Re: [secdir] secdir review of draft-ietf-core-stateless-05

[Klaus Hartke <[e-mail]>]

David Mandelberg wrote:
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.

Thanks a lot!

> I think this protocol change increases the amount of data that a CoAP server
> would reflect in a DoS attack using spoofed source IP addresses with UDP. I
> don't see any opportunity for amplification though, just reflection of more
> data sent by a malicious client. I'm very much not a DoS expert though, so I
> have no idea if this is an issue at all.

Right, the amount of data that can potentially be reflected increases. The CoAP RFC already has a section on reflection and amplification [1]; I will add an explicit reference to that section to the draft.

> What happens when a client changes the (implementation-private) format of
> the state it puts in the tokens? E.g., what if a client sends a request, applies a
> software update, then receives the response? (I'm guessing that's a more
> likely situation with UDP, since the software update would probably interrupt
> a TCP session.) If an attacker can predict when the software update will
> happen and how the new version will interpret the old version's tokens, can
> they replay anything maliciously? (Assuming the replay window includes
> some messages from just before the software update.)

Right, false interoperability with previous implementation versions might cause a security issue. I will add a paragraph along these lines to the draft ("...SHOULD include a version indicator in the serialized state...").

Klaus

[1] https://tools.ietf.org/html/rfc7252#section-11.3