RFC 8902
TLS Authentication Using Intelligent Transport System (ITS) Certificates
TLS Authentication Using Intelligent Transport System (ITS) Certificates 🚗💖
Okay bestie, this is RFC 8902 and it is so experimental 🧪. It's an Independent Submission in the Experimental category (ISSN 2070-1721), dated September 2020. The editors are M. Msahli, Ed. (Telecom Paris), N. Cam-Winget, Ed. (Cisco), and W. Whyte, Ed. (Qualcomm). The other authors are A. Serhrouchni (Telecom Paris) and H. Labiod (Telecom Paris). The header doesn't list anything it obsoletes or updates, so no drama there 💅.
Abstract 🌸
The IEEE and ETSI have specified a type of end-entity certificate. This document defines an experimental change to TLS so it can support IEEE/ETSI certificate types to authenticate TLS entities 🫶.
Status of This Memo 📜
This document is not an Internet Standards Track specification. It's published so people can examine it, try out experimental implementations, and evaluate it 🔍.
This document defines an Experimental Protocol for the Internet community. It's a contribution to the RFC Series, independent of any other RFC stream. The RFC Editor chose to publish it at their discretion and makes no statement about its value for implementation or deployment. Documents approved for publication by the RFC Editor are not candidates for any level of Internet Standard. See Section 2 of RFC 7841 for the details 🙈.
Information about the current status of this document, any errata, and how to give feedback on it can be found at https://www.rfc-editor.org/info/rfc8902 🔗.
Copyright Notice ©️
Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these documents carefully, because they explain your rights and restrictions with respect to this document 📚.
Table of Contents 🗂️
1. Introduction
1.1. Experiment Overview
2. Requirements Terminology
3. Extension Overview
4. TLS Client and Server Handshake
4.1. Client Hello
4.2. Server Hello
5. Certificate Verification
6. Examples
6.1. TLS Server and TLS Client Use the ITS Certificate
6.2. TLS Client Uses the ITS Certificate and TLS Server Uses the
X.509 Certificate
7. Security Considerations
7.1. Securely Obtaining Certificates from an Online Repository
7.2. Expiry of Certificates
7.3. Algorithms and Cryptographic Strength
7.4. Interpreting ITS Certificate Permissions
7.5. Psid and Pdufunctionaltype in CertificateVerify
8. Privacy Considerations
9. IANA Considerations
10. Normative References
Acknowledgements
Authors' Addresses1. Introduction ✨
Okay so the TLS protocol [RFC8446] lets you use X.509 certificates and raw public keys to authenticate servers and clients. This document describes an experimental extension that follows the procedures from [RFC7250] to support the certificate format that the IEEE specifies in [IEEE1609.2] and that ETSI profiles in [TS103097]. These standards cover secure communication in vehicular environments, and the certificates are called Intelligent Transport Systems (ITS) Certificates in this document 🚙💨.
The certificate types are tuned for bandwidth and processing time, which matters for delay-sensitive applications. They also give both authentication and authorization info, so access control decisions can be made fast in the ad hoc networks you find in Intelligent Transport Systems (ITS) 🏎️. The standards define different certificate types to support a full Public Key Infrastructure (PKI) specification. The certificates used in this context are end-entity certificates, meaning certificates that have the IEEE 1609.2 appPermissions field present 🎯.
ITS certificates are becoming super widespread. In practice, ITS communications make heavy use of 10 MHz channels with a typical throughput of 6 Mbps. (The 802.11OCB modulation that gives this throughput isn't the one with the highest throughput, but it gives a robust signal over a range up to 300-500 m, which is the "sweet spot" communications range for ITS operations like collision avoidance 🥹.) The compact nature of ITS certificates, compared to X.509 certificates, makes them a great fit for this setting 💅.
ITS certificates are also a great fit for the machine-to-machine (M2M) ad hoc network setting. Their direct encoding of permissions (see Section 7.4) lets a receiver make an immediate accept/deny decision about an incoming message, without having to look up a remote identity and access management server 🙌. The EU has committed to using ITS certificates in Cooperative Intelligent Transport Systems deployments. A multi-year project developed a certificate policy for ITS certificates, including a specification of how different root certificates can be trusted across the system. It's hosted at https://ec.europa.eu/transport/themes/its/c-its_en, and the direct link is https://ec.europa.eu/transport/sites/transport/files/c-its_certificate_policy_release_1.pdf 📄.
The EU has committed funding for the first five years of operation of the top-level Trust List Manager entity. That lets organizations like motor vehicle original equipment manufacturers (OEMs) and national road authorities create root certificate authorities (CAs) and get them trusted 🏛️. In the US, the US Department of Transportation (USDOT) published a proposed regulation. It was active as of late 2019, though not rapidly progressing. It requires all light vehicles in the US to implement vehicle-to-everything (V2X) communications, including the use of ITS certificates. You can find it at https://www.federalregister.gov/documents/2017/01/12/2016-31059/federal-motor-vehicle-safety-standards-v2v-communications 🇺🇸. As of 2019, ITS deployments across the US, Europe, and Australia were using ITS certificates 🌏. Volkswagen has committed to deploying V2X using ITS certificates. New York, Tampa, and Wyoming are deploying traffic management systems with ITS certificates. GM deployed V2X in the Cadillac CTS, using ITS certificates 🚘.
ITS certificates are also used in a bunch of standards that build on top of the foundational IEEE and ETSI standards. The big ones are the Society of Automobile Engineers (SAE) J2945/x series of standards for applications, and ISO 21177 [ISO21177]. ISO 21177 builds a framework for exchanging multiple authentication tokens on top of the TLS variant specified in this document 🧩.
1.1. Experiment Overview 🧪
This document describes an experimental extension to the TLS security model. It uses a form of certificate that has never been used on the Internet before. Systems using this Experimental approach are kept separate from systems using standard TLS, through a new certificate type value that's reserved through IANA (see Section 9) 🔒. A TLS implementation that isn't part of the Experiment won't recognize this new certificate type and won't take part in the experiment. TLS sessions will either negotiate the use of existing X.509 certificates or fail to be established ❌.
This extension has been encouraged by stakeholders in the Cooperative ITS community so they can deploy ITS use cases, and it's expected to be used widely 🌈.
2. Requirements Terminology 🔑
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 💜.
3. Extension Overview 🎀
The TLS extensions "client_certificate_type" and "server_certificate_type" [RFC7250] are used to negotiate the type of Certificate messages used in TLS to authenticate the server and, optionally, the client. Using separate extensions allows mixed deployments, where the client and server can use certificates of different types 🍓. It's expected that ITS deployments will see both peers using ITS certificates, because the ecosystem is so homogeneous, but there's no technical barrier that stops mixed certificate usage 🤷♀️.
This document defines a new certificate type, 1609Dot2, for use with TLS 1.3. The updated CertificateType enumeration and the matching addition to the CertificateEntry structure are shown below. CertificateType values are sent in the "server_certificate_type" and "client_certificate_type" extensions, and the CertificateEntry structures are included in the certificate chain sent in the Certificate message. In the case of TLS 1.3, the "client_certificate_type" SHALL contain a list of supported certificate types proposed by the client, as shown in the figure below 🧚:
/* Managed by IANA */
enum {
X509(0),
RawPublicKey(2),
1609Dot2(3),
(255)
} CertificateType;
struct {
select (certificate_type) {
/* certificate type defined in this document.*/
case 1609Dot2:
opaque cert_data<1..2^24-1>;
/* RawPublicKey defined in RFC 7250*/
case RawPublicKey:
opaque ASN.1_subjectPublicKeyInfo<1..2^24-1>;
/* X.509 certificate defined in RFC 8446*/
case X.509:
opaque cert_data<1..2^24-1>;
};
Extension extensions<0..2^16-1>;
} CertificateEntry;As per [RFC7250], the server processes the received [endpoint]_certificate_type extension(s) and selects one of the offered certificate types. It then returns the negotiated value in its EncryptedExtensions (TLS 1.3) message. Note that there is no requirement for the negotiated value to be the same in client_certificate_type and server_certificate_type extensions sent in the same message 🦋.
4. TLS Client and Server Handshake ✨
Okay bestie, here's the handshake flow 🦋 Figure 1 shows the message order for a full TLS 1.3 handshake where both certificate types get negotiated.
Client Server
Key ^ ClientHello
Exch | + server_certificate_type*
| + client_certificate_type*
| + key_share*
v + signature_algorithms* -------->
ServerHello ^ Key
+ key_share* v Exch
{EncryptedExtensions} ^ Server
{+ server_certificate_type*}| Params
{+ client_certificate_type*}|
{CertificateRequest*} v
{Certificate*} ^
{CertificateVerify*} | Auth
{Finished} v
<------- [Application Data*]
^ {Certificate*}
Auth | {CertificateVerify*}
v {Finished} -------->
[Application Data] <-------> [Application Data]
+ Indicates noteworthy extensions sent in the
previously noted message.
* Indicates optional or situation-dependent
messages/extensions that are not always sent.
{} Indicates messages protected using keys
derived from a [sender]_handshake_traffic_secret.
[] Indicates messages protected using keys
derived from [sender]_application_traffic_secret_N.
Figure 1: Message Flow with Certificate Type Extension for Full
TLS 1.3 HandshakeSo for TLS 1.3, clients and servers negotiate ITS certificate-based authentication by including the extension of type "client_certificate_type" and "server_certificate_type" in the extended Client Hello and "EncryptedExtensions". 🎀
4.1. Client Hello
Here's the deal: in order to say "hey, I support ITS certificates," a client MUST include an extension of type "client_certificate_type" or "server_certificate_type" in the extended Client Hello message, as described in Section 4.1.2 of [RFC8446] (TLS 1.3). 💅
For TLS 1.3, the rules for when the Client Certificate and CertificateVerify messages show up are:
- The client's Certificate message is present if and only if the server sent a CertificateRequest message.
- The client's CertificateVerify message is present if and only if the client's Certificate message is present and contains a non-empty certificate_list.
For maximum compatibility, all implementations SHOULD be prepared to handle "potentially" extraneous certificates and arbitrary orderings from any TLS version, with the exception of the end-entity certificate, which MUST be first. 🫶
4.2. Server Hello
When the server gets the Client Hello containing the client_certificate_type extension and/or the server_certificate_type extension, a few scenarios are possible 👀
- If both the client and server indicate support for the ITS certificate type, the server MAY select the first (most preferred) certificate type from the client's list that is supported by both peers.
- The server does not support any of the proposed certificate types and terminates the session with a fatal alert of type "unsupported_certificate". 💀
- The server supports the certificate types specified in this document. In this case, it MAY respond with a certificate of this type. It MAY also include the client_certificate_type extension in Encrypted Extension. Then, the server requests a certificate from the client (via the CertificateRequest message).
The certificates in the TLS client or server certificate chain MAY be sent as part of the handshake, MAY be obtained from an online repository, or might already be known to and cached at the endpoint. If the handshake does not contain all the certificates in the chain, and the endpoint cannot access the repository and does not already know the certificates from the chain, then it SHALL reject the other endpoint's certificate and close the connection. Protocols to support retrieving certificates from a repository are specified in ETSI [TS102941]. 🌸
5. Certificate Verification
Verifying an ITS certificate or certificate chain is described in section 5.1 of [IEEE1609.2]. For TLS 1.3, when the certificate_type is 1609.2, the CertificateVerify contents and processing are different from the CertificateVerify message specified for other values of certificate_type in [RFC8446]. In this case, the CertificateVerify message contains an Ieee1609Dot2Data encoded with Canonical Octet Encoding Rules (OER) [ITU-TX.696] of type signed, as specified in [IEEE1609.2] and [IEEE1609.2b], where:
- payload contains an extDataHash containing the SHA-256 hash of the data that the signature is calculated over. This is identical to the data that the signature is calculated over in standard TLS, which is reproduced below for clarity.
- headerInfo.psid indicates the application activity that the certificate is authorizing.
- headerInfo.generationTime is the time at which the data structure was generated.
- headerInfo.pduFunctionalType (as specified in [IEEE1609.2b]) is present and is set equal to tlsHandshake (1).
All other fields in the headerInfo are omitted. The certificate appPermissions field SHALL be present and SHALL permit (as defined in [IEEE1609.2]) signing of PDUs with the PSID indicated in the HeaderInfo of the SignedData. If the application specification for that PSID requires Service Specific Permissions (SSP) for signing a pduFunctionalType of tlsHandshake, this SSP SHALL also be present. For more details on the use of PSID and SSP, see [IEEE1609.2], clauses 5.1.1 and 5.2.3.3.3. All other fields in the headerInfo are omitted.
The certificate appPermissions field SHALL be present and SHALL permit (as defined in [IEEE1609.2]) signing of PDUs with the PSID indicated in the HeaderInfo of the SignedData. If the application specification for that PSID requires Service Specific Permissions (SSP) for signing a pduFunctionalType of tlsHandshake, this SSP SHALL also be present.
The signature and verification are carried out as specified in [IEEE1609.2].
The input to the hash process is identical to the message input for TLS 1.3, as specified in Section 4.4.3 of [RFC8446], consisting of pad, context string, separator, and content, where content is Transcript-Hash(Handshake Context, Certificate). 🔥
6. Examples
Some of the message-exchange examples are shown in Figures 2 and 3. 📖
6.1. TLS Server and TLS Client Use the ITS Certificate
This section shows an example where both the TLS client and the TLS server use ITS certificates. So, both the server and the client fill in the client_certificate_type and server_certificate_type extension with the IEEE 1609 Dot 2 type, as shown in Figure 2. 🧚
Client Server
ClientHello,
client_certificate_type=1609Dot2,
server_certificate_type=1609Dot2, --------> ServerHello,
{EncryptedExtensions}
{client_certificate_type=1609Dot2}
{server_certificate_type=1609Dot2}
{CertificateRequest}
{Certificate}
{CertificateVerify}
{Finished}
{Certificate} <------- [Application Data]
{CertificateVerify}
{Finished} -------->
[Application Data] <-------> [Application Data]
Figure 2: TLS Client and TLS Server Use the ITS Certificate6.2. TLS Client Uses the ITS Certificate and TLS Server Uses the X.509 Certificate
This example shows the TLS authentication, where the TLS client fills in the server_certificate_type extension with the X.509 certificate and raw public key types, as shown in Figure 3. The client indicates that it can receive and validate an X.509 certificate from the server. The server chooses the X.509 certificate to authenticate itself to the client. This applies when the server supports a raw public key. 🌈
Client Server
ClientHello,
client_certificate_type=(1609Dot2),
server_certificate_type=(1609Dot2,
X509,RawPublicKey), -----------> ServerHello,
{EncryptedExtensions}
{client_certificate_type=1609Dot2}
{server_certificate_type=X509}
{CertificateRequest}
{Certificate}
{CertificateVerify}
{Finished}
<--------- [Application Data]
{Finished} --------->
[Application Data] <--------> [Application Data]
Figure 3: TLS Client Uses the ITS Certificate and TLS Server Uses
the X.509 Certificate7. Security Considerations 🔐
This section gives an overview of the basic security considerations you need to think about before implementing the necessary security mechanisms. The security considerations described throughout [RFC8446] apply here as well.
Heads up, this part is serious. Don't skip it! 😭
7.1. Securely Obtaining Certificates from an Online Repository
In particular, the certificates used to establish a secure connection MAY be obtained from an online repository. An online repository may be used to obtain the CA certificates in the chain of either participant in the secure session. ETSI TS 102 941 [TS102941] provides a mechanism that can be used to securely obtain ITS certificates.
7.2. Expiry of Certificates
Certificate lifetime conventions differ between ITS certificates and X.509 certificates. In particular, ITS certificates may be relatively short-lived compared with typical X.509 certificates. A party to a TLS session that accepts ITS certificates MUST check the expiry time in the received ITS certificate and SHOULD terminate a session when the certificate received in the handshake expires. ⏰
7.3. Algorithms and Cryptographic Strength
All ITS certificates use public-key cryptographic algorithms with an estimated strength on the order of 128 bits or more. Specifically, they use Elliptic Curve Cryptography (ECC) based on curves with keys of length 256 bits or longer. An implementation of the techniques specified in this document SHOULD require that if X.509 certificates are used by one of the parties to the session, those certificates are associated with cryptographic algorithms with (pre-quantum-computer) strength of at least 128 bits. 🛡️
7.4. Interpreting ITS Certificate Permissions 🦋
Okay so, ITS certificates in TLS show what the holder is allowed to do using two fields 💅 The first is a PSID, which is also called an ITS Application Identifier (ITS-AID). It points to a broad set of application activities and gives context for the holder's permissions 🌸 The second is a Service Specific Permissions (SSP) field tied to that PSID, and it narrows things down to the specific activities the holder is entitled to carry out inside that broad set ✨
For example, SAE [SAEJ29453] uses PSID 0204099 for activities around reporting weather and managing weather response 🌦️ Its SSP says whether the holder is a Weather Data Management System (WDMS, i.e., a central road manager), an ordinary vehicle, or a vehicle belonging to a managed road maintenance fleet 🚗 If you want more on PSIDs, check [IEEE1609.12], and for how SSPs get developed, check [SAEJ29455] 🧚
7.5. Psid and Pdufunctionaltype in CertificateVerify 💜
Bestie, this part is so important 😭 The CertificateVerify message for TLS 1.3 is an Ieee1609Dot2Data of type signed, and the signature inside it was generated using an ITS certificate 🔐 That certificate can carry multiple PSIDs. When a CertificateVerify message like this is used, the HeaderInfo inside the Ieee1609Dot2Data MUST have the pduFunctionalType field present and set to tlsHandshake 🎀
Here's the reason behind it. Depending on how the application tied to its PSID(s) is defined, an ITS certificate might be used to sign messages directly, to sign TLS CertificateVerify messages, or both 👑 To stop a signature made in one context from being replayed in another, so that a message signature can't be passed off as a CertificateVerify or the other way around, the pduFunctionalType field acts as the signer's statement of intent about how the signed message is meant to be used 🔥 If pduFunctionalType is absent, the message is a directly signed message for the application and MUST NOT be interpreted as a CertificateVerify 🙈
Also, each PSID has an owning organization with sole rights to define the activities tied to it 🌈 If an application specifier wants to expand the activities for an existing PSID (say, to cover activities over a secure session like the one specified in this document), they have to negotiate with the PSID owner so the functionality gets added to the official specification for that PSID 💖
8. Privacy Considerations 🌸
For privacy in a vehicular environment, the ITS certificate gets used for a bunch of reasons 🫶
- In order to address the risk of a personal data leakage, messages exchanged for vehicle-to-vehicle (V2V) communications are signed using ITS pseudonym certificates. 🦋
- The purpose of these certificates is to provide privacy and minimize the exchange of private data. ✨
9. IANA Considerations 🍓
IANA maintains the "Transport Layer Security (TLS) Extensions" registry with a subregistry called "TLS Certificate Types". 📝
Value 3 was previously assigned for "1609Dot2" and included a reference to draft-tls-certieee1609. IANA has updated this entry to reference this RFC. 💅
10. Normative References 📚
[IEEE1609.12] IEEE, "IEEE Standard for Wireless Access in Vehicular Environments (WAVE) - Identifier Allocations", IEEE 1609.12-2016, December 2016.
[IEEE1609.2] IEEE, "IEEE Standard for Wireless Access in Vehicular Environments -- Security Services for Applications and Management Messages", IEEE Standard 1609.2-2016, DOI 10.1109/IEEESTD.2016.7426684, March 2016, https://doi.org/10.1109/IEEESTD.2016.7426684.
[IEEE1609.2b] IEEE, "IEEE Standard for Wireless Access in Vehicular Environments--Security Services for Applications and Management Messages - Amendment 2--PDU Functional Types and Encryption Key Management", IEEE 1609.2b-2019, June 2019.
[ISO21177] ISO, "Intelligent transport systems - ITS station security services for secure session establishment and authentication between trusted devices", ISO/TS 21177:2019, August 2019.
[ITU-TX.696] ITU-T, "Information technology - ASN.1 encoding rules: Specification of Octet Encoding Rules (OER)", Recommendation ITU-T X.696, August 2015.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, https://www.rfc-editor.org/info/rfc2119.
[RFC7250] Wouters, P., Ed., Tschofenig, H., Ed., Gilmore, J., Weiler, S., and T. Kivinen, "Using Raw Public Keys in Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS)", RFC 7250, DOI 10.17487/RFC7250, June 2014, https://www.rfc-editor.org/info/rfc7250.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, https://www.rfc-editor.org/info/rfc8174.
[RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, https://www.rfc-editor.org/info/rfc8446.
[SAEJ29453] SAE, "Requirements for V2I Weather Applications", J2945/3, June 2017.
[SAEJ29455] SAE, "Service Specific Permissions and Security Guidelines for Connected Vehicle Applications", J2945/5_202002, February 2020.
[TS102941] ETSI, "Intelligent Transport Systems (ITS); Security; Trust and Privacy Management", ETSI TS 102 941, 2018.
[TS103097] ETSI, "Intelligent Transport Systems (ITS); Security; Security header and certificate formats", ETSI TS 103 097, 2017.
Acknowledgements 🫶
The authors wish to thank Adrian Farrel, Eric Rescola, Russ Housley, Ilari Liusvaara, and Benjamin Kaduk for their feedback and suggestions on improving this document. Thanks are due to Sean Turner for his valuable and detailed comments. Special thanks to Panos Kampanakis, Jasja Tijink, and Bill Lattin for their guidance and support of the document. 💖
Authors' Addresses 🌈
Mounira Msahli (editor)
Telecom Paris
France
Email: mounira.msahli@telecom-paris.fr
Nancy Cam-Winget (editor)
Cisco
United States of America
Email: ncamwing@cisco.com
William Whyte (editor)
Qualcomm
United States of America
Email: wwhyte@qti.qualcomm.com
Ahmed Serhrouchni
Telecom Paris
France
Email: ahmed.serhrouchni@telecom-paris.fr
Houda Labiod
Telecom Paris
France
Email: houda.labiod@telecom-paris.fr📦 where this page comes from
- ietf: rfc8902 2020-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms