[core] FW: New Version Notification for draft-mattsson-core-coap-attacks-02.txt

[John Mattsson <[e-mail]>]

Hi,

-02 tries to address almost all received comments on -00 and -01.

- A paragraph explaining freshness, replay protection, and sequence numbers has been added.
- More references to the soon to be published RFC 9175 (Echo, Request-Tag, and Token Processing)
- While RFC2119 terminology is perfectly fine in an informational draft/RFC it is not needed
in this document. All RFC2119 terminology has been removed based on a comment from Carsten.
- Added more details on which protocols are affected by the attacks and some practical difficulties based on comments from Achim.
- Corrected text on OSCORE over TCP. It is TLS-like replay protection that mitigates the attack, not TCP.
- Added a sentence on why misbinding attacks do not work on HTTPS.
- Changed homeless/hitman/killed to something nicer based on Carsten’ comment.
- Smaller editorial changes (several based on comments from Carsten)

I think this would be a good time to have an adoption call for the document. Echo, Request-Tag, and Token Processing will soon be published as RFC 9175. It would be good to publish the informational “CoAP Attacks” as a companion document in the not-too-distant future as suggested by the security AD.

https://mailarchive.ietf.org/arch/msg/core/i6bf9C0ObT5FIplkHPms9gaC47U/

Cheers,
John

From: [e-mail] <[e-mail]>
Date: Tuesday, 1 February 2022 at 09:59
To: Christian Amsüss <[e-mail]>, Göran Selander <[e-mail]>, John Mattsson <[e-mail]>, Christian Amsuess <[e-mail]>, Francesca Palombini <[e-mail]>, Göran Selander <[e-mail]>, John Fornehed <[e-mail]>, John Mattsson <[e-mail]>
Subject: New Version Notification for draft-mattsson-core-coap-attacks-02.txt

A new version of I-D, draft-mattsson-core-coap-attacks-02.txt
has been successfully submitted by John Preuß Mattsson and posted to the
IETF repository.

Name:           draft-mattsson-core-coap-attacks
Revision:       02
Title:          CoAP Attacks
Document date:  2022-02-01
Group:          Individual Submission
Pages:          25
URL:            https://www.ietf.org/archive/id/draft-mattsson-core-coap-attacks-02.txt
Status:         https://datatracker.ietf.org/doc/draft-mattsson-core-coap-attacks/
Html:           https://www.ietf.org/archive/id/draft-mattsson-core-coap-attacks-02.html
Htmlized:       https://datatracker.ietf.org/doc/html/draft-mattsson-core-coap-attacks
Diff:           https://www.ietf.org/rfcdiff?url2=draft-mattsson-core-coap-attacks-02

Abstract:
   Being able to securely read information from sensors, to securely
   control actuators, and to not enable distributed denial-of-service
   attacks are essential in a world of connected and networking things
   interacting with the physical world.  This document summarizes a
   number of known attacks on CoAP and show that just using CoAP with a
   security protocol like DTLS, TLS, or OSCORE is not enough for secure
   operation.  The document also summarizes different denial-of-service
   attacks using CoAP.  The goal with this document is motivating
   generic and protocol-specific recommendations on the usage of CoAP.
   Several of the discussed attacks can be mitigated with the solutions
   in draft-ietf-core-echo-request-tag.




The IETF Secretariat