Table of Contents
1.4 Non normative references. 11
1.5.3 UTF-8 encoded strings. 13
2 MQTT Control Packet format16
2.1 Structure of an MQTT Control Packet16
2.2.1 MQTT Control Packet type. 16
3.1 CONNECT – Client requests a connection to a Server23
3.2 CONNACK – Acknowledge connection request31
3.3 PUBLISH – Publish message. 33
3.4 PUBACK – Publish acknowledgement37
3.5 PUBREC – Publish received (QoS 2 publish received, part 1)37
3.6 PUBREL – Publish release (QoS 2 publish received, part 2)38
3.7 PUBCOMP – Publish complete (QoS 2 publish received, part 3)39
3.8 SUBSCRIBE - Subscribe to topics. 40
3.9 SUBACK – Subscribe acknowledgement43
3.10 UNSUBSCRIBE – Unsubscribe from topics. 45
3.11 UNSUBACK – Unsubscribe acknowledgement47
3.13 PINGRESP – PING response. 48
3.14 DISCONNECT – Disconnect notification. 49
4.1.1 Non normative example. 51
4.3 Quality of Service levels and protocol flows. 52
4.3.1 QoS 0: At most once delivery. 52
4.3.2 QoS 1: At least once delivery. 53
4.3.3 QoS 2: Exactly once delivery. 54
4.4 Message delivery retry. 55
4.7 Topic Names and Topic Filters. 57
4.7.2 Topics beginning with $. 58
4.7.3 Topic semantic and usage. 58
5.2 MQTT solutions: security and certification. 60
5.3 Lightweight cryptography and constrained devices. 61
5.4.1 Authentication of Clients by the Server61
5.4.2 Authorization of Clients by the Server61
5.4.3 Authentication of the Server by the Client61
5.4.4 Integrity of Application Messages and Control Packets. 62
5.4.5 Privacy of Application Messages and Control Packets. 62
5.4.6 Non-repudiation of message transmission. 62
5.4.7 Detecting compromise of Clients and Servers. 62
5.4.8 Detecting abnormal behaviors. 63
5.4.9 Other security considerations. 63
6 Using WebSocket as a network transport65
Appendix A. Acknowledgements (non normative)68
Appendix B. Mandatory normative statements (non normative)70
Appendix C. Revision history (non normative)
1 Introduction
1.1 Organization of MQTT
This specification is split into seven chapters:
· Chapter 2 - MQTT Control Packet format
· Chapter 3 - MQTT Control Packets
· Chapter 4 - Operational behavior
· Chapter 6 - Using WebSocket as a network transport
· Chapter 7 - Conformance Targets
1.2 Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this specification are to be interpreted as described in IETF RFC 2119 [RFC2119].
Network Connection:
A construct provided by the underlying transport protocol that is being used by MQTT.
· It connects the Client to the Server.
· It provides the means to send an ordered, lossless, stream of bytes in both directions.
For examples see Section 4.2.
Application Message:
The data carried by the MQTT protocol across the network for the application. When Application Messages are transported by MQTT they have an associated Quality of Service and a Topic Name.
Client:
A program or device that uses MQTT. A Client always establishes the Network Connection to the Server. It can
· Publish Application Messages that other Clients might be interested in.
· Subscribe to request Application Messages that it is interested in receiving.
· Unsubscribe to remove a request for Application Messages.
· Disconnect from the Server.
Server:
A program or device that acts as an intermediary between Clients which publish Application Messages and Clients which have made Subscriptions. A Server
· Accepts Network Connections from Clients.
· Accepts Application Messages published by Clients.
· Processes Subscribe and Unsubscribe requests from Clients.
· Forwards Application Messages that match Client Subscriptions.
Subscription:
A Subscription comprises a Topic Filter and a maximum QoS. A Subscription is associated with a single Session. A Session can contain more than one Subscription. Each Subscription within a session has a different Topic Filter.
Topic Name:
The label attached to an Application Message which is matched against the Subscriptions known to the Server. The Server sends a copy of the Application Message to each Client that has a matching Subscription.
Topic Filter:
An expression contained in a Subscription, to indicate an interest in one or more topics. A Topic Filter can include wildcard characters.
Session:
A stateful interaction between a Client and a Server. Some Sessions last only as long as the Network Connection, others can span multiple consecutive Network Connections between a Client and a Server.
MQTT Control Packet:
A packet of information that is sent across the Network Connection. The MQTT specification defines fourteen different types of Control Packet, one of which (the PUBLISH packet) is used to convey Application Messages.
1.3 Normative references
Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
http://www.ietf.org/rfc/rfc2119.txt
Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003
http://www.ietf.org/rfc/rfc3629.txt
Dierks, T. and E. Rescorla, "The Transport Layer Security (TLS) Protocol Version 1.2", RFC 5246, August 2008.
http://www.ietf.org/rfc/rfc5246.txt
Fette, I. and A. Melnikov, "The WebSocket Protocol", RFC 6455, December 2011.
http://www.ietf.org/rfc/rfc6455.txt
[Unicode]
The Unicode Consortium. The Unicode Standard.
http://www.unicode.org/versions/latest/
1.4 Non normative references
[RFC793]
Postel, J. Transmission Control Protocol. STD 7, IETF RFC 793, September 1981.
http://www.ietf.org/rfc/rfc793.txt
Advanced Encryption Standard (AES) (FIPS PUB 197).
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
[DES]
Data Encryption Standard (DES).
http://csrc.nist.gov/publications/fips/fips46-3/fips46-3.pdf
[FIPS1402]
Security Requirements for Cryptographic Modules (FIPS PUB 140-2)
http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf
IEEE Standard for Local and metropolitan area networks - Secure Device Identity
http://standards.ieee.org/findstds/standard/802.1AR-2009.html
[ISO29192]
ISO/IEC 29192-1:2012 Information technology -- Security techniques -- Lightweight cryptography -- Part 1: General
http://www.iso.org/iso/home/store/catalogue_tc/catalogue_detail.htm?csnumber=56425
[MQTT NIST]
MQTT supplemental publication, MQTT and the NIST Framework for Improving Critical Infrastructure Cybersecurity
http://docs.oasis-open.org/mqtt/mqtt-nist-cybersecurity/v1.0/mqtt-nist-cybersecurity-v1.0.html
[MQTTV31]
MQTT V3.1 Protocol Specification.
http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html
[NISTCSF]
Improving Critical Infrastructure Cybersecurity Executive Order 13636
http://www.nist.gov/itl/upload/preliminary-cybersecurity-framework.pdf
[NIST7628]
NISTIR 7628 Guidelines for Smart Grid Cyber Security
http://www.nist.gov/smartgrid/upload/nistir-7628_total.pdf
[NSAB]
NSA Suite B Cryptography
http://www.nsa.gov/ia/programs/suiteb_cryptography/
[PCIDSS]
PCI-DSS Payment Card Industry Data Security Standard
https://www.pcisecuritystandards.org/security_standards/
[RFC1928]
Leech, M., Ganis, M., Lee, Y., Kuris, R., Koblas, D., and L. Jones, "SOCKS Protocol Version 5", RFC 1928, March 1996.
http://www.ietf.org/rfc/rfc1928.txt
[RFC4511]
Sermersheim, J., Ed., "Lightweight Directory Access Protocol (LDAP): The Protocol", RFC 4511, June 2006.
http://www.ietf.org/rfc/rfc4511.txt
[RFC5077]
Salowey, J., Zhou, H., Eronen, P., and H. Tschofenig, "Transport Layer Security (TLS) Session Resumption without Server-Side State", RFC 5077, January 2008.
http://www.ietf.org/rfc/rfc5077.txt
[RFC5280]
Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and W. Polk, "Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile", RFC 5280, May 2008.
http://www.ietf.org/rfc/rfc5280.txt
[RFC6066]
Eastlake 3rd, D., "Transport Layer Security (TLS) Extensions: Extension Definitions", RFC 6066, January 2011.
http://www.ietf.org/rfc/rfc6066.txt
[RFC6749]
Hardt, D., Ed., "The OAuth 2.0 Authorization Framework", RFC 6749, October 2012.
http://www.ietf.org/rfc/rfc6749.txt
[RFC6960]
Santesson, S., Myers, M., Ankney, R., Malpani, A., Galperin, S., and C. Adams, "X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP", RFC 6960, June 2013.
http://www.ietf.org/rfc/rfc6960.txt
[SARBANES]
Sarbanes-Oxley Act of 2002.
http://www.gpo.gov/fdsys/pkg/PLAW-107publ204/html/PLAW-107publ204.htm
U.S.-EU Safe Harbor
http://export.gov/safeharbor/eu/eg_main_018365.asp
1.5 Data representations
1.5.1 Bits
Bits in a byte are labeled 7 through 0. Bit number 7 is the most significant bit, the least significant bit is assigned bit number 0.
1.5.2 Integer data values
Integer data values are 16 bits in big-endian order: the high order byte precedes the lower order byte. This means that a 16-bit word is presented on the network as Most Significant Byte (MSB), followed by Least Significant Byte (LSB).
1.5.3 UTF-8 encoded strings
Text fields in the Control Packets described later are encoded as UTF-8 strings. UTF-8 [RFC3629] is an efficient encoding of Unicode [Unicode] characters that optimizes the encoding of ASCII characters in support of text-based communications.
Each of these strings is prefixed with a two byte length field that gives the number of bytes in a UTF-8 encoded string itself, as illustrated in Figure 1.1 Structure of UTF-8 encoded strings below. Consequently there is a limit on the size of a string that can be passed in one of these UTF-8 encoded string components; you cannot use a string that would encode to more than 65535 bytes.
Unless stated otherwise all UTF-8 encoded strings can have any length in the range 0 to 65535 bytes.
Figure 1.1 Structure of UTF-8 encoded strings
Bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
byte 1 | String length MSB | |||||||
byte 2 | String length LSB | |||||||
byte 3 …. | UTF-8 Encoded Character Data, if length > 0. |
The character data in a UTF-8 encoded string MUST be well-formed UTF-8 as defined by the Unicode specification [Unicode] and restated in RFC 3629 [RFC3629]. In particular this data MUST NOT include encodings of code points between U+D800 and U+DFFF. If a Server or Client receives a Control Packet containing ill-formed UTF-8 it MUST close the Network Connection [MQTT-1.5.3-1].
A UTF-8 encoded string MUST NOT include an encoding of the null character U+0000. If a receiver (Server or Client) receives a Control Packet containing U+0000 it MUST close the Network Connection [MQTT-1.5.3-2].
The data SHOULD NOT include encodings of the Unicode [Unicode] code points listed below. If a receiver (Server or Client) receives a Control Packet containing any of them it MAY close the Network Connection:
U+0001..U+001F control characters
U+007F..U+009F control characters
Code points defined in the Unicode specification [Unicode] to be non-characters (for example U+0FFFF)
A UTF-8 encoded sequence 0xEF 0xBB 0xBF is always to be interpreted to mean U+FEFF ("ZERO WIDTH NO-BREAK SPACE") wherever it appears in a string and MUST NOT be skipped over or stripped off by a packet receiver [MQTT-1.5.3-3].
1.5.3.1 Non normative example
For example, the string A