Subject: [core] Security considerations

From: Zach Shelby <[email-masked]>
Date: Thu, 9 Sep 2010 15:14:22 +0300

Sorry for the barrage of Trac messages, but I am working on closing the open tickets for coap-02. Most of the tickets were straight-forward thanks to good list discussion. 

The Security considerations sections is going to need to new work though, and we need help from the WG here. I created an initial table of contents for the section. Rene Struik informally volunteered to help out on the DTLS section, any other help/ideas welcome as well. On the security limitations I encourage everyone to think about that, and throw any ideas for what to include there to the list. It is a good idea to start with reading section 15 of RFC2616 as some of that is pertinent to CoAP as well. What new limitations are special for CoAP? I tried to list a few possible ones below.

10.  Security Considerations

10.1.  Securing CoAP with DTLS

   This section describes how to secure CoAP with DTLS, along with a
   couple minimal DTLS configurations appropriate for constrained
   environments.

10.2.  Threat analysis and protocol limitations

   This section is meant to inform protocol and application developers
   about the security limitations of CoAP as described in this document.
   As CoAP realizes a subset of the features in HTTP/1.1, the security
   considerations in Section 15 of [RFC2616] are also pertinent to CoAP.
   This section concentrates on describing limitations specific to CoAP
   and CoRE.

10.2.1.  Processing URIs

10.2.2.  Proxying and Caching

10.2.3.  Attacks on TIDs

10.2.4.  Risk of amplification using multicast

10.2.5.  Asynchronous responses

-- 
Zach Shelby, Chief Nerd, Sensinode Ltd.
http://zachshelby.org  - My blog "On the Internet of Things"
http://6lowpan.net - My book "6LoWPAN: The Wireless Embedded Internet"
Mobile: +358 40 7796297