Re: [T2TRG] [core] New Version Notification for draft-mattsson-core-coap-attacks-02.txt

[Carsten Bormann <[e-mail]>]

Just picking one paragraph here:

> On 2022-02-02, at 18:52, Achim Kraus <[e-mail]> wrote:
> 
> I'm not sure, if there is a common, realistic understanding of the
> "nature" of such an attack. At least I have much more questions than
> answers. E.g. is amplification only relevant above some threshold?
> Means, if a request with 80 bytes is used and the response has 160, is
> that relevant? Or must the response be above 400 bytes in order to get
> relevant? So, in theory there may be a lot of rules, but I'm afraid,
> that these rules stay theoretical, complicated, and maybe practically wrong.

That is exactly the issue that makes this so hard.
We need to factor in how attackers are going to behave, so the answers are neither exact nor stable.
If there are better amplification sources, there will be much fewer attacks using public CoAP servers.
But once these go away, CoAP server suddenly seem interesting again.
So the fixes in other protocols and implementations are our enemy here…

It seems you have data, and that is what I’d like to collect in the T2TRG effort, together with what went wrong in the specific instances.

Then we need to forge these data into an assessment of the situation and finally rules with a bit harder boundaries than the ones we already have.  That will be the BCP.

Grüße, Carsten