Subject: [core] Publish draft-mattsson-core-coap-actuators as a companion document to draft-ietf-core-echo-request-tag

From: John Mattsson <[email-masked]>
Date: Wed, 12 May 2021 09:23:41 +0000

Hi,

In their IESG review of draft-ietf-core-echo-request-tag, both security ADs mentions and references draft-mattsson-core-coap-actuators.

Ben seems to suggst that it would be good to publish draft-ietf-core-echo-request-tag as an informative RFC:

"I note that draft-mattsson-core-coap-actuators is referenced from
several locations (for useful additional discussion, to be clear), but
it is only an individual draft that expired almost two years ago.  Is
there any likelihood that it will ever progress to an RFC?"

I tend to I agree, now when we have mitigations for the security problems described in draft-mattsson-core-coap-actuators, I think it would make sense to document it as a informative RFC to complement draft-ietf-core-echo-request-tag. I think draft-mattsson-core-coap-actuators is in a pretty good shape already. It should probably be expanded with a description of DoS attacks which is something the Echo option in draft-ietf-core-echo-request-tag is a solution for but which is not documented in draft-mattsson-core-coap-actuators. Coap and DDoS attacks have recently gotten quite a lot of media attention.

https://medium.com/nsc42/what-is-coap-and-is-it-the-next-ddos-for-iot-de8ee97e57e6

https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/

Cheers,
John