Re: [T2TRG] [core] New Version Notification for draft-mattsson-core-coap-attacks-02.txt

[Carsten Bormann <[e-mail]>]

Hi John,

> On 2022-02-01, at 10:30, John Mattsson <john.mattsson=[e-mail]> wrote:
> 
> I think this would be a good time to have an adoption call for the document. Echo, Request-Tag, and Token Processing will soon be published as RFC 9175. It would be good to publish the informational “CoAP Attacks” as a companion document in the not-too-distant future as suggested by the security AD.

I think we need to open up this discussion a little bit before we converge on a good way forward.

We already have elements of solutions standardized, e.g., echo-request-tag (RFC 9175-to-be).  This is a standards-track document, done in the CoRE WG.
This document provides the implementer with a set of tools, but doesn’t provide actionable guidelines as to when these tools should be used.

We obviously need more documentation.

We could go ahead and do a BCP now, but somehow that might work approximately as well as the hand-washing mandates that are trying to prevent the spread of COVID-19 — we don’t actually know very well what works and what doesn’t (*).

To really do a BCP that works in a sustainable way, we need to do a bit more research:

— what attacks do occur in practice
— what solutions [mitigations] (RFC 7252, RFC 9175-to-be, others) actually do work against these attacks
— are there workarounds against those solutions that an attacker could use
— would certain solutions just shift around the attacks to a different vulnerability
— what is the design space for potential additional solutions that have fewer work-arounds
— if there are several solutions that one could choose from, how do they compare in
  — effectiveness
  — onus on the communication partners and the network in between
— can we come up metrics that actually allow an implementer to make decisions in this complex space

That information should not all go into the BCP, as this should focus on the actionable advice.  Instead, there should be a document that can be referenced from the BCP to provide more detailed explanation and rationale.

That other document (“research document”) would be a natural thing to work on in T2TRG.  We already have had some off-list discussions that indicate that we might have critical mass for that.

Grüße, Carsten

(*) Spoiler: Hand-washing does little against the spread of COVID-19.  But a general increase of handwashing is not bad at all, and it may be hard to retract mandates until it is proven that handwashing never helps (which you essentially can’t prove), so handwashing will stay on as a ritual that started with COVID-19.
One of my objectives is to minimize the number of rituals that we infect our ecosystem with…