emanjon
commented
4 years ago Sounds good.
From: chrysn notifications@github.com Reply to: core-wg/echo-request-tag reply@reply.github.com Date: Tuesday, 17 September 2019 at 15:23 To: core-wg/echo-request-tag echo-request-tag@noreply.github.com Cc: John Mattsson john.mattsson@ericsson.com, Comment comment@noreply.github.com Subject: Re: [core-wg/echo-request-tag] Allow OSCORE servers to send outer Echo for reachability, ... (#48)
@chrysn commented on this pull request.
In draft-ietf-core-echo-request-tag.mdhttps://protect2.fireeye.com/url?k=5112f2c7-0dc6fba1-5112b25c-8610d8a762ca-c54b8a5254bceef6&q=1&u=https%3A%2F%2Fgithub.com%2Fcore-wg%2Fecho-request-tag%2Fpull%2F48%23discussion_r325163168:
@@ -144,9 +144,7 @@ The server may use request freshness provided by the Echo option to verify the a
Upon receiving a 4.01 Unauthorized response with the Echo option, the client SHOULD resend the original request with the addition of an Echo option with the received Echo option value. The client MAY send a different request compared to the original request. Upon receiving any other response with the Echo option, the client SHOULD echo the Echo option value in the next request to the server. The client MAY include the same Echo option value in several different requests to the server.
-A client MUST only send Echo values to endpoints it received them from (where as defined in {{RFC7252}} Section 1.2, the security association is part of the endpoint).
-In OSCORE processing, that means sending Echo values from outer options back in outer options,
-and those from inner options in inner options in the same security context.
+A client MUST only send Echo values to endpoints it received them from (where as defined in {{RFC7252}} Section 1.2, the security association is part of the endpoint). In OSCORE processing, that means sending Echo values from outer options back in outer options, and those from inner options in inner options in the same security context. Echo options in error responses not protected by OSCORE are treated as outer options.
OK, then let's just say "from outer options (or non-OSCORE messages)"; merging with that on top of it.
— You are receiving this because you commented. Reply to this email directly, view it on GitHubhttps://protect2.fireeye.com/url?k=d05ebdf6-8c8ab490-d05efd6d-8610d8a762ca-2e98ea59e8abcd55&q=1&u=https%3A%2F%2Fgithub.com%2Fcore-wg%2Fecho-request-tag%2Fpull%2F48%3Femail_source%3Dnotifications%26email_token%3DAFYXKYQ2DQC2EJDOOXXV3T3QKDK3ZA5CNFSM4IXA5CMKYY3PNVWWK3TUL52HS4DFWFIHK3DMKJSXC5LFON2FEZLWNFSXPKTDN5WW2ZLOORPWSZGOCE63MBI%23discussion_r325163168, or mute the threadhttps://protect2.fireeye.com/url?k=148e2046-485a2920-148e60dd-8610d8a762ca-502cc4990ac93970&q=1&u=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAFYXKYWIDDZMK6LUPMRUR3LQKDK3ZANCNFSM4IXA5CMA.
chrysn
... and clarify that client aliveness is a cryptographic property.
This is in response to comments about the conflict between "OSCORE servers MUST ONLY produce Inner" and "Echo option [...] MAY be unprotected".
Contributes-To: https://github.com/core-wg/echo-request-tag/issues/46