search

eclipse-californium / californium

CoAP/DTLS Java Implementation
https://www.eclipse.org/californium/
Other
722 stars 364 forks source link

Add Sequence Token Generator ? #2175

Open sbernard31 opened 10 months ago

sbernard31 commented 10 months ago

I understand that current default TokenGenerator is random based.

Looking at 4.2. Updated Token Processing Requirements for Clients , It seems that recommended way is a sequence number.

When CoAP is used with a security protocol not providing bindings between requests and responses, the Tokens have cryptographic importance. The client MUST make sure that Tokens are not used in a way so that responses risk being associated with the wrong request.

One easy way to accomplish this is to implement the Token (or part of the Token) as a sequence number, starting at zero for each new or rekeyed secure connection. This approach SHOULD be followed.

Do you think that SequenceGenerator should be added and/or maybe use as default ?

boaks commented 10 months ago

It seems that recommended way is a sequence number.

And previously, it was a random.

Do you think that SequenceGenerator should be added and/or maybe use as default ?

If you like to add one, OK. I don't think, it makes sense to use it as default. Anyway, it's easy to define it as application specific default, if someone wants that.

boaks commented 10 months ago

By the way, assuming that such an attack would make only sense say within 24h. How many, say 4 bytes token are emitted usually in 24h per device? What will be the probability, that one of 4 byte tokens are reused within 24h? And just to say, if the DTLS sequence number receive window is enabled, what will be left of that attack?

boaks commented 4 months ago

The API is able to work with a custom implementation of TokenGenerator. If someone is interested, please go for it. In the case someone wants to contribute it, that will be welcome.