Subject: [TLS] DTLS and failed cookie validation

From: <[email-masked]>
Date: Sat, 26 Jul 2008 19:51:41 +0300

Hi,

While reading draft-ietf-capwap-protocol-specification-11, I came
across a detail that isn't well specified in DTLS:

RFC 4347 doesn't seem to say what the server should do if it receives
an invalid cookie (which doesn't match the expected value).

My proposal would be to treat this the same as a request with no
cookie at all. (The original IKEv2 RFC also omitted this detail. When
writing RFC 4718 we concluded that other approaches, such as silently
discarding the whole request, could create strange failure modes even
in the absence of any malicious attackers, and wouldn't really provide
any additional DoS protection.)

Best regards,
Pasi

_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls