Re: [Anima-bootstrap] bootstrap over CoAP

Carsten Bormann <cabo@tzi.org> Sat, 09 July 2016 13:46 UTC

Return-Path: <cabo@tzi.org>
X-Original-To: anima-bootstrap@ietfa.amsl.com
Delivered-To: anima-bootstrap@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D8A912D107 for <anima-bootstrap@ietfa.amsl.com>; Sat, 9 Jul 2016 06:46:25 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CCmoCZjaYkot for <anima-bootstrap@ietfa.amsl.com>; Sat, 9 Jul 2016 06:46:23 -0700 (PDT)
Received: from relay6-d.mail.gandi.net (relay6-d.mail.gandi.net [IPv6:2001:4b98:c:538::198]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EFA5112B03C for <anima-bootstrap@ietf.org>; Sat, 9 Jul 2016 06:46:22 -0700 (PDT)
Received: from mfilter47-d.gandi.net (mfilter47-d.gandi.net [217.70.178.178]) by relay6-d.mail.gandi.net (Postfix) with ESMTP id 15436FB886; Sat, 9 Jul 2016 15:46:21 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at mfilter47-d.gandi.net
Received: from relay6-d.mail.gandi.net ([IPv6:::ffff:217.70.183.198]) by mfilter47-d.gandi.net (mfilter47-d.gandi.net [::ffff:10.0.15.180]) (amavisd-new, port 10024) with ESMTP id qb7UJ_80wUhU; Sat, 9 Jul 2016 15:46:19 +0200 (CEST)
X-Originating-IP: 93.199.242.26
Received: from nar-3.local (p5DC7F21A.dip0.t-ipconnect.de [93.199.242.26]) (Authenticated sender: cabo@cabo.im) by relay6-d.mail.gandi.net (Postfix) with ESMTPSA id 2D5CDFB89F; Sat, 9 Jul 2016 15:46:19 +0200 (CEST)
Message-ID: <57810029.2070408@tzi.org>
Date: Sat, 09 Jul 2016 15:46:17 +0200
From: Carsten Bormann <cabo@tzi.org>
User-Agent: Postbox 4.0.8 (Macintosh/20151105)
MIME-Version: 1.0
To: Brian E Carpenter <brian.e.carpenter@gmail.com>
References: <3A2F4C70-4960-4592-9314-6EC53B53CC94@cisco.com> <5d5623cd-fe4b-e443-da5d-6a43ffb9b5c6@gmail.com>
In-Reply-To: <5d5623cd-fe4b-e443-da5d-6a43ffb9b5c6@gmail.com>
X-Enigmail-Version: 1.2.3
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/anima-bootstrap/DDDJeBSQIERVLPRA6GfqPKfqVwk>
Cc: "Max Pritikin \(pritikin\)" <pritikin@cisco.com>, "anima-bootstrap@ietf.org" <anima-bootstrap@ietf.org>
Subject: Re: [Anima-bootstrap] bootstrap over CoAP
X-BeenThere: anima-bootstrap@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Mailing list for the bootstrap design team of the ANIMA WG <anima-bootstrap.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/anima-bootstrap/>
List-Post: <mailto:anima-bootstrap@ietf.org>
List-Help: <mailto:anima-bootstrap-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/anima-bootstrap>, <mailto:anima-bootstrap-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Jul 2016 13:46:25 -0000

> 1. Is CoAP/DTLS protected against corrupt packets? (Assuming we are
> talking about UDP/IPv6 there will at least be the UDP checksum.)

DTLS ciphersuites usually authenticate the packets (and protect against
replay), so there will be very strong protection.

> 2. In the fragmentation scenario, what happens when a fragment is
> corrupted or lost?

I'm not sure I understood that part of the draft*), but generally CoAP
is designed so you can avoid fragmentation (and use the segmentation
provided by draft-ietf-core-block instead); the latter has per-segment
reliability (acknowledgements and retransmits).   DTLS may require
fragmentation during its handshake; this is mitigated if you can use a
PSK (symmetric) or, if you need asymmetric, ECC-based ciphersuite, which
allows the packets to stay well below 1280 bytes.

Grüße, Carsten

*) We just had an interesting exchange in the CoRE WG where some people
weren't aware of the terminology that differentiates fragmentation and
segmentation; I apologize for sticking to that.