz7gapinq+xP8Ve+FC/SD1GvFbkwTIs m54kkQQzypRrLJuZEZzB5LxC1o8z2Lkd/hoNLscYEaaR2FX4JsmSIOIp8tj8dCMCmhS7C8vi rSFhoiK/gFFmXlbmpjGsEfnQlNhTKLsujRfhJEUOk8owWYzyX5agnb2LENH9RSIlTshX0rxa QkVPGna1Bc+0dQZZYbYrddD/9KW6Myb2nEX5s87SZFmLCuz7Eem20Jh/RNb5596eb2GSu4ah 3NKRq17VHn3NLkRYoO69UZ8ds2UM0/j2fzJHL8WR6xL3ksYW44WlsYjDZstkv8/+KPlZr+WR nR0XnqefSUyxyYrjAaSSVfwFUTme0DQDAAA=
Archived-At: <https://mailarchive.ietf.org/arch/msg/lwip/dfGCFpMtaCbnEjHZpBeIrxSX4MI>
Subject: Re: [Lwip] [Ace] EDHOC standardization
X-BeenThere: lwip@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Lightweight IP stack. Official mailing list for IETF LWIG Working Group." <lwip.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/lwip>, <mailto:lwip-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/lwip/>
List-Post: <mailto:lwip@ietf.org>
List-Help: <mailto:lwip-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/lwip>, <mailto:lwip-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Nov 2018 15:03:02 -0000

Hi all,

Inspired by the discussion in this thread, I did more detailed calculations of the number of bytes when DTLS 1.3 is used for typical IoT use cases (PSK, RPK, Connection ID). The plan is to add this information to draft-ietf-lwig-security-protocol-comparison as this has been requested by several people. I think some bytes were missing in the earlier estimates for TLS 1.3, and as Ben commented, DTLS 1.3 adds some bytes compared to TLS 1.3.

==============================================================================
Flight                                #1         #2        #3       Total     
------------------------------------------------------------------------------
DTLS 1.3 RPK + ECDHE                 149        373       213        735      
DTLS 1.3 PSK + ECDHE                 186        190        57        433      
DTLS 1.3 PSK                         136        150        57        343      
------------------------------------------------------------------------------
EDHOC    RPK + ECDHE                  38        121        86        245      
EDHOC    PSK + ECDHE                  43         47        12        102      
==============================================================================
                                 Number of bytes

Assumptions:
- Minimum number of algorithms and cipher suites offered 
- Curve25519, ECDSA with P-256, AES-CCM_8, SHA-256
- Length of key identifiers: 4 bytes
- Connection identifiers: 1 byte
- The DTLS RPKs use point compression (saves 32 bytes)
- No DTLS handshake message fragmentation
- Only mandatory DTLS extentions, except for connection ID
- Version 30 https://tools.ietf.org/html/draft-ietf-tls-dtls13-30

(EDHOC numbers are for the soon to be published -11 version with cipher suites)

I hope this information is useful for people. Please comment if I missed something or if you have any suggestion of things to add or how to present things. I do not know currently how these numbers compare to DTLS 1.2.

Below is detailed information about where the byte in different flights as well as the RPKs (SubjectPublicKeyInfo). Most of the bytes should have the correct value, but most of the length fields are just written as LL LL LL. Below is also information about how resumption, cached information [RFC 7924], and not using Connection ID affects the number of bytes.


======================================================
DTLS 1.3 Flight #1 RPK + ECDHE
======================================================

Record Header - DTLSPlaintext (13 bytes)
16 fe fd EE EE SS SS SS SS SS SS LL LL

	Handshake Header - Client Hello (10 bytes)
	01 LL LL LL SS SS 00 00 00 LL LL LL

		Legacy Version (2 bytes)
		fe fd

		Client Random (32 bytes)
		00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

		Legacy Session ID (1 bytes)
		00

		Cipher Suites (TLS_AES_128_CCM_8_SHA256) (4 bytes)
		00 02 13 05

		Compression Methods (null) (2 bytes)
		01 00

		Extensions Length (2 bytes)
		LL LL

			Extension - Supported Groups (x25519) (8 bytes)
			00 0a 00 04 00 02 00 1d

			Extension - Signature Algorithms (ecdsa_secp256r1_sha256) (8 bytes)
			00 0d 00 04 00 02 08 07

			Extension - Key Share (42 bytes)
			00 33 00 26 00 24 00 1d 00 20
			00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

			Extension - Supported Versions (1.3) (7 bytes)
			00 2b 00 03 02 03 04 

			Extension - Client Certificate Type (Raw Public Key) (6 bytes)
			00 13 00 01 01 02 

			Extension - Server Certificate Type (Raw Public Key) (6 bytes)
			00 14 00 01 01 02

			Extension - Connection Identifier (43) (6 bytes)
			XX XX 00 02 01 42

13 + 10 + 2 + 32 + 1 + 4 + 2 + 2 + 8 + 8 + 42 + 7 + 6 + 6 + 6 = 149 bytes

------------------------------------------------------
DTLS 1.3 Flight #1 PSK + ECDHE
------------------------------------------------------

Differences compared to RPK + ECDHE

+ Extension - PSK Key Exchange Modes (6 bytes)
  00 2d 00 02 01 01

+ Extension - Pre Shared Key (51 bytes)
  00 29 00 2F
  00 0a 00 04 ID ID ID ID 00 00 00 00
  00 21 20 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

- Extension - Signature Algorithms (ecdsa_secp256r1_sha256) (8 bytes)

- Extension - Client Certificate Type (Raw Public Key) (6 bytes)

- Extension - Server Certificate Type (Raw Public Key) (6 bytes)

149 + 6 + 51 - 8 - 6 - 6 = 186 bytes

------------------------------------------------------
DTLS 1.3 Flight #1 PSK
------------------------------------------------------

Differences compared to PSK + ECDHE

- Extension - Supported Groups (x25519) (8 bytes)

- Extension - Key Share (42 bytes)

186 - 8 - 42 = 136 bytes



======================================================
DTLS 1.3 Flight #2  RPK + ECDHE
======================================================

Record Header - DTLSPlaintext (13 bytes)
16 fe fd EE EE SS SS SS SS SS SS LL LL

	Handshake Header - Server Hello (10 bytes)
	02 LL LL LL SS SS 00 00 00 LL LL LL

		Legacy Version (2 bytes)
		fe fd

		Server Random (32 bytes)
		00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

		Legacy Session ID (1 bytes)
		00

		Cipher Suite (TLS_AES_128_CCM_8_SHA256) (2 bytes)
		13 05

		Compression Method (null) (1 bytes)
		00

		Extensions Length (2 bytes)
		LL LL

			Extension - Key Share (40 bytes)
			00 33 00 24 00 1d 00 20
			00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

			Extension - Supported Versions (1.3) (6 bytes)
			00 2b 00 02 03 04

			Extension - Connection Identifier (43) (6 bytes)
			XX XX 00 02 01 43

Record Header - DTLSCiphertext, Full (6 bytes)
HH ES SS 43 LL LL

	Handshake Header - Encrypted Extensions (10 bytes)
	08 LL LL LL SS SS 00 00 00 LL LL LL

		Extensions Length (2 bytes)
		LL LL

			Extension - Client Certificate Type (Raw Public Key) (6 bytes)
			00 13 00 01 01 02 

			Extension - Server Certificate Type (Raw Public Key) (6 bytes)
			00 14 00 01 01 02

	Handshake Header - Certificate Request (10 bytes)
	0d LL LL LL SS SS 00 00 00 LL LL LL

		Request Context (1 bytes)
		00

		Extensions Length (2 bytes)
		LL LL

			Extension - Signature Algorithms (ecdsa_secp256r1_sha256) (8 bytes)
			00 0d 00 04 00 02 08 07

	Handshake Header - Certificate (10 bytes)
	0b LL LL LL SS SS 00 00 00 LL LL LL

		Request Context (1 bytes)
		00

		Certificate List Length (3 bytes)
		LL LL LL

		Certificate Length (3 bytes)
		LL LL LL

		Certificate (59 bytes) // Point compression
		....

		Certificate Extensions (2 bytes)
		00 00

	Handshake Header - Certificate Verify (10 bytes)
	0f LL LL LL SS SS 00 00 00 LL LL LL

		Signature  (68 bytes)
		ZZ ZZ 00 40 ....

	Handshake Header - Finished (10 bytes)
	14 LL LL LL SS SS 00 00 00 LL LL LL

		Verify Data (32 bytes)
		00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

	Record Type (1 byte)
	16

Auth Tag (8 bytes)
e0 8b 0e 45 5a 35 0a e5

13 + 102 + 6 + 24 + 21 + 78 + 78 + 42 + 1 + 8 = 373 bytes

------------------------------------------------------
DTLS 1.3 Flight #2 PSK + ECDHE
------------------------------------------------------

Differences compared to RPK + ECDHE

- Handshake Message Certificate (78 bytes)

- Handshake Message CertificateVerify (78 bytes)

- Handshake Message CertificateRequest (21 bytes)

- Extension - Client Certificate Type (Raw Public Key) (6 bytes)

- Extension - Server Certificate Type (Raw Public Key) (6 bytes)

+ Extension - Pre Shared Key (6 bytes)
  00 29 00 02 00 00

373 - 78 - 78 - 21 - 6 - 6  + 6 = 190 bytes

------------------------------------------------------
DTLS 1.3 Flight #2 PSK
------------------------------------------------------

Differences compared to PSK + ECDHE

- Extension - Key Share (40 bytes)

190 - 40 = 150 bytes



======================================================
DTLS 1.3 Flight #3 RPK + ECDHE
======================================================

Record Header (6 bytes) // DTLSCiphertext, Full
ZZ ES SS 42 LL LL

	Handshake Header - Certificate (10 bytes)
	0b LL LL LL SS SS XX XX XX LL LL LL

		Request Context (1 bytes)
		00

		Certificate List Length (3 bytes)
		LL LL LL

		Certificate Length (3 bytes)
		LL LL LL
	
		Certificate (59 bytes) // Point compression
		....

		Certificate Extensions (2 bytes)
		00 00

	Handshake Header - Certificate Verify (10 bytes) 
	0f LL LL LL SS SS 00 00 00 LL LL LL

		Signature  (68 bytes)
		04 03 LL LL //ecdsa_secp256r1_sha256
		00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f
		00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

	Handshake Header - Finished (10 bytes)
	14 LL LL LL SS SS 00 00 00 LL LL LL

		Verify Data (32 bytes) // SHA-256
		00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

	Record Type (1 byte)
	16

Auth Tag (8 bytes) // AES-CCM_8
00 01 02 03 04 05 06 07

6 + 78 + 78 + 42 + 1 + 8 = 213 bytes

------------------------------------------------------
DTLS 1.3 Flight #3 PSK + ECDHE
-----------------------------------------------------

Differences compared to RPK + ECDHE

- Handshake Message Certificate (78 bytes)

- Handshake Message Certificate Verify (78 bytes)

213 - 78 - 78 = 57 bytes

------------------------------------------------------
DTLS 1.3 Flight #3 PSK
-----------------------------------------------------

Differences compared to PSK + ECDHE

None

57 bytes







======================================================
DTLS 1.3 - Cached information [RFC 7924] 
======================================================

- Cached information together with server X.509 can be used to move bytes from flight #2 to flight #1
  (cached RPK increases the number of bytes compared to cached X.509)

Differences compared to RPK + ECDHE

Flight #1

- Extension - Server Certificate Type (Raw Public Key) (6 bytes)

+ Extension - Client Cashed Information (39 bytes)
  00 19 LL LL LL LL
  01 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f

149 + 33 = 182 bytes

Flight #2

- Extension - Server Certificate Type (Raw Public Key) (6 bytes)

+ Extension - Server Cashed Information (7 bytes)
  00 19 LL LL LL LL 01

- Server Certificate (59 bytes -> 32 bytes) 

373 - 26 = 347 bytes

==============================================================================
Flight                                #1         #2        #3       Total     
------------------------------------------------------------------------------
DTLS 1.3 Cached X.509/RPK + ECDHE    182        347       213        742      
DTLS 1.3 RPK + ECDHE                 149        373       213        735      
==============================================================================



======================================================
DTLS 1.3 - Resumption
======================================================

To enable resumption, a 4th flight (New Session Ticket) is added

Flight #4 - New Session Ticket

Record Header - DTLSCiphertext, Full (6 bytes)
HH ES SS 43 LL LL

	Handshake Header - New Session Ticket (10 bytes)
	04 LL LL LL SS SS 00 00 00 LL LL LL

		Ticket Lifetime (4 bytes)
		00 01 02 03

		Ticket Age Add (4 bytes)
		00 01 02 03

		Ticket Nonce (2 bytes)
		01 00

		Ticket (6 bytes)
		00 04 ID ID ID ID

		Extensions (2 bytes)
		00 00

Auth Tag (8 bytes) // AES-CCM_8
00 01 02 03 04 05 06 07

6 + 10 + 4 + 4 + 2 + 6 + 2 + 8 = 42 bytes

The resumption handshake is just a PSK handshake with 136 + 150 + 57 = 343 bytes

==============================================================================
Flight                                      #1     #2     #3     #4    Total     
------------------------------------------------------------------------------
DTLS 1.3 RPK + ECDHE + NewSessionTicket    149    373    213     42      777      
DTLS 1.3 PSK (resumption)                  136    150     57             343      
==============================================================================



======================================================
DTLS 1.3 - Connection ID
======================================================

Without a Connection ID the DTLS 1.3 flight sizes changes as follows

DTLS 1.3 Flight #1:   -6 bytes
DTLS 1.3 Flight #2:   -7 bytes
DTLS 1.3 Flight #3:   -1 byte



==============================================================================
Flight                                #1         #2        #3       Total     
------------------------------------------------------------------------------
DTLS 1.3 RPK + ECDHE (no cid)        143        364       212        721      
DTLS 1.3 PSK + ECDHE (no cid)        180        183        56        419      
DTLS 1.3 PSK (no cid)                130        143        56        329      
==============================================================================





======================================================
DTLS Raw Public Keys
======================================================

SubjectPublicKeyInfo without point compression
-----------------------------------------------------

0x30 // Sequence
0x59 // Size 89

0x30 // Sequence
0x13 // Size 19
0x06 0x07 0x2A 0x86 0x48 0xCE 0x3D 0x02 0x01.     // OID 1.2.840.10045.2.1 (ecPublicKey)
0x06 0x08 0x2A 0x86 0x48 0xCE 0x3D 0x03 0x01 0x07 // OID 1.2.840.10045.3.1.7 (secp256r1)

0x03 // Bit string
0x42 // Size 66
0x00 // Unused bits 0
0x04 // Uncompressed
...... 64 bytes X and Y

Total of 91 bytes

SubjectPublicKeyInfo with point compression
-----------------------------------------------------

0x30 // Sequence
0x59 // Size 89

0x30 // Sequence
0x13 // Size 19
0x06 0x07 0x2A 0x86 0x48 0xCE 0x3D 0x02 0x01.     // OID 1.2.840.10045.2.1 (ecPublicKey)
0x06 0x08 0x2A 0x86 0x48 0xCE 0x3D 0x03 0x01 0x07 // OID 1.2.840.10045.3.1.7 (secp256r1)

0x03 // Bit string
0x42 // Size 66
0x00 // Unused bits 0
0x03 // Compressed
...... 32 bytes X

Total of 59 bytes


======================================================
Helpful Sources of Information
======================================================

In addition to relevant RFCs and the estimates done by Jim, the following
references were helpful:

Every Byte Explained: The Illustrated TLS 1.3 Connection
https://tls13.ulfheim.net/

Digital Certificates for the Internet of Things
https://kth.diva-portal.org/smash/get/diva2:1153958/FULLTEXT01.pdf

/John




-----Original Message-----
From: Benjamin Kaduk <kaduk@mit.edu>
Date: Saturday, 3 November 2018 at 15:59
To: John Mattsson <john.mattsson@ericsson.com>
Cc: "salvador.p.f@um.es" <salvador.p.f@um.es>, "ace@ietf.org" <ace@ietf.org>
Subject: Re: [Ace] EDHOC standardization

On Fri, Nov 02, 2018 at 02:55:54PM +0000, John Mattsson wrote:
> Hi Benjamin, Salvador
> 
> While DTLS 1.3 have done a very good job of lowering the overhead of the record layer when application data is sent (see e.g. https://tools.ietf.org/html/draft-ietf-lwig-security-protocol-comparison-01 for a comparison between different protocols), I do not think the handshake protocol is much leaner (is it leaner at all?).

(There are some handshake messages that are removed entirely.)

> We tried to make an fair comparison between EDHOC and TLS 1.3 in the presentation at IETF 101 (see https://datatracker.ietf.org/meeting/101/materials/slides-101-ace-key-exchange-w-oscore-00) Since then, we have significantly optimized the encoding in EDHOC and the upcoming version (-11) is expected to have the following message sizes.
> 
>    Auth.               PSK       RPK       x5t     x5chain
>    --------------------------------------------------------------------
>    EDHOC message_1      43        38        38        38
>    EDHOC message_2      47       121       127       117 + Certificate chain
>    EDHOC message_3      12        86        92        82 + Certificate chain
>    --------------------------------------------------------------------
>    Total               102       245       257       237 + Certificate chains
> 
> As Salvador writes, the handshakes in TLS 1.3 and DTLS 1.3 are basically the same, so the numbers presented at IETF 101 should be a good estimate also for DTLS 1.3.
> 
>    Auth.                PSK       RPK
>    --------------------------------------------------------------------
>    (D)TLS message_1     142       107
>    (D)TLS message_2     135       264
>    (D)TLS message_3      51       167
>    --------------------------------------------------------------------
>    Total                328       538

Thanks for the numbers!

> The numbers above include ECDHE. For handshake messages, my understanding is that the DTLS 1.3 and TLS 1.3 record layer have exactly the same size.

The DTLS 1.3 ones will be worse, due to the epoch and sequence number
fields.

-Ben