Re: [T2TRG] [core] New Version Notification for draft-mattsson-core-coap-attacks-02.txt

[John Mattsson <[e-mail]>]

> We obviously need more documentation.

I agree that we obviously need more research and documentation regarding amplification attacks. I also agree that we need more discussion. I think it would be very good if T2TRG do research on the topic.

echo-request-tag (RFC 9175-to-be) will soon be published which provides mechanisms and guidance to mitigate some of the attacks described in draft-mattsson-core-coap-attacks.

Regarding BCP, I agree with you that we don't have all the knowledge. On the other hand we need to make sure that amplification attacks using IoT devices do net get worse. They cause significant and costly damage. Right now CoAP is used in DDoS attacks, and it is not even clear that the devices used are violating IETF requirements.

I think a minumum right now is to publish descriptions on how CoAP can be used in amplification attacks (draft-mattsson-core-coap-attacks) and to make the amplification mitigation requirements in new RFCs (group communicaiton, conditional attributes) stricter then CORE has done in the past.

I agree that an BCP would likely be much better if written later. But one could also arguee that if we know so little on how to mitigate IoT amplification attacks, publishing more IoT RFCs is unethical.

I think a reasonable way forward would be
-               Soon: Publish descriptions on how CoAP can be used in amplification attacks.
-               Soon: Discuss how to make the amplification mitigation requirements in new RFCs stricter between now and when the BCP is published.
-               Later: Publish T2TRG research document on denial-of-service and amplification attacks.
-               Later: Publish BCP referencing the research document.

For T2TRG, here are links to the last two presentation on the topic.

https://datatracker.ietf.org/meeting/111/materials/slides-111-core-coap-attacks-00

https://datatracker.ietf.org/meeting/interim-2022-core-02/materials/slides-interim-2022-core-02-sessa-coap-attacks-draft-mattsson-core-coap-attacks-02-00

Cheers,
John

From: Carsten Bormann <[e-mail]>
Date: Wednesday, 2 February 2022 at 14:03
To: John Mattsson <[e-mail]>
Cc: [e-mail] <[e-mail]>, [e-mail] <[e-mail]>
Subject: Re: [core] New Version Notification for draft-mattsson-core-coap-attacks-02.txt
Hi John,

> On 2022-02-01, at 10:30, John Mattsson <john.mattsson=[e-mail]> wrote:
>
> I think this would be a good time to have an adoption call for the document. Echo, Request-Tag, and Token Processing will soon be published as RFC 9175. It would be good to publish the informational “CoAP Attacks” as a companion document in the not-too-distant future as suggested by the security AD.

I think we need to open up this discussion a little bit before we converge on a good way forward.

We already have elements of solutions standardized, e.g., echo-request-tag (RFC 9175-to-be).  This is a standards-track document, done in the CoRE WG.
This document provides the implementer with a set of tools, but doesn’t provide actionable guidelines as to when these tools should be used.

We obviously need more documentation.

We could go ahead and do a BCP now, but somehow that might work approximately as well as the hand-washing mandates that are trying to prevent the spread of COVID-19 — we don’t actually know very well what works and what doesn’t (*).

To really do a BCP that works in a sustainable way, we need to do a bit more research:

— what attacks do occur in practice
— what solutions [mitigations] (RFC 7252, RFC 9175-to-be, others) actually do work against these attacks
— are there workarounds against those solutions that an attacker could use
— would certain solutions just shift around the attacks to a different vulnerability
— what is the design space for potential additional solutions that have fewer work-arounds
— if there are several solutions that one could choose from, how do they compare in
  — effectiveness
  — onus on the communication partners and the network in between
— can we come up metrics that actually allow an implementer to make decisions in this complex space

That information should not all go into the BCP, as this should focus on the actionable advice.  Instead, there should be a document that can be referenced from the BCP to provide more detailed explanation and rationale.

That other document (“research document”) would be a natural thing to work on in T2TRG.  We already have had some off-list discussions that indicate that we might have critical mass for that.

Grüße, Carsten

(*) Spoiler: Hand-washing does little against the spread of COVID-19.  But a general increase of handwashing is not bad at all, and it may be hard to retract mandates until it is proven that handwashing never helps (which you essentially can’t prove), so handwashing will stay on as a ritual that started with COVID-19.
One of my objectives is to minimize the number of rituals that we infect our ecosystem with…