Re: [core] I-D Action: draft-ietf-core-attacks-on-coap-01.txt

[[e-mail]]

Hi John,

Thanks for the update.

(I was confused by the WGLC mention in your initial message. It seems that you are referring to the comments received during the call for adoption).

Cheers,
Med

De : John Mattsson <[e-mail]>
Envoyé : vendredi 11 novembre 2022 15:08
À : BOUCADAIR Mohamed INNOV/NET <[e-mail]>; John Mattsson <john.mattsson=[e-mail]>; [e-mail]
Objet : Re: [core] I-D Action: draft-ietf-core-attacks-on-coap-01.txt

Hi Mohamed,

As I wrote none of the WGLS comments related to the "Request Fragment Rearrangement Attack" has been addressed. There was also comments from Jon Shallow and Achim Kraus regarding this section. We will address that in the next update. Your comment has been captured as a GitHub issue and will not be forgotten. We agree that discussion that considers RFC9177 is needed.

https://github.com/core-wg/attacks-on-coap/issues

Cheers,
John

From: core <[e-mail]<mailto:[e-mail]>> on behalf of [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Date: Thursday, 10 November 2022 at 20:55
To: John Mattsson <john.mattsson=[e-mail]<mailto:john.mattsson=[e-mail]>>, [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: Re: [core] I-D Action: draft-ietf-core-attacks-on-coap-01.txt
Hi John,


It is long time since I read this draft. It seems that this version still does not address https://mailarchive.ietf.org/arch/msg/core/GNnRO4-iE_jRb5X2HfRtV3c8Sew/. I was at least expecting to see a discussion that also considers RFC9177.



Apologies if I missed any follow-up since then.



Cheers,

Med

De : core <[e-mail]<mailto:[e-mail]>> De la part de John Mattsson
Envoyé : jeudi 10 novembre 2022 11:05
À : [e-mail]<mailto:[e-mail]>
Objet : Re: [core] I-D Action: draft-ietf-core-attacks-on-coap-01.txt

Hi,

This update tries to address many but not all of the WGLC comments:

  *   "block attack" renamed "blocking attack"
  *   Added "availability" to list of required properties
  *   Added that the freshness definition comes from RFC 9175
  *   Several changes to abstract and introduction based on Achim's comment

Left to do of WGLC comments:

  *   All the comments related to the Request Fragment Rearrangement Attack
  *   Maybe more changes based on Achim's comment

Cheers,
John

From: core <[e-mail]<mailto:[e-mail]>> on behalf of [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Date: Thursday, 10 November 2022 at 10:54
To: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Cc: [e-mail]<mailto:[e-mail]> <[e-mail]<mailto:[e-mail]>>
Subject: [core] I-D Action: draft-ietf-core-attacks-on-coap-01.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : Attacks on the Constrained Application Protocol (CoAP)
        Authors         : John Preuß Mattsson
                          John Fornehed
                          Göran Selander
                          Francesca Palombini
                          Christian Amsüss
  Filename        : draft-ietf-core-attacks-on-coap-01.txt
  Pages           : 19
  Date            : 2022-11-10

Abstract:
   Being able to securely read information from sensors, to securely
   control actuators, and to not enable distributed denial-of-service
   attacks are essential in a world of connected and networking things
   interacting with the physical world.  Using a security protocol such
   as DTLS, TLS, or OSCORE to protect CoAP is a requirement for secure
   operation and protects against many attacks.  This document
   summarizes a number of known attacks on CoAP deployments and show
   that just using CoAP with a security protocol like DTLS, TLS, or
   OSCORE is not enough for secure operation.  Several of the discussed
   attacks can be mitigated with the solutions in RFC 9175.


The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-attacks-on-coap/

There is also an HTML version available at:
https://www.ietf.org/archive/id/draft-ietf-core-attacks-on-coap-01.html

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-attacks-on-coap-01


Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts


_______________________________________________
core mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/core

_________________________________________________________________________________________________________________________



Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc

pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler

a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,

Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.



This message and its attachments may contain confidential or privileged information that may be protected by law;

they should not be distributed, used or copied without authorisation.

If you have received this email in error, please notify the sender and delete this message and its attachments.

As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.

Thank you.

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.