Re: [secdir] Secdir last call review of draft-ietf-tls-dtls-connection-id-11

[Hannes Tschofenig <[e-mail]>]

Hi Ben, Hi Daniel,

There is currently a call for adoption of draft-tschofenig-tls-dtls-rrc because the TLS group decided earlier to consider adoption after the completion of draft-ietf-tls-dtls-connection-id-11 & DTLS 1.3 given that there are application specific mechanisms than can provide the same functionality. Of course, as Daniel mentioned below, there are preferences in the design of communication security that play a role here. In the IETF IoT community we have seen folks who prefer to do things at the application layer (CoAP in particular) and then there are folks who want to design a solution as low in the stack as possible.

In any case, we have implemented the 1.2 CID solution and use application layer RRCs. As a co-author of the - dtls-rrc I also want to see a generic solution at the DTLS layer.

Ciao
Hannes


-----Original Message-----
From: secdir <[e-mail]> On Behalf Of Benjamin Kaduk
Sent: Sunday, May 2, 2021 6:36 AM
To: Daniel Franke <[e-mail]>
Cc: [e-mail]; [e-mail]
Subject: Re: [secdir] Secdir last call review of draft-ietf-tls-dtls-connection-id-11

Hi Daniel,

Thanks for the review.

There was some effort towards a return-routability check at the DTLS layer, in draft-tschofenig-tls-dtls-rrc, but we seem to have failed to follow up after the adoption call was issued.

I've pinged the chairs to check on its progress.

-Ben

On Thu, Apr 22, 2021 at 08:36:56AM -0700, Daniel Franke via Datatracker wrote:
> Reviewer: Daniel Franke
> Review result: Ready
>
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the security area directors.
>  Document editors and WG chairs should treat these comments just like
> any other last call comments.
>
> Apologies for the absolute last-minute review; I overlooked until just
> now that this had been assigned a telechat date.
>
> This document is Ready. I do have some concerns — in particular I
> think relying on application-layer measures to prevent amplified
> reflection attacks is a bit dubious — but these have been debated to
> death already, the issues are well-captured in the document, and I don't think I have anything new to add.
>
>

_______________________________________________
secdir mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/secdir
wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.