Subject: [Ace] When to deal with proxies?

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Mar 2014 02:30:08 +0100

Hi all,

Goeran raised a question in the charter discussion about when to
investigate suitability of the solution regarding proxies.

With version 0.5 of the charter I suggested to explore the proxy issues*
after a candidate solution had been selected.

He suggested, however, to deal with proxies already during as part of
the requirements/use case/design considerations phase.

What would you like to do?

Ciao
Hannes

PS: We discussed various types of proxies on the list. Some proxies were
protocol translation proxies that provided the ability to interface with
other protocols (e.g., HTTP) and deployed infrastructure (some backend
authentication/authorization infrastructure) and yet other proxies were
part of the CoAP protocol.

---

From: Phil Hunt <[email-masked]>
Date: Thu, 13 Mar 2014 09:54:11 -0700

I think proxies should be discussed up front. I'm not a big fan of them, so discussing why we think we need them seems important.

My belief is that dual-protocol endpoints rather than gateways/proxies is what will be simplest and most secure. 

But again, discussion will bring out what we mean by proxy and what the benefits are.

Phil

@independentid
www.independentid.com
[email-masked]

On 2014-03-12, at 6:30 PM, Hannes Tschofenig <[email-masked]> wrote:

> _______________________________________________
> Ace mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ace

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Mar 2014 17:56:12 +0100

Thanks for your feedback, Phil.

Dual-protocol endpoints might be a bit challenging for some of the
devices that folks have in mind. CoAP was developed since there was the
believe HTTP stacks do not fit on some of these very constrained
devices. Telling these people now that they should now add HTTP to it
because of interworking with legacy infrastructure might make them jump
up-and-down.

Ciao
Hannes

---

From: Phil Hunt <[email-masked]>
Date: Thu, 13 Mar 2014 10:12:04 -0700

Agreed. When it is all constrained, the case is clear. But often there will be a mix. Some have pointed out that AS servers will likely be unconstrained.  My thought is that unconstrained endpoints will likely have to be dual protocol (TCP and UDP) based.

Some have commented that they think AS's would likely be unconstrained. Taking that thought forward: an AS would likely support both constrained and non-constrained clients allowing a non-constrained client to obtain a token to use against a constrained resource.  The reverse, a constrained client obtains a token to use against a dual-protocol resource. Or finally, a constrained client obtains a token to use with a constrained resource.

This is what we need to work through.  As soon as we introduce proxies, we get into MITM issues when a lot of current authorization approaches are assuming secure point-to-point communication.

Phil

@independentid
www.independentid.com
[email-masked]

---

From: "Rahman, Akbar" <[email-masked]>
Date: Thu, 13 Mar 2014 15:57:02 -0400

Hi Hannes,

> I think proxies should be discussed up front. I'm not a big fan of
them, so discussing why we think we need them seems important.

I agree with this point from Phil.  And it overlaps with the point that
I previously brought up regarding extensive support of proxies in the
current CoAP spec:

http://www.ietf.org/mail-archive/web/ace/current/msg00360.html

Since neither Zach/Carsten (i.e. CoAP experts) have responded yet, I
would like to draw your attention to the following section of the CoAP
spec which specifically discusses CoAP Proxies and DTLS.  Please see
especially the 3rd paragraph which refers specifically to "access
control considerations":

http://tools.ietf.org/html/draft-ietf-core-coap-18#section-11.2

Best Regards,

Akbar

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
Sent: Thursday, March 13, 2014 12:56 PM
To: Phil Hunt
Cc: [email-masked]
Subject: Re: [Ace] When to deal with proxies?

Ciao
Hannes

On 03/13/2014 05:54 PM, Phil Hunt wrote:
> I think proxies should be discussed up front. I'm not a big fan of
them, so discussing why we think we need them seems important.
> 
> My belief is that dual-protocol endpoints rather than gateways/proxies
is what will be simplest and most secure. 
>> With version 0.5 of the charter I suggested to explore the proxy 
>> issues* after a candidate solution had been selected.
>>

>> PS: We discussed various types of proxies on the list. Some proxies 
>> were protocol translation proxies that provided the ability to 
>> interface with other protocols (e.g., HTTP) and deployed 
>> infrastructure (some backend authentication/authorization 
>> infrastructure) and yet other proxies were part of the CoAP protocol.
>>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Mar 2014 21:03:33 +0100

Very good point since I am wondering now myself how a CoAP client
authorizes the server when there is a CoAP proxy along the way.

When I read through the security consideration section of the CoAP spec
it just said that you compare the identifier used for the look-up with
the one found in the certificate but unless the CoAP client knew about
the proxy up-front this check will fail. If the CoAP client knew about
the proxy then, in DTLS terms, it is actually treating the proxy as the
server. Needless to say that this would be useless for the work we are
doing in this group since the information would just be with the wrong
party.

Ciao
Hannes