Re: [core] ALPN "coap" for DTLS

[Christian Amsüss <[e-mail]>]

Hello CoRE,

tl;dr: I will request an ALPN for CoAP-over-DTLS 5 days from now if
nobody objects.

On Sun, Mar 26, 2023 at 12:24:29PM +0200, Christian Amsüss wrote:
> processing reviews for DNS-over-CoAP[1] showed that while we do have an
> ALPN and usage guidance for CoAP-over-TLS (ALPN "coap"), there is no
> referencable text on whether and how CoAP-over-DTLS can be disambiguated
> in an ALPN. While the general specification situation is a bit dire on
> mixing DTLS with ALPNs[^2], it appears to be readily used[3].

The way ALPNs are used in DNR ([RFC9463]) indicates to me that we'd need
a different ALPN for CoAP-over-DTLS (because otherwise a DNR SVCB
doesn't indicate whether to use TCP or UDP), which is also aligned with
what Ben Schwartz said on the topic[5].

Therefore the next action in this is to request an APLN ID for
CoAP-over-DTLS. The registry is [6], policy is Expert Review, method of
registration is "check with experts on [e-mail]" (who are
"advised to encourage the inclusion of a reference to a permanent and
readily available specification"). Sounds like we can just ask for that
(RFC7252 can serve as the specification, entering existing RFCs into
expert-review registries is not too uncommon).

So, a brief last check before I send the following to the experts over
there at the end of the month -- any better ideas?

> Dear TLS experts,
> 
> please have the following entry added into the TLS ALPN registry:
> 
> * Protocol: CoAP-over-DTLS
> * Identification sequence: 0x63 0x6f ("co")
> * Reference: RFC7252
>
> RFC7252 did not register this because it predates ALPNs, but there are
> now use cases related to dns-over-coap [7] and SVCB.
>
> Given that the underlying protocol is used in constrained environments
> that are sensitive to message sizes, the short identifier should be
> warranted.
> 
> Note that there is already an entry for "coap", but that refers to
> CoAP-over-TLS.  If possible, please consider updating the "CoAP" (0x63
> 0x6f 0x61 0x70) entry to say "CoAP-over-TLS" to avoid confusion. This
> is following the recommendation at [5] to not attempt reusing the same
> ALPN for both the DTLS and the TLS version of a protocol.

Best regards
Christian

[RFC9463]: https://www.rfc-editor.org/rfc/rfc9463
[5]: https://mailarchive.ietf.org/arch/msg/core/8wdEwrzU2s8xYEvYpzh_tGQxYUY/
[6]: https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
[7]: https://datatracker.ietf.org/doc/draft-ietf-core-dns-over-coap/

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom