Subject: [Uta] TLS Implementation Status for IoT

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 21 Sep 2020 09:20:45 +0000

Hi all,

working on draft-ietf-uta-tls13-iot-profile, Thomas and I have been looking at the implementation status of TLS/DTLS extensions on embedded devices. Here is what we found out looking at various popular stacks. There are lots of features in prototype status and we have not taken those into account.

"red" means not implemented, "green" refers to an implemented feature, and "white" is an indication that we didn't have a chance to figure out whether the feature is supported or not because it was not described in the documentation.

In a nutshell, it is fair to say that certificate and PSKs are well supported. Raw public key support is also available with a number of implementations.
What is a bit disappointing is that many extensions targeting IoT optimizations are not implemented. It is hard to say why. Maybe companies don't feel a need to use these optimizations, maybe the optimizations aren't good enough, or companies are unaware of these RFCs.

Please let us know if we got something wrong or if we forgot your implementation.

Ciao
Hannes
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: Eliot Lear <[email-masked]>
Date: Mon, 21 Sep 2020 11:51:59 +0200

Really nice work, Hannes.  Thank you.

Eliot

> On 21 Sep 2020, at 11:20, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
> 
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta

---

From: Achim Kraus <[email-masked]>
Date: Mon, 21 Sep 2020 20:40:59 +0200

Great overview!

 > What is a bit disappointing is that many extensions targeting IoT
optimizations are not implemented. It is hard to say why. Maybe
companies don't feel a need to use these optimizations, maybe the
optimizations aren't good enough, or companies are unaware of these RFCs.

Sometimes that depends on the fact, that both sides must implement it.
For many deployments, highly optimized TLS technique build the (cloud)
endpoint (hw-tls-load-balancers) and these endpoints seems not to change
too fast.

A other reason from my view for that delay in adoption may also be the
commercial view. IoT seems to be behind the timelines and so the invest
in that is also postponed.

best regards
Achim

---

From: Hubert Kario <[email-masked]>
Date: Wed, 23 Sep 2020 13:34:18 +0200

On Monday, 21 September 2020 11:20:45 CEST, Hannes Tschofenig wrote:
> Hi all,
>
> working on draft-ietf-uta-tls13-iot-profile, Thomas and I have 
> been looking at the implementation status of TLS/DTLS extensions 
> on embedded devices. Here is what we found out looking at 
> various popular stacks. There are lots of features in prototype 
> status and we have not taken those into account.
>
> "red" means not implemented, "green" refers to an implemented 
> feature, and "white" is an indication that we didn't have a 
> chance to figure out whether the feature is supported or not 
> because it was not described in the documentation.
>
> In a nutshell, it is fair to say that certificate and PSKs are 
> well supported. Raw public key support is also available with a 
> number of implementations.
> What is a bit disappointing is that many extensions targeting 
> IoT optimizations are not implemented. It is hard to say why. 
> Maybe companies don't feel a need to use these optimizations, 
> maybe the optimizations aren't good enough, or companies are 
> unaware of these RFCs.
>

for future comparisons, could you add which versions of those libraries
did you look at?

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic