Subject: Re: [core] Stephen Farrell's No Objection on draft-ietf-core-observe-14: (with COMMENT)

From: "Kovatsch Matthias" <[email-masked]>
Date: Thu, 12 Feb 2015 12:21:45 +0000

Dear all

Sorry to open this up again, but I could not find a response to this or if there actually was one:

> > All notifications resulting from a GET request with an Observe Option MUST be returned within the same epoch of the same connection as the request.

> I'm not a security expert, but I vaguely remember some attack that involved
> sending a request in one epoch and sending the response after
> renegotiation in another epoch. That's why I put that sentence in. I might
> misremember this, though, in which case I would agree that re-establishing
> the observation should not be necessary.
> 
> Klaus

Is this confirmed? Because it would greatly simply things if notifications would work after a DTLS session was resumed. (I understand that the epoch must be increased on session resumption.)

The issue came up now in the context of OMA LWM2M.

Ciao
Matthias

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 12 Feb 2015 14:09:46 +0100

Note that Observe doesn't invent anything new here.  RFC 7252 says (9.1.1):

   The following rules are added for matching an Acknowledgement message
   or Reset message to a Confirmable message, or a Reset message to a
   Non-confirmable message: The DTLS session MUST be the same, and the
   epoch MUST be the same.

We may want to think through the whole concept of endpoints and session
resumption in the context of the TLS 1.3 discussion about replacing
resumption by PSK, as well as the discussion we have had about the
reconnection resilience (or lack of) of CoAP over (TLS over) TCP.  I
think we are much better off if we make session continuation (at the
CoAP level) more explicit, rather than just relying on the lower layers
always doing exactly the right thing for us.

So, for Observe, I think we can stay at where we are -- an observation
relationship stays or dies with the pair of endpoints.  We can then
independently work on the concept of an endpoint pair.

Grüße, Carsten

---

From: "Kovatsch Matthias" <[email-masked]>
Date: Thu, 12 Feb 2015 13:15:16 +0000

Okay, thanks. I think the main confusion here is "what is an endpoint?" when DTLS with session _resumption_ and epochs is involved. I filly agree that there must be a clean design here. Taking care of this during the adoption of TLS 1.3 sounds very good.

I will clarify this situation for the OMA LWM2M community.

Ciao
Matthias

> -----Original Message-----
> From: Carsten Bormann [mailto:[email-masked]]
> Sent: Donnerstag, 12. Februar 2015 14:10
> To: Kovatsch Matthias; Klaus Hartke; Olaf Bergmann
> Cc: [email-masked] WG
> Subject: Re: [core] Stephen Farrell's No Objection on draft-ietf-core-
> observe-14: (with COMMENT)
> 
> reconnection resilience (or lack of) of CoAP over (TLS over) TCP.  I think we
> are much better off if we make session continuation (at the CoAP level)
> more explicit, rather than just relying on the lower layers always doing
> exactly the right thing for us.
>