Subject: [core] #292: Add description of resource depletion attack

From: "core issue tracker" <[email-masked]>
Date: Sun, 07 Apr 2013 12:26:56 -0000

#292: Add description of resource depletion attack

 Michael Scharf (tsv-dir reviewer) notes (msg04191-tsvdir-4):

 Section 11

 * Section 11

 => This section IMHO lacks the description of two further attacks:

 (a) The equivalent of a SYN flooding attack on TCP would be sending
 complex queries with CON to a server. Given that the cost of a CON request
 is small, this attack can easily be executed. Also, if the server responds
 with CONs, it will have to allocate buffer and retransmission logic for
 each request, and it will likely run out of resources. A simple remedy is
 rate limiting as mentioned in Section 4.7; this counter-measure should be
 repeated here.

 Carsten Bormann plans to reply:

 Yes. (There is a whole set of battery depletion attacks that are hard to
 guard against without some form of network segregation.)

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  [email-masked]
  [email-masked]           |     Status:  new
     Type:  other        |  Milestone:  post-IESG-1
  technical              |    Version:  coap-14
 Priority:  minor        |   Keywords:
Component:  coap         |
 Severity:  Submitted    |
  WG Document            |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/core/trac/ticket/292>
core <http://tools.ietf.org/core/>

---

From: "core issue tracker" <[email-masked]>
Date: Fri, 12 Apr 2013 19:24:59 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 Fixed in [1289]:

 Add a paragraph about resource depletion attacks, fix #292 and fix #293

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-core-
  [email-masked]           |  [email-masked]
     Type:  other        |      Status:  closed
  technical              |   Milestone:  post-IESG-1
 Priority:  minor        |     Version:  coap-14
Component:  coap         |  Resolution:  fixed
 Severity:  Submitted    |
  WG Document            |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: </ticket/292#comment:1>
core <http://tools.ietf.org/core/>