Subject: [core] I-D Action: draft-ietf-core-echo-request-tag-07.txt

From: [email-masked]
Date: Thu, 19 Sep 2019 03:57:29 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : CoAP: Echo, Request-Tag, and Token Processing
        Authors         : Christian Amsüss
                          John Preuß Mattsson
                          Göran Selander
	Filename        : draft-ietf-core-echo-request-tag-07.txt
	Pages           : 27
	Date            : 2019-09-19

Abstract:
   This document specifies enhancements to the Constrained Application
   Protocol (CoAP) that mitigate security issues in particular use
   cases.  The Echo option enables a CoAP server to verify the freshness
   of a request or to force a client to demonstrate reachability at its
   claimed network address.  The Request-Tag option allows the CoAP
   server to match block-wise message fragments belonging to the same
   request.  The update to the client Token processing requirements of
   RFC 7252 forbids non-secure reuse of Tokens to ensure binding of
   responses to requests when CoAP is used with security.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-echo-request-tag/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-core-echo-request-tag-07
https://datatracker.ietf.org/doc/html/draft-ietf-core-echo-request-tag-07

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-echo-request-tag-07

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: John Mattsson <[email-masked]>
Date: Thu, 19 Sep 2019 11:08:05 +0000

Hi,

-07 was uploaded to address an editorial errata in -06 (I comment was visible by mistake).

The changes since -05 are listed below. We think that -07 addresses the comments from Jim Schaad. In addition, we made a few other clarifications, and added more privacy and security considerations. In particular security consideration for reuse of Tokens as discussed high level on the list before the WGLC.

   o  Changes since draft-ietf-core-echo-request-tag-06:

      *  Removed visible comment that should not be visible in Token
         reuse considerations.

   o  Changes since draft-ietf-core-echo-request-tag-05:

      *  Add privacy considerations on cookie-style use of Echo values

      *  Add security considerations for token reuse

      *  Add note in security considerations on use of nonvolatile
         memory when dealing with pseudorandom numbers

      *  Appendix on echo generation: add a few words on up- and
         downsides of the encrypted timestamp alternative

      *  Clarifications around Outer Echo:

         +  Could be generated by the origin server to prove network
            reachability (but for most applications it MUST be inner)

         +  Could be generated by intermediaries

         +  Is answered by the client to the endpoint from which it
            received it (ie.  Outer if received as Outer)

      *  Clarification that a server can send Echo preemtively

      *  Refer to stateless to explain what "more information than just
         the sequence number" could be

      *  Remove explanations around 0.00 empty messags

      *  Rewordings:

         +  the attack: from "forging" to "guessing"

         +  "freshness tokens" to "freshness indicators" (to avoid
            confusion with the Token)

      *  Editorial fixes:

         +  Abstract and introduction mention what is updated in RFC7252

         +  Reference updates

         +  Capitalization, spelling, terms from other documents

Cheers,
John

-----Original Message-----
From: core <[email-masked]> on behalf of "[email-masked]" <[email-masked]>
Reply to: "[email-masked]" <[email-masked]>
Date: Thursday, 19 September 2019 at 12:58
To: "[email-masked]" <[email-masked]>
Cc: "[email-masked]" <[email-masked]>
Subject: [core] I-D Action: draft-ietf-core-echo-request-tag-07.txt

    
    Abstract:

    

    
    _______________________________________________
    core mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/core