Subject: [T2TRG] FW: New Version Notification for draft-mattsson-core-coap-attacks-03.txt

From: John Mattsson <[email-masked]>
Date: Fri, 4 Feb 2022 14:57:20 +0000

Hi,

As discussed during the CORE interim, the part about amplification attacks have been removed from this document. The amplification attacks will soon be submitted to T2TRG as a new draft. I think it is great if T2TRG starts working on (D)DoS attacks as part of the suggested SECCORE activity. Two big enablers for DDoS are devices that are easy to hack and protocols/implementations with large amplification factors. A T2TRG activity would help to raise awareness, increase understanding, and hopefully suggest mitigations suitable for constrained devices and networks.

Changes in -03
  - The section on amplification attacks has been removed.
  - Merged a PR from Carsten with Nits
  - Merged a PR from Christian with a new section (2.4.3) describing the attack difficulty of the fragment rearrangement attack. This PR was based on an issue opened by Achim.

Cheers,
John

From: [email-masked] <[email-masked]>
Date: Friday, 4 February 2022 at 15:49
To: Christian Amsüss <[email-masked]>, Göran Selander <[email-masked]>, John Mattsson <[email-masked]>, Christian Amsuess <[email-masked]>, Francesca Palombini <[email-masked]>, Göran Selander <[email-masked]>, John Fornehed <[email-masked]>, John Mattsson <[email-masked]>
Subject: New Version Notification for draft-mattsson-core-coap-attacks-03.txt

A new version of I-D, draft-mattsson-core-coap-attacks-03.txt
has been successfully submitted by John Preuß Mattsson and posted to the
IETF repository.

Name:           draft-mattsson-core-coap-attacks
Revision:       03
Title:          Attacks on the Constrained Application Protocol (CoAP)
Document date:  2022-02-04
Group:          Individual Submission
Pages:          20
URL:            https://www.ietf.org/archive/id/draft-mattsson-core-coap-attacks-03.txt
Status:         https://datatracker.ietf.org/doc/draft-mattsson-core-coap-attacks/
Html:           https://www.ietf.org/archive/id/draft-mattsson-core-coap-attacks-03.html
Htmlized:       https://datatracker.ietf.org/doc/html/draft-mattsson-core-coap-attacks
Diff:           https://www.ietf.org/rfcdiff?url2=draft-mattsson-core-coap-attacks-03

Abstract:
   Being able to securely read information from sensors, to securely
   control actuators, and to not enable distributed denial-of-service
   attacks are essential in a world of connected and networking things
   interacting with the physical world.  This document summarizes a
   number of known attacks on CoAP and show that just using CoAP with a
   security protocol like DTLS, TLS, or OSCORE is not enough for secure
   operation.  Several of the discussed attacks can be mitigated with
   the solutions in draft-ietf-core-echo-request-tag.

The IETF Secretariat