Subject: [core] Token spoofing (was Re: Comments on draft-ietf-core-coap-03)

From: Klaus Hartke <[email-masked]>
Date: Tue, 2 Nov 2010 18:22:15 +0100

Peter Bigot wrote:
>> 3.2.8.
>> It is sufficient if token values are unique in use per server.
>
> Not generally.  This is only true if the implementation retains the server
> network information along with the outstanding request, and uses envelope
> information from the response in combination with the token to uniquely
> identify the corresponding request.

Shouldn't a client always do this to prevent accidental or intentional
spoofing of tokens?

Klaus