> For the complete documentation index, see [llms.txt](https://security.andreasbreum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.andreasbreum.com/internet-of-things/common-iot-protocols/coap.md).

# CoAP

Constrained Application Protocol (CoAP)

CoAP (Constrained Application Protocol) is a lightweight and efficient protocol designed for use with constrained networks and devices. CoAP is particularly well-suited for low-power wireless devices, and it is often used in IoT applications such as home automation, smart energy, and industrial automation.

## CoAP at a glance

* Application layer protocol 
* Focus on constrained devices - CoAP is designed to work efficiently on devices with limited processing power and memory, such as sensors and actuators.
* Runs over UDP 
* RFC [7252 ](https://www.rfc-editor.org/rfc/rfc7252)
* Very lightweight 
* Can be used over ZigBee

## CoAP security

Security is done by enforcing DTLS (Datagram Transport Layer Security), which is similar to TLS (Transport Layer Security) but designed for use with UDP.

Four security modes: 

* NoSec: DTLS is disabled, and no security measures are enforced.
* PreSharedKey: DTLS is enabled, and a pre-shared key list is used for authentication and encryption using the AES algorithm.
* RawPublicKey: DTLS is enabled, and asymmetric keys without a certificate are used for authentication and encryption using the AES and ECC algorithms. 
* Certificate: DTLS is enabled, and X.509 certificates are used for authentication and encryption.

## CoAP attacks

* CoAP can be used for amplification (DDoS) attacks (average amplification factor of \~34)
* If DTLS is not enabled, CoAP messages can be intercepted and modified by attackers, compromising the integrity and confidentiality of the data being transmitted.
* If pre-shared keys are used for authentication, attackers can potentially obtain the keys through various means, such as eavesdropping or social engineering.