Add Sequence Token Generator ?
sbernard31 opened this issue · comments
I understand that current default TokenGenerator is random based.
Looking at 4.2. Updated Token Processing Requirements for Clients , It seems that recommended way is a sequence number.
When CoAP is used with a security protocol not providing bindings between requests and responses, the Tokens have cryptographic importance. The client MUST make sure that Tokens are not used in a way so that responses risk being associated with the wrong request.
One easy way to accomplish this is to implement the Token (or part of the Token) as a sequence number, starting at zero for each new or rekeyed secure connection. This approach SHOULD be followed.
Do you think that SequenceGenerator should be added and/or maybe use as default ?
It seems that recommended way is a sequence number.
And previously, it was a random.
Do you think that SequenceGenerator should be added and/or maybe use as default ?
If you like to add one, OK. I don't think, it makes sense to use it as default.
Anyway, it's easy to define it as application specific default, if someone wants that.
By the way, assuming that such an attack would make only sense say within 24h. How many, say 4 bytes token are emitted usually in 24h per device? What will be the probability, that one of 4 byte tokens are reused within 24h?
And just to say, if the DTLS sequence number receive window is enabled, what will be left of that attack?
The API is able to work with a custom implementation of TokenGenerator. If someone is interested, please go for it. In the case someone wants to contribute it, that will be welcome.