Re: [core] I-D Action: draft-ietf-core-echo-request-tag-07.txt

[John Mattsson <[e-mail]>]

Hi,

-07 was uploaded to address an editorial errata in -06 (I comment was visible by mistake).

The changes since -05 are listed below. We think that -07 addresses the comments from Jim Schaad. In addition, we made a few other clarifications, and added more privacy and security considerations. In particular security consideration for reuse of Tokens as discussed high level on the list before the WGLC.

   o  Changes since draft-ietf-core-echo-request-tag-06:

      *  Removed visible comment that should not be visible in Token
         reuse considerations.

   o  Changes since draft-ietf-core-echo-request-tag-05:

      *  Add privacy considerations on cookie-style use of Echo values

      *  Add security considerations for token reuse

      *  Add note in security considerations on use of nonvolatile
         memory when dealing with pseudorandom numbers

      *  Appendix on echo generation: add a few words on up- and
         downsides of the encrypted timestamp alternative

      *  Clarifications around Outer Echo:

         +  Could be generated by the origin server to prove network
            reachability (but for most applications it MUST be inner)

         +  Could be generated by intermediaries

         +  Is answered by the client to the endpoint from which it
            received it (ie.  Outer if received as Outer)

      *  Clarification that a server can send Echo preemtively

      *  Refer to stateless to explain what "more information than just
         the sequence number" could be

      *  Remove explanations around 0.00 empty messags

      *  Rewordings:

         +  the attack: from "forging" to "guessing"

         +  "freshness tokens" to "freshness indicators" (to avoid
            confusion with the Token)

      *  Editorial fixes:

         +  Abstract and introduction mention what is updated in RFC7252

         +  Reference updates

         +  Capitalization, spelling, terms from other documents

Cheers,
John

-----Original Message-----
From: core <[e-mail]> on behalf of "[e-mail]" <[e-mail]>
Reply to: "[e-mail]" <[e-mail]>
Date: Thursday, 19 September 2019 at 12:58
To: "[e-mail]" <[e-mail]>
Cc: "[e-mail]" <[e-mail]>
Subject: [core] I-D Action: draft-ietf-core-echo-request-tag-07.txt

    
    A New Internet-Draft is available from the on-line Internet-Drafts directories.
    This draft is a work item of the Constrained RESTful Environments WG of the IETF.
    
            Title           : CoAP: Echo, Request-Tag, and Token Processing
            Authors         : Christian Amsüss
                              John Preuß Mattsson
                              Göran Selander
    	Filename        : draft-ietf-core-echo-request-tag-07.txt
    	Pages           : 27
    	Date            : 2019-09-19
    
    Abstract:
       This document specifies enhancements to the Constrained Application
       Protocol (CoAP) that mitigate security issues in particular use
       cases.  The Echo option enables a CoAP server to verify the freshness
       of a request or to force a client to demonstrate reachability at its
       claimed network address.  The Request-Tag option allows the CoAP
       server to match block-wise message fragments belonging to the same
       request.  The update to the client Token processing requirements of
       RFC 7252 forbids non-secure reuse of Tokens to ensure binding of
       responses to requests when CoAP is used with security.
    
    
    The IETF datatracker status page for this draft is:
    https://datatracker.ietf.org/doc/draft-ietf-core-echo-request-tag/
    
    There are also htmlized versions available at:
    https://tools.ietf.org/html/draft-ietf-core-echo-request-tag-07
    https://datatracker.ietf.org/doc/html/draft-ietf-core-echo-request-tag-07
    
    A diff from the previous version is available at:
    https://www.ietf.org/rfcdiff?url2=draft-ietf-core-echo-request-tag-07
    
    
    Please note that it may take a couple of minutes from the time of submission
    until the htmlized version and diff are available at tools.ietf.org.
    
    Internet-Drafts are also available by anonymous FTP at:
    ftp://ftp.ietf.org/internet-drafts/
    
    _______________________________________________
    core mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/core