2

Is there a way for authentication and authorizaion in CoAP without DTLS and on the application layer?

3 Answers3

4

Yes there is: OSCORE (RFC8613) got released recently, and provides application-layer security that is end-to-end, can support multicast (separate document, quite stable but not an RFC yet) and can still use CoAP proxies for retransmission and fragmentation.

OSCORE on its own only provides the symmetric parts, so for authentication using certificates, raw public keys or to get perfect forward secrecy, you'll still need ... something (EDHOC was suggested to fill in those parts and is my favorite solution) -- but whether you need that really depends on your particular application.

As for authorization, you may want to look into CWT (RFC8392) (the Constrained version of JWT); further documents around that are in preparation.

Community
  • 1
  • 1
chrysn
  • 810
  • 6
  • 19
1

Well, you might have somehow encrypt your payload, craft a key exchange approach, etc. but it is a really bad idea unless you are a top security expert. Though even in this case, schemes widely unknown publicly are threat.

DTLS covers most of security issues in a proven way.

Why shouldn't we roll own [security scheme]?

eugene-nikolaev
  • 1,290
  • 1
  • 13
  • 21
1

If you search for an alternative approach, I would strongly recommend, that you mention your intention doing so. Not that you fall from rain into storm.

So, do you have any hard drawbacks with DTLS?

DTLS has it's complexity and pitfalls. If other approaches, as OSCORE, competes better, depends on your criterias.

Achim Kraus
  • 729
  • 1
  • 7
  • 11