Subject: Re: [core] Question about blockwise and object security

From: Göran Selander <[email-masked]>
Date: Wed, 2 Sep 2015 10:00:36 +0000

Hi Carsten,

Coming back to this thread, sorry for the delay.

On 2015-07-29 12:49, "Carsten Bormann" <[email-masked]> wrote:

>> Maybe this has already been discussed but just for clarification: Do we
>> want to secure blockwise transfer end-to-end or should we leave to the
>> applications of CoAP? Example of use case mentioned is firmware update.
>
>There are two ways to do this:
>Secure each exchange of the blockwise transfer or secure the blockwise
>transfer as a whole.  The first one we almost get for free, unless we
>want to support re-arrangement of blocks in a proxy (then it gets
>hairy). 

This is the springing point, isn’t it?

In order for the receiving endpoint to verify the integrity of the block
received, the sending endpoint must have signed something that can be
reproduced by the receiver. We can’t in general assume keys established
with proxies, so the block partitioning must be made by the sending
endpoint and respected by the proxies.

E.g. if we define block options almost as in the blockwise draft and
assume they are set by the sending endpoint and safe-to-forward, then
using object security mode COAP we get both integrity of the individual
blocks and of the entire sequence of blocks.

(This is one interpretation of “almost . . . for free” but maybe you were
thinking of something else?)

Have you considered anything like that for the blockwise draft?

> The second one is easy for the payload-only variant (PAYL) that
>you are proposing,

Yes.

>slightly less easy for the message protection (COAP):
>the latter would need some rules about which options need to coincide
>between the blocks to make the entire transfer valid.

I don’t know how to do this. See alternative above.

>
>I can imagine use cases for each of these variants.  For a firmware
>transfer that happens on an unprotected network using NoSec mode, you
>actually might want both at the same time (protect the blocks to make
>denial of service harder, protect the whole because you might want to
>use a more expensive operation there).  Of course, the first may be done
>by DTLS (not using NoSec mode), and the second may be done by some
>application-defined mechanism specifically protecting firmware updates.

Yes there are other alternatives. However, I think it is very natural to
object secure individual blocks rather than relying on other solutions if
the size of message exceeds a certain size. Using "end-to-end" block
options and mode COAP would give you both individual block and message
protection.

Regards,
Göran

>Grüße, Carsten