Extension of the Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE) to Transport Layer Security (TLS)
updates
- rfc-9202 — Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)
Extracted elements (11)
RFC 9202 was originally specified only for DTLS, but the profile works equally well for TLS. This extension is motivated by network environments where UDP may be blocked, requiring clients to fall back from CoAP over UDP to CoAP over TCP for NAT or firewall traversal.
The same access token can be used with either DTLS or TLS between a given Client/RS pair, enabling transport-layer flexibility without requiring separate token issuance per transport type.
A Client that implements either TLS or DTLS but not both might fail entirely in establishing a secure communication channel with a Resource Server that only supports the other mechanism.
Clients and Resource Servers SHOULD support DTLS and MAY support TLS, since resource-constrained devices are not expected to support both transport layer security mechanisms.
Clients that support either DTLS or TLS but not both SHOULD use the transport protocol underlying their supported security mechanism for initial unauthorized resource requests to the Resource Server.
If DTLS connection fails, the Client MAY try to connect to the Resource Server via TLS as a fallback.
Nonconstrained Clients and Resource Servers SHOULD support both TLS and DTLS.
When an initial unauthorized resource request succeeds, the Client SHOULD first use the same underlying transport protocol for the security association to the Resource Server (DTLS for UDP, TLS for TCP).
The ace_profile parameter value 'coap_dtls' (CBOR value 1) in AS-to-Client responses or access token claims now indicates that either DTLS or TLS may be used for transport layer security between Client and Resource Server.
The 'ACE Profiles' IANA registry entry for 'coap_dtls' (CBOR value 1) has been updated to reflect that the profile covers both DTLS and TLS channels, with references updated to include RFC 9430 alongside RFC 9202.
All security considerations and requirements from RFC 9202 (DTLS Profile for ACE), TLS 1.3 (RFC 8446), and BCP 195 (RFC 8996, RFC 9325, which deprecates TLS 1.0/1.1 and provides TLS/DTLS recommendations) apply to this document.