Re: [core] Endpoint Client Name / Endpoint Name in RD draft
Hannes Tschofenig <Hannes.Tschofenig@arm.com> Thu, 05 April 2018 10:02 UTC
Return-Path: <Hannes.Tschofenig@arm.com>
X-Original-To: core@ietfa.amsl.com
Delivered-To: core@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A5CC1126C25 for <core@ietfa.amsl.com>; Thu, 5 Apr 2018 03:02:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.899
X-Spam-Level:
X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=armh.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I_YcgjMCPdxd for <core@ietfa.amsl.com>; Thu, 5 Apr 2018 03:02:48 -0700 (PDT)
Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-ve1eur03on0602.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe09::602]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFE20124205 for <core@ietf.org>; Thu, 5 Apr 2018 03:02:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector1-arm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=kN0T7R3L30PB4C0TLHIHz3+lJEVeEZzyHckoXh6cUag=; b=YH4n/MWHXSZ2f9mVq+29nAv3DZ9O1b00CIf0w3vPJW5TKeKzg3hUwpdcRQVwwN9gTtWgWnlzXwOaMvQ2qVMXBSyTbfcM4kenlTphzfNTd6uqpJ1F+5uSYN/51SVcAklDgDSCrIn3yEF6+CGVCvd8zsMG4b6PdBK+/iQ7mTejOQo=
Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com (10.173.75.16) by VI1PR0801MB1757.eurprd08.prod.outlook.com (10.168.67.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.653.12; Thu, 5 Apr 2018 10:02:44 +0000
Received: from VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::64d4:b973:bf81:cfbf]) by VI1PR0801MB2112.eurprd08.prod.outlook.com ([fe80::64d4:b973:bf81:cfbf%18]) with mapi id 15.20.0631.013; Thu, 5 Apr 2018 10:02:44 +0000
From: Hannes Tschofenig <Hannes.Tschofenig@arm.com>
To: Jaime Jiménez <jaime.jimenez@ericsson.com>
CC: Jim Schaad <ietf@augustcellars.com>, "core@ietf.org" <core@ietf.org>
Thread-Topic: [core] Endpoint Client Name / Endpoint Name in RD draft
Thread-Index: AdPMGk8Ajq5nOeuWRv+BrgbskCDzwf//7S4A//+qDBCAALM9gP//8agggADTwQD//7rfYA==
Date: Thu, 05 Apr 2018 10:02:44 +0000
Message-ID: <VI1PR0801MB2112A692CB307D213A89DFC8FABB0@VI1PR0801MB2112.eurprd08.prod.outlook.com>
References: <VI1PR0801MB2112B52094B182F5D44C4F64FAA40@VI1PR0801MB2112.eurprd08.prod.outlook.com> <A484D917-677C-4B29-BBAD-DDDE34B50303@ericsson.com> <VI1PR0801MB21128EA2B70DEEE7C5775A62FAA40@VI1PR0801MB2112.eurprd08.prod.outlook.com> <070801d3cc3f$8d59e0c0$a80da240$@augustcellars.com>, <VI1PR0801MB2112FB25797DCB8F546C148DFAA40@VI1PR0801MB2112.eurprd08.prod.outlook.com> <7BA9B091-F489-4ED4-B6EC-5AD7D971D6F7@ericsson.com>
In-Reply-To: <7BA9B091-F489-4ED4-B6EC-5AD7D971D6F7@ericsson.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: spf=none (sender IP is ) smtp.mailfrom=Hannes.Tschofenig@arm.com;
x-originating-ip: [217.140.96.140]
x-ms-publictraffictype: Email
x-microsoft-exchange-diagnostics: 1; VI1PR0801MB1757; 7:Hz3VG6yiAlgN2QK4YSmSHFaddNDzpYSMS9piSZZC4pMHUbOVzLqaoy2qxsW1wnGnd63FQP0LBrlt6T3peUnC2keOqdQa/d6IBS3oCcnTIU5s4W4iZu70xdgCwUvySpKuaTUu/c8Mulq7k3QvL0euSs8uOYIEY19T4yjxNktOa5CA6R14P1OGs24FyM3YItAYg0lda5KQaIgfyt2Lfapc/DwHCxyi9q9xPyCXPqci99obOpN5TA5m/XLO3LkI8kpe
x-ms-exchange-antispam-srfa-diagnostics: SOS;
x-ms-office365-filtering-correlation-id: 9beb88b8-2443-4c7e-bdf4-08d59adc60b4
x-ms-office365-filtering-ht: Tenant
x-microsoft-antispam: UriScan:; BCL:0; PCL:0; RULEID:(7020095)(4652020)(5600026)(4604075)(3008032)(48565401081)(4534165)(4627221)(201703031133081)(201702281549075)(2017052603328)(7153060)(7193020); SRVR:VI1PR0801MB1757;
x-ms-traffictypediagnostic: VI1PR0801MB1757:
x-microsoft-antispam-prvs: <VI1PR0801MB1757117E9E80054EC519FB42FABB0@VI1PR0801MB1757.eurprd08.prod.outlook.com>
x-exchange-antispam-report-test: UriScan:(37575265505322)(158342451672863)(180628864354917)(192374486261705);
x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(8211001083)(6040522)(2401047)(5005006)(8121501046)(10201501046)(3002001)(93006095)(93001095)(3231221)(944501327)(52105095)(6055026)(6041310)(20161123558120)(20161123564045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123560045)(20161123562045)(6072148)(201708071742011); SRVR:VI1PR0801MB1757; BCL:0; PCL:0; RULEID:; SRVR:VI1PR0801MB1757;
x-forefront-prvs: 06339BAE63
x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(39380400002)(376002)(396003)(39860400002)(53754006)(189003)(199004)(40434004)(51914003)(3280700002)(6306002)(3846002)(54896002)(6116002)(236005)(790700001)(72206003)(68736007)(53936002)(33656002)(316002)(25786009)(55016002)(6436002)(14454004)(5250100002)(81166006)(97736004)(81156014)(74316002)(8676002)(446003)(11346002)(9326002)(5890100001)(6916009)(486006)(7736002)(53376002)(9686003)(6246003)(66066001)(7696005)(76176011)(53546011)(186003)(93886005)(59450400001)(86362001)(6506007)(8936002)(4326008)(99286004)(106356001)(229853002)(2906002)(966005)(606006)(3660700001)(102836004)(2900100001)(105586002)(54906003)(26005)(5660300001)(476003)(478600001); DIR:OUT; SFP:1101; SCL:1; SRVR:VI1PR0801MB1757; H:VI1PR0801MB2112.eurprd08.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1;
received-spf: None (protection.outlook.com: arm.com does not designate permitted sender hosts)
x-microsoft-antispam-message-info: yzBnZj8sFTN00O54ze9mvl2R0BjT5m5eI4ZAvm9nY82IgjSoR6N8DSLI99jnXm2HsTFIXhk9pWPMbVBFyDU3qipdANF2ICC7dTEd+MHYio4/yFrVCekPZDW3QfX5jNZw9NDNDnvFFG/6cb74NLPfZrTrlmloviBDWTj8C2lPOSKVmwusZ19DdrV+kdnmZjomRQB2kghNF3UgiRzpT0LJLEghMMW/a6uBjCmWJ1IC7rlZRJYZwr8kcMzkaAjA1JgkYYQq+eezMKp0GfD1myiyTinGrreP9SHhtRAHyFR/28ZH5/iQW/QJ6IWcw9K3hZze/VSljWnkhy/tW6SvUySADW/iEAntCwGNX0FEzz0XyFR27TTt6jRRsspbEKoySgUJteskdosCH6UD+cKilUMIKkBFTWHYrof9RMmiL4VDWO4=
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: multipart/alternative; boundary="_000_VI1PR0801MB2112A692CB307D213A89DFC8FABB0VI1PR0801MB2112_"
MIME-Version: 1.0
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9beb88b8-2443-4c7e-bdf4-08d59adc60b4
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Apr 2018 10:02:44.7327 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR0801MB1757
Archived-At: <https://mailarchive.ietf.org/arch/msg/core/TxN_jZN3bqz9D3NCkuFop_noGa0>
Subject: Re: [core] Endpoint Client Name / Endpoint Name in RD draft
X-BeenThere: core@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "Constrained RESTful Environments \(CoRE\) Working Group list" <core.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/core>, <mailto:core-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/core/>
List-Post: <mailto:core@ietf.org>
List-Help: <mailto:core-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/core>, <mailto:core-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 05 Apr 2018 10:02:52 -0000
Hi Jaime, Thanks for the pointer to earlier discussions on this topic. Looking at the discussions from 2014 it appears that there is some misunderstanding of how this endpoint name interacts with the security protocol and what vulnerabilities are created by relying on an identifier that is unauthenticated. I am curious what we lose if we remove this identifier altogether. The only thing that comes to my mind is a debugging capability where you might want to test your system without any security protocol. In any practical deployment I would not recommend to use RD without security. Ciao Hannes From: Jaime Jiménez [mailto:jaime.jimenez@ericsson.com] Sent: 05 April 2018 07:52 To: Hannes Tschofenig Cc: Jim Schaad; core@ietf.org Subject: Re: [core] Endpoint Client Name / Endpoint Name in RD draft Hi, You mean we should remove the "endpoint name" altogether, so not using URNs to identify CoAP endpoints for example? The rationale for using endpoint name was at least discussed in 2014, back then it seemed useful in the context of LWM2M. http://ietf.org/mail-archive/web/core/current/msg05645.html Ciao! El 4 abr 2018, a las 22:01, Hannes Tschofenig <Hannes.Tschofenig@arm.com<mailto:Hannes.Tschofenig@arm.com>> escribió: Hi Jim, I had various comments: First, I argue that the LwM2M spec and the RD draft should be in sync regarding the name of the parameter. Second, I believe that the security consideration section is correct in the threat description but came to the wrong conclusion regarding the use of the parameter. In essence, the parameter should be optional and probably only used for debugging. Third, I went as far as saying that the endpoint name parameter should actually be removed altogether. I can already see how those deploying it will get it wrong and will introduce security problems. Ciao Hannes From: Jim Schaad [mailto:ietf@augustcellars.com] Sent: 04 April 2018 21:06 To: Hannes Tschofenig; 'Jaime Jiménez' Cc: core@ietf.org<mailto:core@ietf.org> Subject: RE: [core] Endpoint Client Name / Endpoint Name in RD draft Hannes, I am not completely clear. Are you saying that the RD should not have the endpoint name parameter as a defined property or something else? Jim From: core <core-bounces@ietf.org<mailto:core-bounces@ietf.org>> On Behalf Of Hannes Tschofenig Sent: Wednesday, April 4, 2018 10:41 AM To: Jaime Jiménez <jaime.jimenez@ericsson.com<mailto:jaime.jimenez@ericsson.com>> Cc: core@ietf.org<mailto:core@ietf.org> WG <core@ietf.org<mailto:core@ietf.org>> Subject: Re: [core] Endpoint Client Name / Endpoint Name in RD draft Hi Jaime, using IP address and port for an endpoint (client) name would not be a good idea. In general, it was not a good idea to have this parameter defined in the first place. It might actually be better to remove it altogether. Ciao Hannes From: Jaime Jiménez [mailto:jaime.jimenez@ericsson.com] Sent: 04 April 2018 17:32 To: Hannes Tschofenig Cc: core@ietf.org<mailto:core@ietf.org> WG; Carsten Bormann Subject: Re: [core] Endpoint Client Name / Endpoint Name in RD draft Hi, Note that endpoint can refer to both source and destination, being and IP:port in its simplest form: https://tools.ietf.org/html/rfc7252#page-6 The fact that LWM2M swaps those role names might actually add to the confusion, probably OMA LWM2M should be the one changing the terminology as the device is mostly a "server" hosting resources and only is a "client" during bootstrapping and registration. We could have used terms like "servient" instead but it might be too late for that. Ciao! - - Jaime Jiménez On 4 Apr 2018, at 16.41, Hannes Tschofenig <Hannes.Tschofenig@arm.com<mailto:Hannes.Tschofenig@arm.com>> wrote: Hi all, I noticed that the term "endpoint name" is used in the IETF RD draft while the OMA LwM2M spec uses the term "endpoint client name". Endpoint is a confusing term since it is used differently in the CoAP spec than in the Web environment. For this reason I believe it would be better to use the term "endpoint client name" also in the RD draft. This would improve alignment between the two specs. Ciao Hannes IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. _______________________________________________ core mailing list core@ietf.org<mailto:core@ietf.org> https://www.ietf.org/mailman/listinfo/core IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you. IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
- [core] Endpoint Client Name / Endpoint Name in RD… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Jaime Jiménez
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Jim Schaad
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Jaime Jiménez
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Jim Schaad
- Re: [core] Endpoint Client Name / Endpoint Name i… peter van der Stok
- Re: [core] Endpoint Client Name / Endpoint Name i… Carsten Bormann
- Re: [core] Endpoint Client Name / Endpoint Name i… Christian Amsüss
- Re: [core] Endpoint Client Name / Endpoint Name i… Jim Schaad
- Re: [core] Endpoint Client Name / Endpoint Name i… Kovatsch, Matthias
- Re: [core] Endpoint Client Name / Endpoint Name i… Jim Schaad
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Kovatsch, Matthias
- Re: [core] Endpoint Client Name / Endpoint Name i… peter van der Stok
- Re: [core] Endpoint Client Name / Endpoint Name i… peter van der Stok
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… peter van der Stok
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… Kovatsch, Matthias
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig
- Re: [core] Endpoint Client Name / Endpoint Name i… peter van der Stok
- Re: [core] Endpoint Client Name / Endpoint Name i… Hannes Tschofenig