[TLS] DTLS and failed cookie validation

[<Pasi.Eronen at nokia.com>]

Hi,

While reading draft-ietf-capwap-protocol-specification-11, I came
across a detail that isn't well specified in DTLS:

RFC 4347 doesn't seem to say what the server should do if it receives
an invalid cookie (which doesn't match the expected value).

My proposal would be to treat this the same as a request with no
cookie at all. (The original IKEv2 RFC also omitted this detail. When
writing RFC 4718 we concluded that other approaches, such as silently
discarding the whole request, could create strange failure modes even
in the absence of any malicious attackers, and wouldn't really provide
any additional DoS protection.)

Best regards,
Pasi


_______________________________________________
TLS mailing list
TLS at ietf.org
https://www.ietf.org/mailman/listinfo/tls