[core] Consensus on using Echo to mitigate NoSec amplification?

[Carsten Bormann <[e-mail]>]

In draft-ietf-core-echo-request-tag-08.txt, Section 2.4 item 3 places a SHOULD on a "server that sends large responses to unauthenticated peers” to mitigate the amplification threat using the Echo Option procedure.

draft-ietf-core-echo-request-tag already is flagged to update RFC7252, but this is called out in the abstract and introduction only for Token processing.  The SHOULD in Section 2.4 item 3 is a bit hidden for my taste.  My esteemed co-chair pointed out to me that we don’t really advertise a mitigation for the substantial amplification opportunities posed by those installations that do not translate the discussion in Section 11.3 of RFC 7252 into active behavior.  There are now people out there that believe CoAP ranks with DNS and NTP in the DDoS threat generated.

<chair hat>
Would the CoRE WG be fine with expanding the “updates 7252” text in draft-ietf-core-echo-request-tag to also include recommending this mitigation?  If you have a position on this, please reply to the list (or to the chairs) by March 2nd.

Grüße, Carsten