Re: [core] Block aspects addressed in draft-ietf-core-attacks-on-coap-03.txt

[Jon Shallow <[e-mail]>]

Hi Christian,

Thanks for coming back on this.

See
https://github.com/core-wg/attacks-on-coap/issues/3#issuecomment-1590834571
for some comments on this.  I think it is an attack vector for concurrent
requests that are not using both ETag and Request-Tag.

Regards

Jon

> -----Original Message-----
> From: Christian Amsüss [mailto: [e-mail]]
> Sent: 13 June 2023 23:23
> To: [e-mail]
> Cc: [e-mail]
> Subject: Block aspects addressed in draft-ietf-core-attacks-on-coap-03.txt
> 
> Hello Jon,
> 
> you've had comments on earlier versions of attacks-on-coap that did not
result
> in a text change, and I'd like to check with you whether you agree with
the
> resolution:
> 
> In [1], you outlined an attack where exchanges of the shape
> single-block1-many-block2 that have different request payloads would get
> mixed up. In my understanding, this is not a working attack, as the
requests
> pulling the later block2 responses would contain the original request --
and for
> identical requests, this is no different from the case of payload-less
requests of
> different times getting mixed up (which is what ETag is for).
> 
> If you still think there is some of [77] that needs to be considered,
please
> follow up here -- otherwise, I'd mentally mark this one as addressed.
> 
> Best regards, and thanks for bringing up the item c
> 
> [1]:
> https://mailarchive.ietf.org/arch/msg/core/tuI9NNtx5t3NDsK0zfhdvNGCmEg/
> [77]: https://github.com/core-wg/echo-request-tag/issues/77
> 
> --
> I shouldn't have written all those tank programs.
>   -- Kevin Flynn