Subject: [Dtls-iot] RFC 7925 - Section 16 - Session Hash

From: Achim Kraus <[email-masked]>
Date: Wed, 3 Jun 2020 14:06:02 +0200

Hi Thomas,
Hi Hannes,

I tried to find out, to which list this question should be sent.
According https://www.rfc-editor.org/info/rfc7925 it's dtls-iot.
But the last question there is from 2016. Therefore I added your
addresses directly, I hope that's OK.

https://tools.ietf.org/html/rfc7925#section-16

mentions:

"It is, however, possible that some application-layer protocols will
tunnel other authentication protocols on top of DTLS making this attack
relevant again."

Is there more information about that application-layer risk?
Would RFC 7627 protect against that application-layer risk?

I'm still wondering, if RFC 7627 comes with any benefit,
if only ECDHE or PSK cipher suites are supported anyway.

best regards
Achim