[core] CoAP observation in NATed environment using DTLS

Simon Bernard <contact@simonbernard.eu> Thu, 03 November 2016 18:03 UTC

To: "core@ietf.org" <core@ietf.org>
From: Simon Bernard <contact@simonbernard.eu>
Message-ID: <ef7b578b-0882-bcc9-b95d-57fc5a7d3d65@simonbernard.eu>
Date: Thu, 03 Nov 2016 19:03:43 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Icedove/45.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/core/0vwuEnq6IRHJc70l3BTggX6p9vs>
Subject: [core] CoAP observation in NATed environment using DTLS
Precedence: list

Hi list,

I have attended meeting of the T2T RG in Ludwigsburg, there is a 
discussion around CoAP observation in NATed environment using DTLS (1.2).

I would like to share my thought here about that:

     The problem :
Currently the CoAP spec say :
"All notifications resulting from a GET request with an Observe Option 
MUST be returned within the same epoch of the same connection as the 
request."
Currently, in TLS, a connection is identified by its IP/Port address.
So when your IP address changed because of the NAT expiration, you must 
create a new TLS connection and so create a new CoAP observation relation.

     Behind this practical problem, I understand there is 2 separated 
issue :
1) Define a long term identifier for CoAP instead of limited CoAP 
interaction to the same DTLS connection. At CoAP level users would like 
to know from which or to which they send data.
2) Be able to use DTLS with dynamic IP address (e.g. NAT) without the 
need to redo full handshake or resume handshake.

     Possible Solutions ?
1) Using the DTLS identity (PSK identity for PSK, public key for RPK, CN 
for certificate, ...) and only if there is no authentication the DTLS 
Session as constraint for CoAP exchange. (we remove the same epoch/same 
connection constraint)
2) Using the "connectionId" extension proposed in the 
draft-fossati-tls-iot-optimizations-00.

Does it make sense  ?

Simon

[core] CoAP observation in NATed environment usin… Simon Bernard
Re: [core] CoAP observation in NATed environment … Stephen Farrell
Re: [core] CoAP observation in NATed environment … Lauri Piikivi
Re: [core] CoAP observation in NATed environment … Simon Bernard
Re: [core] CoAP observation in NATed environment … Simon Bernard
Re: [core] CoAP observation in NATed environment … Simon Bernard
Re: [core] CoAP observation in NATed environment … Lauri Piikivi
Re: [core] CoAP observation in NATed environment … Ludwig Seitz