Subject: [core] #322: Clarify that security SHOULD be used for issuing secure requests to a proxy

From: "core issue tracker" <[email-masked]>
Date: Thu, 16 May 2013 21:21:10 -0000

#322: Clarify that security SHOULD be used for issuing secure requests to a proxy

 Stephen Farrell notes (msg04415):

 Section 5.7

 (10) 10.1 - what does https mean here? If it means that the
 request/response are in clear between the source and proxy and then
 encrypted then a) you really really need to say that clearly and b) why is
 that even acceptable and c) what if the destination resource requires
 client auth? It just seems broken to pretend to use https this way. Going
 via a cross-proxy breaks security.  Similarly, what does coaps mean in
 10.2? We had some mail exchanges about that, but I'm not sure I'm ok with
 the outcome so I'd like to DISCUSS this some more. (And did any of that
 get into -16? Not sure.)

 Carsten says:

 Further discussion indicates that it is probably not possible to "solve"
 this in a general sense, but it may be worth to explicitly mandate for
 requests sent via a proxy:

 »When a client uses a proxy to make a request that will use a secure URI
 scheme (e.g., coaps or https), the request towards the proxy SHOULD be
 sent using DTLS security except where equivalent lower layer security is
 used for the leg between the client and the proxy.«

 (Note that CoAP's general rules then also make sure the response is sent
 back from the proxy to the client via DTLS.)

 While nailing this down this looks like a technical change, I'm pretty
 sure that we always intended this as the obvious way to implement sending
 secure requests to a proxy.

 I propose to add this text to the end of section 5.7 and add a pointer to
 5.7 to the first paragraph of 10.1.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |      Owner:  [email-masked]
  [email-masked]           |     Status:  new
     Type:  other        |  Milestone:  post-IESG-1
  technical              |    Version:  coap-16
 Priority:  minor        |   Keywords:
Component:  coap         |
 Severity:  Submitted    |
  WG Document            |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/core/trac/ticket/322>
core <http://tools.ietf.org/core/>

---

From: "core issue tracker" <[email-masked]>
Date: Wed, 22 May 2013 21:22:34 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 Fixed in [1389]:

 Fix #322

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-core-
  [email-masked]           |  [email-masked]
     Type:  other        |      Status:  closed
  technical              |   Milestone:  post-IESG-1
 Priority:  minor        |     Version:  coap-16
Component:  coap         |  Resolution:  fixed
 Severity:  Submitted    |
  WG Document            |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: </ticket/322#comment:1>
core <http://tools.ietf.org/core/>