Subject: [core] I-D Action: draft-ietf-core-echo-request-tag-09.txt

From: [email-masked]
Date: Mon, 09 Mar 2020 09:57:30 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : CoAP: Echo, Request-Tag, and Token Processing
        Authors         : Christian Amsüss
                          John Preuß Mattsson
                          Göran Selander
	Filename        : draft-ietf-core-echo-request-tag-09.txt
	Pages           : 31
	Date            : 2020-03-09

Abstract:
   This document specifies enhancements to the Constrained Application
   Protocol (CoAP) that mitigate security issues in particular use
   cases.  The Echo option enables a CoAP server to verify the freshness
   of a request or to force a client to demonstrate reachability at its
   claimed network address; it is now the recommeded way to mitigate
   amplification attacks.  The Request-Tag option allows the CoAP server
   to match block-wise message fragments belonging to the same request.
   The update to the client Token processing requirements of RFC 7252
   forbids non-secure reuse of Tokens to ensure binding of responses to
   requests when CoAP is used with security.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-echo-request-tag/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-core-echo-request-tag-09
https://datatracker.ietf.org/doc/html/draft-ietf-core-echo-request-tag-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-echo-request-tag-09

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Christian Amsüss <[email-masked]>
Date: Mon, 9 Mar 2020 18:04:30 +0100

Hello CoRE,

> https://datatracker.ietf.org/doc/draft-ietf-core-echo-request-tag/

The recent changes in particular:

*  Make amplification attack mitigation by Echo an RFC7252
   updating recommendation

   (see https://mailarchive.ietf.org/arch/msg/core/wy5bOuXaupfSY9u_hY99U9BDLZ0)

*  Give some more concrete guidance to that use case in terms of
   sizes and message types

   (ibd, using numbers from CoAP-over-UDP-over-IPv6)

*  Allow short (1-3 byte) Echo values for deterministic cases,
   with according security considerations

   (from implementation experience)

*  Point out the tricky parts around Request-Tag for stateless
   proxies, and make that purely an outlook example with out-of-
   scope details

   (see https://mailarchive.ietf.org/arch/msg/core/5Pc92j3uriocjRVjyeo90fySEwc
   and https://mailarchive.ietf.org/arch/msg/core/IoIhwW6qUKmq85S2xMOjYUY5i0g)

*  Lift ban on Request-Tag options without Block1 (as they can
   legitimately be generated by an unaware proxy)

   (from processing an open point in Francesca's review)

*  Suggest concrete numbers for the options

   (from implementations needing them)

I believe this addresses the issues that were raised during the WGLC as
well as two points stemming from an implementation of the Echo
application for OSCORE sequence number recovery.

Kind regards
Christian

-- 
There's always a bigger fish.
  -- Qui-Gon Jinn