Re: [core] Review of draft-ietf-core-groupcomm-bis-03

John Mattsson <john.mattsson@ericsson.com> Wed, 19 May 2021 03:19 UTC

Return-Path: <john.mattsson@ericsson.com>
X-Original-To: core@ietfa.amsl.com
Delivered-To: core@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00C993A1B29 for <core@ietfa.amsl.com>; Tue, 18 May 2021 20:19:49 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.799
X-Spam-Level:
X-Spam-Status: No, score=-2.799 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.698, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O4Ot02owxN1B for <core@ietfa.amsl.com>; Tue, 18 May 2021 20:19:44 -0700 (PDT)
Received: from EUR05-AM6-obe.outbound.protection.outlook.com (mail-am6eur05on2076.outbound.protection.outlook.com [40.107.22.76]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BADC3A1B78 for <core@ietf.org>; Tue, 18 May 2021 20:19:44 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DDwvN/PI79qXSw2TUfWf0ts9Zusdzrfuv1jqopdE2so69dV9115NDsnp1j0wqfQqLbsdN1OYa0a5cfRL9t4T9nsT2QYmetBPxVXnif4+7UEDht4XJUgMMl8hTCpHXd1ML+aQdhIN5e6wtVjjKIXpt+dciFeuL5NBkRV/yVYIga17O3FlKfKL5pH9PTjTLKMQH19ApApf0IVQD1wq0EQ0HBsIFQxe/Sizn6BXv0UFJqe2YuuWiOkFIVFcE90SG7sA7/LBkeKBXWZTLZz4A84TcBGhz6oxkOoSATj63bkez3FA8SSLGZD5C4RmTZ9f6edC1OecmKOqIRPnfVnRxDGJdg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vzGgF5Dx/L010E+t2CWI7PsHp27evvXmFpqAXWL0zP8=; b=n5StQuO7ODLwKskotZrmeFmImN2tSr2QQwdpYJvZkBPoNanpy2XExhxolZJ88e+swayQnVOY6bR76yLJvZ2UD6j0R5iXfi/V1naXKDdNl3a+oE6DwqIYCgM6/rrNAjj6f4nq1nzMKv/H83pLwK27RXG/6ibpOYq4vBZPZH3sNu+/Yf//3laGEPpWqObzAZk2JzL8Hs5ta67ZxIwJseeHWPKEwib+5C3TTn22QEOQcy131/QaKzg4Zk7fsLbqkUYdU2kzcZZoVQWNT6QkBSBXdrSSphHlt9txIBTBnKn0oL/7Xdi7FwYu8hTW92ACe9BosdPDQDGoE/UH+0Y7134wGg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=ericsson.com; dmarc=pass action=none header.from=ericsson.com; dkim=pass header.d=ericsson.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vzGgF5Dx/L010E+t2CWI7PsHp27evvXmFpqAXWL0zP8=; b=SviBwS1vs7XuKsal0sBIcKOYSr6xdhUPz2LNe0L+8Ns6autilwJhBRLQMZt/O+qEsjNZpHxLm2iGio0V4I/4e697tIyctaawWIoKeJs8L3/S+hFSX37tkczUBIT4uzhEm2Q6QPXwf1FDYYgRoal+XD/xeTu3NncdtKumnzjPByM=
Received: from DB6PR0701MB3047.eurprd07.prod.outlook.com (2603:10a6:4:74::7) by DB6PR07MB4245.eurprd07.prod.outlook.com (2603:10a6:6:4f::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4150.13; Wed, 19 May 2021 03:19:41 +0000
Received: from DB6PR0701MB3047.eurprd07.prod.outlook.com ([fe80::f0fb:72b:8eac:53e8]) by DB6PR0701MB3047.eurprd07.prod.outlook.com ([fe80::f0fb:72b:8eac:53e8%4]) with mapi id 15.20.4150.019; Wed, 19 May 2021 03:19:41 +0000
From: John Mattsson <john.mattsson@ericsson.com>
To: "core@ietf.org" <core@ietf.org>
Thread-Topic: Review of draft-ietf-core-groupcomm-bis-03
Thread-Index: AQHXCwSqc4rdNewjlUGtn83ROTnvRarqxxqA
Date: Wed, 19 May 2021 03:19:41 +0000
Message-ID: <F4BA78B6-A40B-4CF0-83FA-B01F7702A674@ericsson.com>
References: <E0959F68-0966-4628-94D3-F9B64F47A84C@ericsson.com>
In-Reply-To: <E0959F68-0966-4628-94D3-F9B64F47A84C@ericsson.com>
Accept-Language: en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.49.21050901
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=ericsson.com;
x-originating-ip: [81.225.97.222]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 6c1645f3-f477-4dac-0517-08d91a74f171
x-ms-traffictypediagnostic: DB6PR07MB4245:
x-microsoft-antispam-prvs: <DB6PR07MB424545A85F4D61E3B4405653892B9@DB6PR07MB4245.eurprd07.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:9508;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 2nNUyJvHXiUMlZuy5USfAofaua5AXUHTL1rt0d5d8A+snmUmsZXmLH8UMQDN7xhq2rBOttuhVdh8gX+nTGMYCjq/EsEq4tHLQURqr4v2u6eoGkb06Wu2JyskFSnPYN1rgvksF6Zai+FCMT7/3c7Thrle4rFlsSOe50G2RbC5tzcAcWQgXFI4+OXpOp2zZTC/wVoOhPQaJnlECtmGcyQVO9BIPDdOiuTOjAGhLyFh8gK2yoSIvM3YUCI0b+uJ/r7Bjjn0EyLifank+Rzj1wI+w++chaTi470hSs/apXng5JWJNXsLTpcRghYN++FcV4n5hwXYtnrb1cHA4zpkUsnr2QOBB2Vq0o+e7fPLZ4V5lHHfOM23dCh96wnB0TLWYTH7XhlsxT17TuaoAuqQHTehn+BVnP4/Hbo+Y97ePjDrZPOmuktI7cYdo5mZUJMOpTEDPDtEYy+X8FuVZTM5VmtmTNQ6nrF5QTokCa3oft6rXLwvikcE/zTF0h3ZkRAmUHjpbj/3d7P8+OwopdjnnsKVRXJD/sNv+oRzcsPmUhrfepj3hB90TkzuFjSFhWHtmMCnxSEpEaJqU/579nFC0j2MAWyUTs1Cp1KtwIFjxkQbqgahEQZC3O5MN90cC/F0wzMeTcSJtbzbUUJJcpeyANXjgk/OjEyQs3okLAfGV6CZw8OF2AGOvk9oTnFxtrVH+ADSjEbHgu5C/voWGkGh6ZOR21vV4LC8ay9T5hvEYlDePcR38QlaB4afOXmQY5b1TCLU3rKCRm2EC9tRHwMiXvc5CZk8vLSXPwyAgEwe0CVpfXrnMBWAwcWqyPw30Kfw8bG0
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB6PR0701MB3047.eurprd07.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(366004)(376002)(346002)(136003)(39860400002)(8936002)(53546011)(6506007)(66556008)(66476007)(66446008)(64756008)(66946007)(6916009)(44832011)(2616005)(36756003)(38100700002)(966005)(71200400001)(122000001)(76116006)(91956017)(6512007)(33656002)(478600001)(83380400001)(66574015)(26005)(6486002)(86362001)(8676002)(316002)(186003)(2906002)(5660300002)(45980500001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: =?utf-8?B?aVdhVzNsaEI5eTRTazFhOGhHOTk0RmdmOWRmQ1hLMm1mZXF4d2VZSWxLZXBm?= =?utf-8?B?ekRpNVdGSjQ5TTRxRjkwYzRGRXFTZUlEL01sQjJNaHJHZUtsdEE4dVFFbkE0?= =?utf-8?B?VDEzQktoeUd1WjRQdmtNTTlWMUdDdDJuVkVCc1FQZWsrQnVrMEhaM1N2aEo5?= =?utf-8?B?U1JOWnNaRWYrQ2xwNHFReXArZ3h0R0k5bTFTOXlFaG8xVCtmM3ZxeDBOd2hF?= =?utf-8?B?RVEyT0NGV2Zjb00zZTNZNEtPcE04MS9tRU51b0NFN1Q4WUNWa3NwbFV0ZVFh?= =?utf-8?B?SzFmcEI2SXZhL001bFFrS0g4NlMyZzVWSEJpanlTZi9EY1Fya2xEZllNdGhU?= =?utf-8?B?elV5NC9idzBuVUYrc1hMUDQxNDdObmJXMjdSYy85c1lLL25PWlFnVkYyRTNL?= =?utf-8?B?V3A0ekpBYWFjY2RIMU9ObnUwSnJlSDQ2aUFjWUlNcks5aEs1M1pZUzJSSDZm?= =?utf-8?B?ZnkwdXZ1eWVJNFNoSzBXQ3h0SHBCaCtRUnhtbnQrSmR3K3F3M2NkdmZtLzVE?= =?utf-8?B?MC9vWTA5M1hVbXFZVEVkaFE4OUM2WGd4aWNzRU5BM1liVExzeHRWdzJHWkpr?= =?utf-8?B?OFlaQ0RyYmJCSHFaMG8ybnMxc3BLYmw2MmlFS2Uxb1RodmZiaTdaOVV0MERq?= =?utf-8?B?VHpGWjluTC9WZnlFTlMyeUIzUE9mL1htenpWWUJ0cGpBVnR6eVZOZlZ1VmFE?= =?utf-8?B?MThTcndqL05Nd2kxVUxaMm1aSkJuV2tEeWdiMGl3OVhxamR2cFZ5QVFQUlFh?= =?utf-8?B?Nnl6V3dXc3lyRXU3SXhoRDR0M0NESmRDZVdyN0NuYW54MitET2dTaXhPbzhY?= =?utf-8?B?cmVPSlNEc3pVZE95cVFrNWYzWE0weFY0ZjlZWis2WmVEUDJxa1Joamk4NWlZ?= =?utf-8?B?RFB2QWFta2hLQW50cXYvbm9IeHdvbTRtN2UrZDQvMUtNbFNYRUU0R2IraW5v?= =?utf-8?B?UW1GOHoxSzF0NFc0Q1M1YnFJRVhCQTUydStYYTR4TzlwV0ZQUWtjb091YVBK?= =?utf-8?B?dVIzT2xJN1BGSTVrOWdFeUZ1c1ZxNG9ybVY0TUxyL29vRzhyTytCZHhURE13?= =?utf-8?B?QzZ6U0FIOHVEOThHd2dYNVBQcElyZkh3RVNuQk8ybHlSYm90V3NzQjBNbm5S?= =?utf-8?B?U0paQ2ZnQkUwS3oyV1BnTDEwQy9Ca2Y0Z0ZBTnAyT0N1WHFkVWhmWEhwNmRm?= =?utf-8?B?ZGRjblZDcmFWWGNRSUlqN3FCVndabVlEM0Q1aENBc0wvbXpSUlVjODJwVjhS?= =?utf-8?B?ZTIzQzFBcUpQR2hvSzB4ZklvVy9sM0RXbmRDQStsaENlUVV4aEFvdDJibHdS?= =?utf-8?B?WWxsQ3lpa01CdHBNeENEeUR0Y3kxckd3Yk9rcVplWkZJV3lJZDZuSDd5SWZu?= =?utf-8?B?eTQxaS9PT09mZ3lTOWJTNTB0bjk2TDd1N1FyWjl1YTFiejBwb2ZVS2NVSEox?= =?utf-8?B?ZUtUbjJFWnhITVBucDUrcDlLMlhoWUkxa1dBUnFLcWduc2pFZUhHaHBvU0l5?= =?utf-8?B?L21sRk1wNy9kUzNCTEdCR3pqMTFFNnczSnppcUEyS2E2bVIxMWdaTUFyZW1Q?= =?utf-8?B?a1hVZzdpeURtY0cvZTU2ZVM2RWhRWS9Da0g0a1MzRFhBWHBtc3pGVDQxQzl1?= =?utf-8?B?TXlBVmZMVmdxOURBOUtEa1FuYjhYaGk1Y2YxWnVoUXRSUWZiVytZYnlEek14?= =?utf-8?B?K2twT1lmVDlVZGNLMWNIck41d0lCQ0dUUnZnRGEwVzdNWXhlVjY1UTNmQVpk?= =?utf-8?Q?RN7e/bH7hMAW4SvuvqS6bFP5TsdMYY5HFXFld0I?=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-ID: <716CEE8BFB5E8C4F9A5624F8DE65D44B@eurprd07.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-OriginatorOrg: ericsson.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB6PR0701MB3047.eurprd07.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6c1645f3-f477-4dac-0517-08d91a74f171
X-MS-Exchange-CrossTenant-originalarrivaltime: 19 May 2021 03:19:41.7261 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: nVS63yhWNPNweMCe6zrXsZnHbSEvvZK7v4CfRvCmZCym+lMffRAl03LVEG5Z250PGIc3gfFQXviI+62UIb4DZIcjty4xFqK7k1V6zPDsgZY=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR07MB4245
Archived-At: <https://mailarchive.ietf.org/arch/msg/core/Z9wxTL3-hAEDT_P8JOQztTfxlVU>
Subject: Re: [core] Review of draft-ietf-core-groupcomm-bis-03
X-BeenThere: core@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Constrained RESTful Environments \(CoRE\) Working Group list" <core.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/core>, <mailto:core-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/core/>
List-Post: <mailto:core@ietf.org>
List-Help: <mailto:core-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/core>, <mailto:core-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 19 May 2021 03:19:49 -0000

Hi,

I just submitted draft-mattsson-core-coap-attacks-00 which has a section on amplification attacks with descriptions of multicast and multicast observe but does not give any answers how to mitigate such amplification attacks.

Cheers,
John

-----Original Message-----
From: John Mattsson <john.mattsson@ericsson.com>
Date: Thursday, 25 February 2021 at 00:27
To: "core@ietf.org" <core@ietf.org>
Subject: Review of draft-ietf-core-groupcomm-bis-03

Review of draft-ietf-core-groupcomm-bis-03

I think this looks very well-written. I read through most of the document quickly and found very little to comment about.

- It seems unclear to me exactly how this updates RFC 7252. Do everything in RFC 7252 still apply, or are some multicast parts replaced? In such case which parts?

- The document seems a bit too locked to "UDP/IP multicast" for my taste. RFC 7252 left things much more open with statements like "by default, are transported over UDP". CoAP is now popular in many environment without UDP/IP and the same will/is true for Group CoAP. I don't see any reason why most of the things in the document could not easily be used with broadcast, geocast, unicast, and non-IP multicast. Maybe you could soften it down a bit so people wanting to use Group CoAP over Foo can still claim they are doing group CoAP draft-ietf-core-groupcomm-bis.

- I think group CoAP needs quite a bit more text on aplification attacks and DoS. There has been several negative articles regarding CoAP and DDoS in the last years. Group CoAP with it's 1 requests and N responses is a amplification in itself. Multicast Observe is even worse, 1 requests and N^2 responses. Multicast can however not be used on the public Internet which limits any attacks. The current document only mention amplification in some specific cases. I think the draft needs to expand on the text in RFC 7252:

 "This specification attempts to reduce the
   amplification effects of multicast requests by limiting when a
   response is returned.  To limit the possibility of malicious use,
   CoAP servers SHOULD NOT accept multicast requests that can not be
   authenticated in some way, cryptographically or by some multicast
   boundary limiting the potential sources.  If possible, a CoAP server
   SHOULD limit the support for multicast requests to the specific
   resources where the feature is required."

A reader of draft-ietf-core-groupcomm-bis might think that Group OSCORE and Echo is enough to stop amplification, which is not the case. Echo only helps a bit by limiting the size of the responses but not the number of responses. An attacker can spoof the source IP of the request and a smart attacker would send it to a resource that supports multicast requests. Not sure Group OSCORE helps much at all as an attacker can take an existing group request and change the source IP. 

Cheers,
John

-----Original Message-----
From: core <core-bounces@ietf.org> on behalf of "internet-drafts@ietf.org" <internet-drafts@ietf.org>
Reply to: "core@ietf.org" <core@ietf.org>
Date: Monday, 22 February 2021 at 17:51
To: "i-d-announce@ietf.org" <i-d-announce@ietf.org>
Cc: "core@ietf.org" <core@ietf.org>
Subject: [core] I-D Action: draft-ietf-core-groupcomm-bis-03.txt


A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : Group Communication for the Constrained Application Protocol (CoAP)
        Authors         : Esko Dijk
                          Chonggang Wang
                          Marco Tiloca
	Filename        : draft-ietf-core-groupcomm-bis-03.txt
	Pages           : 58
	Date            : 2021-02-22

Abstract:
   This document specifies the use of the Constrained Application
   Protocol (CoAP) for group communication, using UDP/IP multicast as
   the underlying data transport.  Both unsecured and secured CoAP group
   communication are specified.  Security is achieved by use of the
   Group Object Security for Constrained RESTful Environments (Group
   OSCORE) protocol.  The target application area of this specification
   is any group communication use cases that involve resource-
   constrained devices or networks.  This document replaces RFC7390,
   while it updates RFC7252 and RFC7641.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-groupcomm-bis/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-core-groupcomm-bis-03
https://datatracker.ietf.org/doc/html/draft-ietf-core-groupcomm-bis-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-groupcomm-bis-03


Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/


_______________________________________________
core mailing list
core@ietf.org
https://www.ietf.org/mailman/listinfo/core