]> Cisco

ofriel@cisco.com

Hewlett-Packard Enterprise

daniel.harkins@hpe.com

This document defines a mechanism that enables a bootstrapping device to establish trust and mutually authenticate against a TLS server. Bootstrapping devices have a public/private key pair, and this mechanism enables a TLS server to prove to the device that it knows the public key, and the device to prove to the TLS server that it knows the private key. The mechanism leverages existing Device Provisioning Protocol (DPP) and TLS standards and can be used in an Extensible Authentication Protocol (EAP) exchange with an EAP server.

Introduction On-boarding devices with no, or limited, user interface can be difficult. Sometimes a credential is needed to access an /EAP-based network, and network connectivity is needed to obtain a credential. This poses a challenge for on-boarding devices. If a device has a public / private keypair, and trust in the integrity of a device's public key can be obtained in an out-of-band fashion, a device can be authenticated and provisioned with a usable credential for /EAP-based network access. While this authentication can be strong, the device's authentication of the network is somewhat weaker. presents a functional security model to address this asymmetry. Device on-boarding protocols such as the Device Provisioning Profile , also referred to as Wi-Fi Easy Connect, address this use case but they have drawbacks. for instance does not support wired network access, and does not specify how the device's DPP keypair can be used in a TLS handshake. This document describes an an authentication mechanism that a device can use to mutually authenticate against a TLS server, and describes how that authentication protocol can be used in an EAP exchange for wired network access. This protocol is called TLS Proof of Knowledge or TLS-POK. This document does not address the problem of Wi-Fi network discovery, where a bootstrapping device detects multiple different Wi-Fi networks and needs a more robust and scalable mechanism than simple round-robin to determine the correct network to attach to. DPP addresses this issue but DPP's discovery will not work on a wired 802.1X ethernet port while TLS-POK will. Therefore, TLS-POK SHOULD NOT be used for bootstrapping against wired networks, and SHOULD be used for bootstrapping against wired networks.

Terminology The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. The following terminology is used throughout this document. 802.1X: IEEE Port-Based Network Access Control BSK: Bootstrap Key which is an elliptic curve public/private key pair from a cryptosystem suitable for doing ECDSA DPP: Device Provisioning Protocol EAP: Extensible Authentication Protocol EC: Elliptic Curve ECDSA: Elliptic Curve Digital Signature Algorithm EPSK: External Pre-Shared Key EST: Enrollment over Secure Transport NAI: Network Access Identifier PSK: Pre-Shared Key TEAP: Tunnel Extensible Authentication Protocol

Bootstrapping Overview A bootstrapping device holds a public / private elliptic curve (EC) key pair which this document refers to as a Bootstrap Key (BSK). The private key of the BSK is known only by the device. The public key of the BSK is known by the device, is known by the owner or holder of the device, and is provisioned on the TLS server by the TLS server operator. In order to establish trust and mutually authenticate, the TLS server proves to the device that it knows the public part of the BSK, and the device proves to the TLS server that it knows the private part of the BSK. More details on the BSK are given in . The TLS server could be an EAP server for network access, or could for example be an Enrollment over Secure Transport (EST) server. In the case of authentication against an EAP server, the EAP server SHOULD provision the device with a credential that it uses for subsequent EAP authentication.

EAP Network Access Enterprise deployments typically require an /EAP-based authentication to obtain network access. Protocols like Enrollment over Secure Transport (EST) can be used to enroll devices with a Certification Authority to allow them to authenticate using 802.1X/EAP. This creates a problem for bootstrapping devices where a certificate is needed for EAP authentication and 802.1X network access is needed to obtain a certificate. Devices whose BSK public key can be obtained in an out-of-band fashion and provisioned on the EAP server can perform a TLS-based EAP exchange, for instance Tunnel Extensible Authentication Protocol (TEAP) , and authenticate the TLS exchange using the authentication mechanisms defined in . This network connectivity can then be used to perform an enrollment protocol (such as provided by ) to obtain a credential for subsequent EAP authentication. Certificate lifecycle management may also be performed in subsequent TEAP transactions..

Supported EAP Methods This document defines a bootstrapping mechanism that results in a certificate being provisioned on a device that can be used for subsequent EAP authentication. Therefore, an EAP method supporting the provisioning of a certificate on a device is required. The only EAP method that currently supports provisioning of a certificate on a device is TEAP, therefore this document assumes that TEAP is the only supported EAP method. Section describes how TLS-POK is used with TEAP, including defining a suitable Network Access Identifier (NAI). If future EAP methods are defined supporting certificate provisioning, then TLS-POK could potentially be used with those methods. Defining how this would work is out of scope of this document.

Bootstrap Key The mechanism for device on-boarding defined in this document relies on an elliptic curve (EC) bootstrap key (BSK). This BSK MUST be from a cryptosystem suitable for doing ECDSA. A bootstrapping client device has an associated EC BSK. The BSK may be static and baked into device firmware at manufacturing time, or may be dynamic and generated at on-boarding time by the device. The BSK public key MUST be encoded as the DER representation of an ASN.1 SEQUENCE SubjectPublicKeyInfo from . The subjectPublicKey MUST be the compressed format of the public key. Note that the BSK public key encoding MUST include the ASN.1 AlgorithmIdentifier in addition to the subjectPublicKey. If the BSK public key can be shared in a trustworthy manner with a TLS server, a form of "entity authentication" (the step from which all subsequent authentication proceeds) can be obtained. The exact mechanism by which the TLS server gains knowledge of the BSK public key is out of scope of this specification, but possible mechanisms include scanning a QR code to obtain a base64 encoding of the DER representation of the ASN.1 SubjectPublicKeyInfo or uploading of a Bill of Materials (BOM) which includes this information. More information on QR encoding is given in . If the QR code is physically attached to the client device, or the BOM is associated with the device, the assumption is that the BSK public key obtained in this bootstrapping method belongs to the client. In this model, physical possession of the device implies legitimate ownership of the device. The TLS server may have knowledge of multiple BSK public keys corresponding to multiple devices, and existing TLS mechanisms are leveraged that enable the server to identity a specific bootstrap public key corresponding to a specific device. Using the process defined herein, the client proves to the TLS server that it has possession of the private key of its BSK. Provided that the mechanism in which the server obtained the BSK public key is trustworthy, a commensurate amount of authenticity of the resulting connection can be obtained. The server also proves that it knows the client's BSK public key which, if the client does not gratuitously expose its public key, can be used to obtain a modicum of correctness, that the client is connecting to the correct server (see ).

Alignment with Wi-Fi Alliance Device Provisioning Profile The definition of the BSK public key aligns with . This, for example, enables the QR code format as defined in to be reused for TLS-POK. Therefore, a device that supports both wired LAN and Wi-Fi LAN connections can have a single QR code printed on its label, or dynamically display a single QR code on a display, and the bootstrap key can be used for DPP if the device bootstraps against a Wi-Fi network, or TLS-POK if the device bootstraps against a wired network. Similarly, a common bootstrap public key format could be imported into a BOM into a server that handles devices connecting over both wired and Wi-Fi networks. Any bootstrapping method defined for, or used by, is compatible with TLS-POK.

Bootstrapping in TLS 1.3 Bootstrapping in TLS 1.3 leverages Certificate-Based Authentication with an External Pre-Shared Key. The External PSK (EPSK) is derived from the BSK public key as described in , and the EPSK is imported using Importing External Pre-Shared Keys (PSKs) for TLS 1.3. As the BSK public key is an ASN.1 SEQUENCE SubjectPublicKeyInfo from , and not a full PKI Certificate, the client must present the BSK as a raw public key as described in and use ECDSA as defined in for authentication. The TLS PSK handshake gives the client proof that the TLS server knows the BSK public key. Certificate-based authentication of the client to the server using the BSK gives the server proof that the client knows the BSK private key. This satisfies the proof of ownership requirements outlined in .

External PSK Derivation An EPSK is made up of the tuple of (Base Key, External Identity, Hash). The Base Key is the DER-encoded ASN.1 subjectPublicKeyInfo representation of the BSK public key. Zero byte padding MUST NOT be added to the DER-encoded representation of the BSK public key. The External Identity is derived from the DER-encoded representation of the BSK public key using with the SHA-256 hash algorithm as follows:

, Base Key), "tls13-bspsk-identity", L) where: - epskid is the EPSK External Identity - Base Key is the DER-encoded ASN.1 subjectPublicKeyInfo representation of the BSK public key - L equals 32, the length in octets of the SHA-256 output - <> is a NULL salt which is a string of L zeros ]]>

SHA-256 MUST be used when deriving epskid using . The ImportedIdentity structure is defined as:

; opaque context<0..2^16-1>; uint16 target_protocol; uint16 target_kdf; } ImportedIdentity; ]]>

and is created using the following values:

]]>

The ImportedIdentity context value MUST be "tls13-bsk". This informs the server that the mechanisms specified in this document for deriving the EPSK and executing the TLS handshake MUST be used. The EPSK and ImportedIdentity are used in the TLS handshake as specified in . Multiple ImportedIdentity values may be imported as per section 5.1. The target_kdf follows and aligns with the cipher suite hash algorithms advertised in the TLS 1.3 handshake between the device and the server. A server can choose a tradeoff between performance and storage by precomputing the identity of every bootstrapped key with every hash algorithm that it uses in TLS and use that to quickly lookup the bootstrap key and generate the PSK. Servers that choose not to employ this optimization will have to do a runtime check with every bootstrap key it holds against the identity the client provides. Test vectors for derivation of an EPSK External Identity from a BSK are given in the appendix.

TLS 1.3 Handshake Details The client includes the "tls_cert_with_extern_psk" extension in the ClientHello, per . The client identifies the BSK public key by inserting the serialized content of ImportedIdentity into the PskIdentity.identity in the PSK extension, per . The client MUST also include the "client_certificate_type" extension in the ClientHello and MUST specify type of RawPublicKey. Upon receipt of the ClientHello, the server looks up the client's EPSK key in its database using the mechanisms documented in . If no match is found, the server MUST terminate the TLS handshake with an alert. If the server finds the matching BSK public key, it includes the "tls_cert_with_extern_psk" extension in the ServerHello message, and the corresponding EPSK identity in the "pre_shared_key" extension. When these extensions have been successfully negotiated, the TLS 1.3 key schedule MUST include both the EPSK in the Early Secret derivation and an (EC)DHE shared secret value in the Handshake Secret derivation. After successful negotiation of these extensions, the full TLS 1.3 handshake is performed with the additional caveat that the server MUST send a CertificateRequest message and the client MUST authenticate with a raw public key (its BSK) per . The BSK is always an elliptic curve key pair, therefore the type of the client's Certificate MUST be ECDSA and MUST contain the client's BSK public key as a DER-encoded ASN.1 subjectPublicKeyInfo SEQUENCE. Note that the client MUST NOT share its BSK public key with the server until after the client has completed processing of the ServerHello and verified the TLS key schedule. The PSK proof is completed at this stage, and the server has proven to the client that it knows the BSK public key, and it is therefore safe for the client to send the BSK public key to the server in the Certificate message. If the PSK verification step fails when processing the ServerHello, the client terminates the TLS handshake and the BSK public key MUST NOT be shared with the server. When the server processes the client's Certificate, it MUST ensure that it is identical to the BSK public key that it used to generate the EPSK and ImportedIdentity for this handshake. When clients are configured to trust the first network which proves possession of their public key (as in ), they MAY forgo the checking of the server's certificate in the CertificateVerify and rely on the integrity of the bootstrapping method employed to distribute its key in order to validate trust in the authenticated TLS connection. The handshake is shown in .

ServerHello + cert_with_extern_psk + client_cert_type=RawPublicKey + key_share + pre_shared_key {EncryptedExtensions} {CertificateRequest} {Certificate} {CertificateVerify} <-------- {Finished} {Certificate} {CertificateVerify} {Finished} --------> ]]>

Using TLS Bootstrapping in EAP Upon "link up", an Authenticator on an 802.1X-protected port will issue an EAP Identity request to the newly connected peer. For unprovisioned devices that desire to take advantage of TLS-POK, there is no initial realm in which to construct an NAI (see ). This document uses the NAI mechanisms defined in and defines the EAP username "tls-pok-dpp" for use with the TEAP realm "teap.eap.arpa". The username "tls-pok-dpp" MUST be included yielding an initial identity of "tls-pok-dpp@teap.eap.arpa". This identifier MUST be included in the EAP Identity response in order to indicate to the Authenticator that TEAP is the desired EAP method. recommends how the device should behave if the Authenticator does not support TEAP or TLS-POK.

<- EAP-Request/ EAP-Type=TEAP (TLS Start) EAP-Response/ EAP-Type=TEAP (TLS client_hello with tls_cert_with_extern_psk and pre_shared_key) -> . . . ]]>

Both client and server have derived the EPSK and associated ImportedIdentity from the BSK public key as described in . When the client starts the TLS exchange in the EAP transaction, it includes the ImportedIdentity structure in the pre_shared_key extension in the ClientHello. When the server receives the ClientHello, it extracts the ImportedIdentity and looks up the EPSK and BSK public key. As previously mentioned in , the exact mechanism by which the server has gained knowledge of or been provisioned with the BSK public key is outside the scope of this document. The server continues with the TLS handshake and uses the EPSK to prove that it knows the BSK public key. When the client replies with its Certificate, CertificateVerify and Finished messages, the server MUST ensure that the public key in the Certificate message matches the BSK public key. Once the TLS handshake completes, the client and server have established mutual trust. The server can then proceed to provision a credential onto the client using, for example, the mechanisms outlined in . The client can then use this provisioned credential for subsequent EAP authentication. The BSK is only used during bootstrap, and is not used for any subsequent EAP authentication.

IANA Considerations This document adds the following to the "EAP Provisioning Identifiers" registry in the "Extensible Authentication Protocol (EAP) Registry" group. NAI: tls-pok-dpp@teap.eap.arpa Method Type: TEAP Reference: THIS DOCUMENT

Implementation Considerations Three key points are documented above, and are repeated here. The subjectPublicKey contained in the ASN.1 SEQUENCE SubjectPublicKeyInfo MUST be the compressed format of the public key. When deriving the External PSK from the BSK, zero byte padding MUST NOT be added to the DER-encoded representation of the BSK public key. SHA-256 MUST be used when using to derive the External PSK from the BSK. The BSK public key MUST NOT be freely available on the network.

Security Considerations Bootstrap and trust establishment by the TLS server is based on proof of knowledge of the client's bootstrap public key, a non-public datum. The TLS server obtains proof that the client knows its bootstrap public key and, in addition, also possesses its corresponding private key. Trust on the part of the client is based on successful completion of the TLS 1.3 handshake using the EPSK derived from the BSK. This proves to the client that the server knows its BSK public key. In addition, the client assumes that knowledge of its BSK public key is not widely disseminated and therefore any server that proves knowledge of its BSK public key is the appropriate server from which to receive provisioning, for instance via . describes a security model for this type of "imprinting". An attack on the bootstrapping method which substitutes the public key of a rogue device for the public key of an honest device can result in the TLS server on-boarding and trusting the rogue device. If an adversary has knowledge of the bootstrap public key, the adversary may be able to make the client bootstrap against the adversary's network. For example, if an adversary intercepts and scans QR labels on clients, and the adversary can force the client to connect to its server, then the adversary can complete the TLS-POK handshake with the client and the client will connect to the adversary's server. Since physical possession implies ownership, there is nothing to prevent a stolen device from being on-boarded. The BSK keypair used for ECDSA MUST be generated and validated according to section 6.2 of . Manufacturers SHOULD use a unique BSK for every single device they manufacture. If multiple devices share the same BSK, then network operators cannot differentiate between these devices, and cannot ensure that only specific authorized devices are allowed connect to their networks.

Information Technology Laboratory National Institute of Standards and Technology

US Gaithersburg

In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document specifies the syntax and semantics for the Subject Public Key Information field in certificates that support Elliptic Curve Cryptography. This document updates Sections 2.3.5 and 5, and the ASN.1 module of "Algorithms and Identifiers for the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 3279. [STANDARDS-TRACK] This document specifies a TLS 1.3 extension that allows a server to authenticate with a combination of a certificate and an external pre-shared key (PSK). This document describes an interface for importing external Pre-Shared Keys (PSKs) into TLS 1.3. This document specifies a new certificate type and two TLS extensions for exchanging raw public keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). The new certificate type allows raw public keys to be used for authentication. This document specifies a simple Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF), which can be used as a building block in various protocols and applications. The key derivation function (KDF) is intended to support a wide range of applications and requirements, and is conservative in its use of cryptographic hash functions. This document is not an Internet Standards Track specification; it is published for informational purposes. InkBridge Networks This document defines the eap.arpa. domain for use only in Network Access Identifiers (NAIs) as a way for Extensible Authentication Protocol (EAP) peers to signal to EAP servers that they wish to obtain limited, and unauthenticated, network access. EAP peers signal which kind of access is required via certain predefined identifiers which use the Network Access Identifier (NAI) format of RFC 7542. A table of identifiers and meanings is defined, which includes entries for RFC 9140. This document updates RFC5216 and RFC9190 to define an unauthenticated provisioning method. Those specifications suggested that such a method has possible, but they did not define how it would be done. This document also updates RFC9140 to deprecate "eap- noob.arpa", and replace it with "@noob.eap.arpa" IEEE Wi-Fi Alliance National Institute of Standards and Technology This document defines the Extensible Authentication Protocol (EAP), an authentication framework which supports multiple authentication methods. EAP typically runs directly over data link layers such as Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. EAP provides its own support for duplicate elimination and retransmission, but is reliant on lower layer ordering guarantees. Fragmentation is not supported within EAP itself; however, individual EAP methods may support this. This document obsoletes RFC 2284. A summary of the changes between this document and RFC 2284 is available in Appendix A. [STANDARDS-TRACK] This document profiles certificate enrollment for clients using Certificate Management over CMS (CMC) messages over a secure transport. This profile, called Enrollment over Secure Transport (EST), describes a simple, yet functional, certificate management protocol targeting Public Key Infrastructure (PKI) clients that need to acquire client certificates and associated Certification Authority (CA) certificates. It also supports client-generated public/private key pairs as well as key pairs generated by the CA. This document defines the Tunnel Extensible Authentication Protocol (TEAP) version 1. TEAP is a tunnel-based EAP method that enables secure communication between a peer and a server by using the Transport Layer Security (TLS) protocol to establish a mutually authenticated tunnel. Within the tunnel, TLV objects are used to convey authentication-related data between the EAP peer and the EAP server. In order to provide inter-domain authentication services, it is necessary to have a standardized method that domains can use to identify each other's users. This document defines the syntax for the Network Access Identifier (NAI), the user identifier submitted by the client prior to accessing resources. This document is a revised version of RFC 4282. It addresses issues with international character sets and makes a number of other corrections to RFC 4282.

Test Vectors

Test Vector 1: prime256v1 Base64 encoding of BSK: MDkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDIgACMvLyoOykj8sFJxSoZfzafuVEvM+kNYCxpEC6KITLb9g= Base64 encoding of epskid: Bd+lLlg/ERdtYacfzDfh1LjdL0+QWJQHdYXoS7JDSkA=

Test Vector 2: secp384r1 Base64 encoding of BSK: MEYwEAYHKoZIzj0CAQYFK4EEACIDMgACwDXKQ1pytcR1WbfqPaNGaXQ0RJnijJG1em8ZKilryZRDfNioq7+EPquT6l9laRvw Base64 encoding of epskid: yMWK26ec3klVFewg2znKntQgVoRcRRjW81n677GL+8w=

Test Vector 3: secp521r1 Base64 encoding of BSK: MFgwEAYHKoZIzj0CAQYFK4EEACMDRAADAIiHIAOXdPVuI8khCnJQHT1j53rQRnFCcY3CZUvxdXKJR9KW5RVB3HDQfmkoQWHEz4XngXUeFyDXliEo3eF6vhqDMFgwEAYHKoZIzj0CAQYFK4EEACMDRAADAIiHIAOXdPVuI8khCnJQHT1j53rQRnFCcY3CZUvxdXKJR9KW5RVB3HDQfmkoQWHEz4XngXUeFyDXliEo3eF6vhqD Base64 encoding of epskid: D+s3Ex81A8N36ECI3AdXwBzrOXuonZUMdhhHXVINhg8=

Test Vector 4: brainpoolP256r1 Base64 encoding of BSK: MDowFAYHKoZIzj0CAQYJKyQDAwIIAQEHAyIAA3fyUWqiV8NC9DAC88JzmVqnoT/reuCvq8lHowtwWNOZ Base64 encoding of epskid: j2TLWcXtrTej+f3q7EZrhp5SmP31uk1ZB23dfcR93EY=