Skip to main content

Last Call Review of draft-ietf-lpwan-coap-static-context-hc-12
review-ietf-lpwan-coap-static-context-hc-12-secdir-lc-wouters-2020-02-21-00

Request Review of draft-ietf-lpwan-coap-static-context-hc
Requested revision No specific revision (document currently at 19)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2020-02-20
Requested 2020-02-06
Authors Ana Minaburo , Laurent Toutain , Ricardo Andreasen
I-D last updated 2020-02-21
Completed reviews Iotdir Last Call review of -11 by Stephen Farrell (diff)
Genart Last Call review of -12 by Reese Enghardt (diff)
Opsdir Last Call review of -12 by Linda Dunbar (diff)
Tsvart Last Call review of -12 by Dr. Joseph D. Touch (diff)
Secdir Last Call review of -12 by Paul Wouters (diff)
Secdir Last Call review of -13 by Charlie Kaufman (diff)
Secdir Telechat review of -15 by Charlie Kaufman (diff)
Assignment Reviewer Paul Wouters
State Partially completed
Request Last Call review on draft-ietf-lpwan-coap-static-context-hc by Security Area Directorate Assigned
Posted at https://mailarchive.ietf.org/arch/msg/secdir/Qc_Og_fHlcNjD0YOtznQ1-IfW7E
Reviewed revision 12 (document currently at 19)
Result Serious Issues
Completed 2020-02-21
review-ietf-lpwan-coap-static-context-hc-12-secdir-lc-wouters-2020-02-21-00
I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

I agree with the comments raised by the genart review by Theresa Enghardt. The
Security Section is just a reference to another document that specifies in its
own Security Consideration:

  As explained in Section 5, SCHC is expected to be implemented on top
   of LPWAN technologies, which are expected to implement security
   measures.

This document explains that packets are wrapped in CoAP and then this document
can be used to compress fields, similar to the references document. But now
this is happening in the most outer layer, which the referenced document
basically states that in its Security Considerations, it assumes the outer
layer has some kind of LPWAN based security meassures in place.

It seems these two drafts need some coordination to determine where, how and
which Security Considerations are relevant.

Additionally, I'm a bit worried about multiple layers doing compression. Can
this lead to security issues? If not, why not?

Where is it sais that compression states need to be checked for bogus
instructions? How are these prevented? Think of the ever-decompressing zip file
hacks of the past. How are these DoS attacks prevented ?

Other than this issue, I found Section 1 Introducion a bit confusing. It seems
to drop a reference to another document and then explain that other document,
without really talking about this document? Or if it does, it was not very
clear to me.

I did not review this document for nits - my apologies but I ran out of time.