Subject: Re: [Tls-reg-review] [UNVERIFIED SENDER] Re: Request to Register Value in TLS ALPN Registry

From: "Thakar, Eeshan" <[email-masked]>
Date: Fri, 18 Oct 2019 17:30:34 +0000

Hello,

Did you get a chance to review the application with the added context from my email?

Thanks,

Eeshan

From: Thakar, Eeshan <[email-masked]<mailto:[email-masked]>>
Sent: Monday, August 12, 2019 5:13 PM
To: Yoav Nir <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>; Lee, Alexandra <[email-masked]<mailto:[email-masked]>>; Sharfin, Jared <[email-masked]<mailto:[email-masked]>>; Gochenaur, Drew <[email-masked]<mailto:[email-masked]>>
Subject: Re: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry

Hi Yoav,

Thanks for taking a look through the request. The current implementation for the AWS IoT Gateway endpoint does support HTTP/1.1 and MQTT (3.1 and 3.1.1) on the same port (443) using ALPN (with a custom ALPN protocol id).
It also supports MQTT on the IANA registered port (8883), but allows ALPN based MQTT connections on 443 to work around standard firewall configurations [1].

The goal with getting the “mqtt” protocol id registered was to have a common basis for all implementers of gateways that support HTTP and MQTT (multiple cloud IoT services do so today, albeit not on the same port) to have a way to accept MQTT traffic on port 443. This is similar to how CoAP has both an ALPN registered string (“coap”) and a registered port (5684 for CoAP with TCP/TLS).

Thanks,

Eeshan

[1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/

From: Yoav Nir <[email-masked]>
Date: Saturday, August 10, 2019 at 2:08 AM
To: "Thakar, Eeshan" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "Lee, Alexandra" <[email-masked]>, "Sharfin, Jared" <[email-masked]>, "Gochenaur, Drew" <[email-masked]>
Subject: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry

On 9 Aug 2019, at 23:45, Thakar, Eeshan <thakar=[email-masked]<mailto:thakar=[email-masked]>> wrote:

Type of Assignment:
Registration of “mqtt” token

Registry:
Application Layer Protocol Negotiation (ALPN) Protocol ID

Description:
The mqtt protocol has the protocol version written into the first message on a connection. The mqtt server implementations typically understand the protocol version based on the fixed header on the first message (connect).

Adding this protocol id to the registry will help the community since clients wanting to request mqtt as the protocol would have an appropriate specification reference to use.

Additional Info:
[1] MQTT 3.1 Specification: http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html
[2] MQTT 3.1.1 Specification: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html
[3] MQTT 5.0 Specification: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html

Hi, Eeshan.

I’ve looked through the linked specifications, especially the third one because it says it replaces the others.

It says that TCP port 8883 is registered with IANA for MQTT over TLS, and the IANA registry confirms it.  If you have your own port, why do you need ALPN?

ALPN is used to negotiate a particular service (such as HTTP) over a single port, typically 443.

So if you were using a server listening on port 443 and serving both MQTT and HTTP/2 you would need that to distinguish clients that need MQTT from web browsers that need HTTP/2.

The linked document does not make any mention of such a server.  Is this described elsewhere?

Thanks

Yoav

---

From: Yoav Nir <[email-masked]>
Date: Fri, 18 Oct 2019 21:36:30 +0300

I think it’s fine. 

Rich?  Nick?  (we need at least two of us to agree)

Yoav

> On 18 Oct 2019, at 20:30, Thakar, Eeshan <[email-masked]> wrote:
> 
> Hello,
>  
> From: Thakar, Eeshan <[email-masked] <mailto:[email-masked]>> 
> To: Yoav Nir <[email-masked] <mailto:[email-masked]>>
> Cc: [email-masked] <mailto:[email-masked]>; Lee, Alexandra <[email-masked] <mailto:[email-masked]>>; Sharfin, Jared <[email-masked] <mailto:[email-masked]>>; Gochenaur, Drew <[email-masked] <mailto:[email-masked]>>
> [1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/ <https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/>
>  
> On 9 Aug 2019, at 23:45, Thakar, Eeshan <thakar=[email-masked] <mailto:thakar=[email-masked]>> wrote:
>  
>> Type of Assignment:
>> [1] MQTT 3.1 Specification: http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html <http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html>
>> [2] MQTT 3.1.1 Specification: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html <http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html>
>> [3] MQTT 5.0 Specification: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html>
>>  
>  
> Hi, Eeshan.
>

---

From: "Salz, Rich" <[email-masked]>
Date: Fri, 18 Oct 2019 18:44:43 +0000

I’m fine with it.

Tunneling things through HTTPS has a long history :)

From: Yoav Nir <[email-masked]>
Date: Friday, October 18, 2019 at 2:41 PM
To: "Thakar, Eeshan" <[email-masked]>, "[email-masked]" <[email-masked]>
Cc: "Lee, Alexandra" <[email-masked]>, "Sharfin, Jared" <[email-masked]>, "Gochenaur, Drew" <[email-masked]>
Subject: Re: [Tls-reg-review] [UNVERIFIED SENDER] Request to Register Value in TLS ALPN Registry

I think it’s fine.

Yoav

On 18 Oct 2019, at 20:30, Thakar, Eeshan <[email-masked]<mailto:[email-masked]>> wrote:

Hello,

Thanks,

Eeshan

Hi Yoav,

Thanks,

Eeshan

[1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/<https://urldefense.proofpoint.com/v2/url?u=https-3A__aws.amazon.com_blogs_iot_mqtt-2Dwith-2Dtls-2Dclient-2Dauthentication-2Don-2Dport-2D443-2Dwhy-2Dit-2Dis-2Duseful-2Dand-2Dhow-2Dit-2Dworks_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=gS3wQv9j7fykgWX5rYj3Juwi-bASrckP4DIA5dBf2Ec&e=>

From: Yoav Nir <[email-masked]<mailto:[email-masked]>>
Date: Saturday, August 10, 2019 at 2:08 AM
To: "Thakar, Eeshan" <[email-masked]<mailto:[email-masked]>>
Cc: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, "Lee, Alexandra" <[email-masked]<mailto:[email-masked]>>, "Sharfin, Jared" <[email-masked]<mailto:[email-masked]>>, "Gochenaur, Drew" <[email-masked]<mailto:[email-masked]>>
Subject: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry

Type of Assignment:

Registry:

Description:

Additional Info:
[1] MQTT 3.1 Specification: http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html<https://urldefense.proofpoint.com/v2/url?u=http-3A__public.dhe.ibm.com_software_dw_webservices_ws-2Dmqtt_mqtt-2Dv3r1.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=cCCKZ-lqltftwi8iSb9xnH41GIG7pDOo77inFY0LShI&e=>
[2] MQTT 3.1.1 Specification: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html<https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-2Dopen.org_mqtt_mqtt_v3.1.1_csprd02_mqtt-2Dv3.1.1-2Dcsprd02.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=PmP61TQmKHzpZMhM8TNDzpcZBqp1fZ8RM7xE05_c9T8&e=>
[3] MQTT 5.0 Specification: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html<https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-2Dopen.org_mqtt_mqtt_v5.0_mqtt-2Dv5.0.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=BEoHGVZzaCG6fp19ig2vfDpkz4rJkQhdUEVOG8EtQD0&e=>

Hi, Eeshan.

Thanks

Yoav

---

From: Yoav Nir <[email-masked]>
Date: Fri, 18 Oct 2019 21:56:13 +0300

Yup, even IP.

IANA: Can you please add the following registration?

Registry name: TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs
Protocol field should be “OASIS Message Queuing Telemetry Transport (MQTT)”
Identification sequence should be:   0x6d 0x71 0x74 0x74 (“mqtt”)
Reference should be this document:   http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html>

Thanks.

Yoav
(on behalf of the TLS registry review team)

> On 18 Oct 2019, at 21:44, Salz, Rich <[email-masked]> wrote:
> 
> I’m fine with it.
>  
>> On 18 Oct 2019, at 20:30, Thakar, Eeshan <[email-masked] <mailto:[email-masked]>> wrote:
>>  
>> Hello,
>>  
>> [1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__aws.amazon.com_blogs_iot_mqtt-2Dwith-2Dtls-2Dclient-2Dauthentication-2Don-2Dport-2D443-2Dwhy-2Dit-2Dis-2Duseful-2Dand-2Dhow-2Dit-2Dworks_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=gS3wQv9j7fykgWX5rYj3Juwi-bASrckP4DIA5dBf2Ec&e=>
>>  
>> From: Yoav Nir <[email-masked] <mailto:[email-masked]>>
>> To: "Thakar, Eeshan" <[email-masked] <mailto:[email-masked]>>
>> Cc: "[email-masked] <mailto:[email-masked]>" <[email-masked] <mailto:[email-masked]>>, "Lee, Alexandra" <[email-masked] <mailto:[email-masked]>>, "Sharfin, Jared" <[email-masked] <mailto:[email-masked]>>, "Gochenaur, Drew" <[email-masked] <mailto:[email-masked]>>
>>> [1] MQTT 3.1 Specification: http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__public.dhe.ibm.com_software_dw_webservices_ws-2Dmqtt_mqtt-2Dv3r1.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=cCCKZ-lqltftwi8iSb9xnH41GIG7pDOo77inFY0LShI&e=>
>>> [2] MQTT 3.1.1 Specification: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-2Dopen.org_mqtt_mqtt_v3.1.1_csprd02_mqtt-2Dv3.1.1-2Dcsprd02.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=PmP61TQmKHzpZMhM8TNDzpcZBqp1fZ8RM7xE05_c9T8&e=>
>>> [3] MQTT 5.0 Specification: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-2Dopen.org_mqtt_mqtt_v5.0_mqtt-2Dv5.0.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=BEoHGVZzaCG6fp19ig2vfDpkz4rJkQhdUEVOG8EtQD0&e=>
>>>  
>>  
>> Hi, Eeshan.
>>

---

From: "Sabrina Tanamal via RT" <[email-masked]>
Date: Tue, 22 Oct 2019 21:56:21 +0000

Hi Yoav, all, 

Before we add this entry to the registry, should we continue to list the entries chronologically by the registration date? If so, should we make an exception for the reserved entries and list them at the end, or should we add the newest entry after the last reserved entry?

You can see the current registry here: 

https://www.iana.org/assignments/tls-extensiontype-values

Thanks,
Sabrina

On Fri Oct 18 18:56:57 2019, [email-masked] wrote:
> Reference should be this document:   http://docs.oasis-
> open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <http://docs.oasis-
> open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html>
> 
> Thanks.
> 
> Yoav
> > Cc: "Lee, Alexandra" <[email-masked]>, "Sharfin, Jared"
> > <[email-masked]>, "Gochenaur, Drew" <[email-masked]>
> >> Cc: [email-masked] <mailto:[email-masked]>; Lee,
> >> Alexandra <[email-masked] <mailto:[email-masked]>>; Sharfin,
> >> Jared <[email-masked] <mailto:[email-masked]>>; Gochenaur,
> >> Drew <[email-masked] <mailto:[email-masked]>>
> >> Thanks for taking a look through the request. The current
> >> implementation for the AWS IoT Gateway endpoint does support
> >> HTTP/1.1 and MQTT (3.1 and 3.1.1) on the same port (443) using ALPN
> >> (with a custom ALPN protocol id).
> >> It also supports MQTT on the IANA registered port (8883), but allows
> >> ALPN based MQTT connections on 443 to work around standard firewall
> >> configurations [1].
> >>
> >> The goal with getting the “mqtt” protocol id registered was to have
> >> a common basis for all implementers of gateways that support HTTP
> >> and MQTT (multiple cloud IoT services do so today, albeit not on the
> >> same port) to have a way to accept MQTT traffic on port 443. This is
> >> similar to how CoAP has both an ALPN registered string (“coap”) and
> >> a registered port (5684 for CoAP with TCP/TLS).
> >>
> >> Thanks,
> >>
> >> Eeshan
> >>
> >> [1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-
> >> authentication-on-port-443-why-it-is-useful-and-how-it-works/
> >> <https://urldefense.proofpoint.com/v2/url?u=https-
> >> 3A__aws.amazon.com_blogs_iot_mqtt-2Dwith-2Dtls-2Dclient-
> >> 2Dauthentication-2Don-2Dport-2D443-2Dwhy-2Dit-2Dis-2Duseful-2Dand-
> >> 2Dhow-2Dit-
> >> 2Dworks_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=gS3wQv9j7fykgWX5rYj3Juwi-
> >> bASrckP4DIA5dBf2Ec&e=>
> >>
> >> Cc: "[email-masked] <mailto:[email-masked]>" <tls-
> >> [email-masked] <mailto:[email-masked]>>, "Lee,
> >> Alexandra" <[email-masked] <mailto:[email-masked]>>,
> >> "Sharfin, Jared" <[email-masked] <mailto:[email-masked]>>,
> >> "Gochenaur, Drew" <[email-masked] <mailto:[email-masked]>>
> >> On 9 Aug 2019, at 23:45, Thakar, Eeshan
> >> <thakar=[email-masked]
> >> <mailto:thakar=[email-masked]>> wrote:
> >>
> >>> Type of Assignment:
> >>> The mqtt protocol has the protocol version written into the first
> >>> message on a connection. The mqtt server implementations typically
> >>> understand the protocol version based on the fixed header on the
> >>> first message (connect).
> >>>
> >>> Adding this protocol id to the registry will help the community
> >>> since clients wanting to request mqtt as the protocol would have an
> >>> appropriate specification reference to use.
> >>>
> >>> Additional Info:
> >>> [1] MQTT 3.1 Specification:
> >>> http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-
> >>> v3r1.html <https://urldefense.proofpoint.com/v2/url?u=http-
> >>> 3A__public.dhe.ibm.com_software_dw_webservices_ws-2Dmqtt_mqtt-
> >>> 2Dv3r1.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >>> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=cCCKZ-
> >>> lqltftwi8iSb9xnH41GIG7pDOo77inFY0LShI&e=>
> >>> [2] MQTT 3.1.1 Specification: http://docs.oasis-
> >>> open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html
> >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-
> >>> 2Dopen.org_mqtt_mqtt_v3.1.1_csprd02_mqtt-2Dv3.1.1-
> >>> 2Dcsprd02.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >>> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=PmP61TQmKHzpZMhM8TNDzpcZBqp1fZ8RM7xE05_c9T8&e=>
> >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-
> >>> 2Dopen.org_mqtt_mqtt_v5.0_mqtt-
> >>> 2Dv5.0.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >>> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=BEoHGVZzaCG6fp19ig2vfDpkz4rJkQhdUEVOG8EtQD0&e=>
> >>>
> >>
> >> Hi, Eeshan.
> >>
> >> I’ve looked through the linked specifications, especially the third
> >> one because it says it replaces the others.
> >>
> >> It says that TCP port 8883 is registered with IANA for MQTT over
> >> TLS, and the IANA registry confirms it.  If you have your own port,
> >> why do you need ALPN?
> >>
> >> So if you were using a server listening on port 443 and serving both
> >> MQTT and HTTP/2 you would need that to distinguish clients that need
> >> MQTT from web browsers that need HTTP/2.
> >>

---

From: "Salz, Rich" <[email-masked]>
Date: Tue, 22 Oct 2019 23:38:44 +0000

Put the reserved first and then chronologically.

On 10/22/19, 5:56 PM, "Sabrina Tanamal via RT" <[email-masked]> wrote:

    Hi Yoav, all, 

    
    
    Thanks,
    Sabrina
    
    > >> this described elsewhere?
    
    _______________________________________________
    tls-reg-review mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/tls-reg-review

---

From: "Sabrina Tanamal via RT" <[email-masked]>
Date: Wed, 23 Oct 2019 23:43:30 +0000

Hi all, 

We've added the following entry to the Application-Layer Protocol Negotiation (ALPN) Protocol IDs registry:

Protocol: OASIS Message Queuing Telemetry Transport (MQTT)
Identification Sequence: 0x6d 0x71 0x74 0x74 (“mqtt”)
Reference: [http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html]

Please see

Best regards, 

Sabrina Tanamal
Senior IANA Services Specialist