Subject: [core] Question about blockwise and object security

From: Ludwig Seitz <[email-masked]>
Date: Thu, 04 Jun 2015 14:20:30 +0200

Hello CoRE,

I am just looking at draft-ietf-core-block in conjunction with object 
security (draft-selander-ace-object-security) , and I wonder if any of 
you are aware of usecases, where it would make sense for a proxy to 
"repackage" blockwise coap messages into blocks of a different size (or 
recombine them before forwarding them).

Regards,

Ludwig Seitz

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se

---

From: "Kepeng Li" <[email-masked]>
Date: Thu, 04 Jun 2015 20:32:36 +0800

It depends on what kinds of proxies, forward proxy, transparent proxy or
interception proxy.
https://tools.ietf.org/html/draft-ietf-core-http-mapping-06#page-5

I think we have this "repackage" use case.

Kind Regards
Kepeng

在 4/6/15 8:20 pm， "Ludwig Seitz" <[email-masked]> 写入:

>_______________________________________________
>core mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/core

---

From: Olaf Bergmann <[email-masked]>
Date: Fri, 05 Jun 2015 13:38:26 +0200

Hi Ludwig,

Ludwig Seitz <[email-masked]> writes:

> "repackage" blockwise coap messages into blocks of a different size
> (or recombine them before forwarding them).

I wonder what this use-case would be:

* If you did not recombine blocks, the proxy would have to pad the
  changed blocks to the next matching block size (what happens if you
  hit the 2048-byte-case?). Where constrainedness is an issue this leads
  nowhere, I suppose.

* If you recombined blocks, message integrity can be checked only for
  the entire payload, as the original block boundaries are gone. Apart
  from (potentially?) not being able to extend the protection to CoAP
  message headers in this case, the receiver would have to recombine the
  entire payload before it can do the integrity check.

Grüße
Olaf

---

From: Ludwig Seitz <[email-masked]>
Date: Fri, 05 Jun 2015 15:42:28 +0200

>    entire payload before it can do the integrity check.

Exactly, that's why I'm hoping that there is no such use case, but I 
wanted to ask just to make sure that there wasn't something I missed.

/Ludwig

-- 
Ludwig Seitz, PhD
SICS Swedish ICT AB
Ideon Science Park
Building Beta 2
Scheelevägen 17
SE-223 70 Lund

Phone +46(0)70-349 92 51
http://www.sics.se