Subject: [core] I-D Action: draft-ietf-core-echo-request-tag-04.txt

From: [email-masked]
Date: Sat, 23 Mar 2019 17:27:53 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : CoAP: Echo, Request-Tag, and Token Processing
        Authors         : Christian Amsüss
                          John Mattsson
                          Göran Selander
	Filename        : draft-ietf-core-echo-request-tag-04.txt
	Pages           : 24
	Date            : 2019-03-23

Abstract:
   This document specifies enhancements to the Constrained Application
   Protocol (CoAP) that mitigate security issues in particular use
   cases.  The Echo option enables a CoAP server to verify the freshness
   of a request or to force a client to demonstrate reachability at its
   claimed network address.  The Request-Tag option allows the CoAP
   server to match Block-Wise message fragments belonging to the same
   request.  The updated Token processing requirements for clients
   ensure secure binding of responses to requests when CoAP is used with
   security.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-echo-request-tag/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-core-echo-request-tag-04
https://datatracker.ietf.org/doc/html/draft-ietf-core-echo-request-tag-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-echo-request-tag-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Carsten Bormann <[email-masked]>
Date: Tue, 26 Mar 2019 13:08:26 +0100

> 	Filename        : draft-ietf-core-echo-request-tag-04.txt

Thank you!

I only have two editorial to semi-editorial comments (chairs-hat-off) about Section 5, which can be handled during the WGLC:

— I don’t know how to formally prove that a counter is “easiest”.  So I would probably avoid the absolute.  Calling out more explicitly what scope that counter has (I.e., the messages covered by the matching rule) might help, too.

— I don’t understand the comment about length-value coding.  There already is a length that governs the token.  The encoding informally described as “o256” in Appendix A.4 of draft-bormann-coap-misc-27.txt works well for me.  Maybe you mean that.  (Feel free to copy-paste that appendix.)

Grüße, Carsten

      # byte strings lexicographically goedelized as numbers (one+256 coding)
      def o256_encode(num)
        str = empty_buffer
        while num > 0
          num -= 1
          str << (num & 0xFF)
          num >>= 8
        end
        str.reverse
      end

      def o256_decode(str)
        num = 0
        str.each_byte do |b|
          num <<= 8
          num += b + 1
        end
        num
      end