[core] OSCOAP -02: sequence number reuse?

[Christian Amsüss <[e-mail]>]

Hello OSCOAP authors,

implementing OSCOAP -02, I'm worried about possible reuse of sequence
numbers. To make sure I understand things right, I'd like to outline
first my understanding of IVs currently specified:

* Assume the server has sender ID 01, and the client has sender ID 02.
* The server's Sender IV is derived from 01, let's say it is
  00010000000000; in analogy, the client's Sender IV is then
  00020000000000.
* The server's Recipient IV is then 00020000000000, the clients'
  Recipient IV is 00010000000000.

(If I'm completely off by here, please let me know and skip the rest).

When the client sends a request with seqno 1, the partial IV it sends is
01, and it uses IV 00020000000001. In the response, the server uses the
same sequence number but as a response, and according to 7.3 #3, it uses
the IV 80020000000001 (its recipient IV, first bit flipped and request
seqno applied). In that process, the server never touches its sequence
number counter.

When then, much later, the client starts an observation, it might send a
request with seqno 257 and IV 00020000000101. The server would, in its
response, fall into the second case of 7.3 #3, have its sequence number
at 1 and produce 80020000000001 (its recipient IV, first bit flipped,
and its own sequence number), which is the very IV we've had before.

(Again, if I'm completely off by here, ...).

I suppose the whole idea behind using the top-most bit on responses is
to partition the available IVs into a half that is self-determined and
one that is peer-determined. The idea is valid IMO, provided we stick
with "only one sender and one recipient" scenarios. Its execution would
need modification, though, unless I got the above wrong. I'd suggest:

* The first bit is flipped iff the sequence number of the request gets
  used (in which case neither server nor client do any checking of the
  sequence number, as it is as unique as the request's).

  Whenever a message is sent that carries its own sequence number
  (either because it is a request or because it is an observe response),
  its sender uses up a sequence number, its recipient checks the number,
  and the first bit stays as it is.

Furthermore, the use of one's Recipient IV for sending a message worries
me: This means that two different base IVs are used with the same key
(as long as the server acts as a server, it uses x002000000nnnn, but
when it asks back, it uses 0001000000nnnn). That means that the
10000000001(hex)st message the server uses in its role as a client
IV-collides with the 1st it uses in an observation.

IMO, everyone should still use their Sender IV for sending, and let the
first-bit flipping do the partitioning.


Hoping you didn't have to skip here from the first "If"
Christian

-- 
Christian Amsüss                      | Energy Harvesting Solutions GmbH
founder, system architect             | headquarter:
mailto:[e-mail]  | Arbeitergasse 15, A-4400 Steyr
tel:[phone]                | http://www.energyharvesting.at/
                                      | ATU68476614