Subject: [Anima] duplicate voucher requests in BRSKI

From: Michael Richardson <[email-masked]>
Date: Sun, 22 Oct 2017 13:58:58 -0400

Max, if a MASA receives a second (nth) voucher request with the same NONCE, for the
     same device and owner, can it return the same voucher? (assuming the
     voucher hasn't expired?)

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Kent Watsen <[email-masked]>
Date: Mon, 23 Oct 2017 11:32:52 +0000

i don’t see why not, but wouldn’t the creation time be different?

K.

Sent from my iPhone

On Oct 22, 2017, at 1:59 PM, Michael Richardson <[email-masked]<mailto:[email-masked]>> wrote:

--
Michael Richardson <[email-masked]<mailto:[email-masked]>>, Sandelman Software Works
-= IPv6 IoT consulting =-

_______________________________________________
Anima mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/anima

---

From: Michael Richardson <[email-masked]>
Date: Mon, 23 Oct 2017 10:18:44 -0400

> i don’t see why not, but wouldn’t the creation time be different?

Yes, the creation time ought to be different, but I think it's okay if it's
the same.   If the voucher has no expiry time, then this can be done for as
long as the nonce is the same.

I think that if the expiry time is <6hr then probably a new voucher needs to
be issued.  The goal here is to mitigate against crypto-intensive DoS
attacks, while still dealing with situations where a transfer may have
aborted, or something bad happened to a registrar and it has to retry.

---

From: "Max Pritikin (pritikin)" <[email-masked]>
Date: Mon, 23 Oct 2017 16:44:38 +0000

I don’t see why the voucher actually has to be expired before obtaining a refresh. 
The creation time would of course be updated.

Michael’s point that a Registrar could use this to force the MASA to perform crypto operations is valid. As implied the fix is to allow the MASA to simply return a current voucher (database lookup but less crypto) if that is more expedient. I suggest we leave that up to the MASA implementors. 

- max

> On Oct 23, 2017, at 8:18 AM, Michael Richardson <[email-masked]> wrote:
> 
>