Subject: Re: [ntpwg] [Technical Errata Reported] RFC5905 (4505)

From: Brian Haberman <[email-masked]>
Date: Thu, 15 Oct 2015 14:49:27 -0400

NTP'ers,
     I am inclined to Reject this erratum. One, because the appendix is
informative and the body of the RFC takes precedence. Two, the
pseudo-code in the appendix was taken from the reference implementation
at the time of publication, so this looks like a change to the protocol.
Protocol changes are inappropriate for errata.

Thoughts?

Regards,
Brian

On 10/15/15 10:23 AM, RFC Errata System wrote:
> The following errata report has been submitted for RFC5905,
> "Network Time Protocol Version 4: Protocol and Algorithms Specification".
> 
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=5905&eid=4505
> 
> --------------------------------------
> Type: Technical
> Reported by: Miroslav Lichvar <[email-masked]>
> 
> Section: A.5.1
> 
> Original Text
> -------------
>         /*
>          * Update the origin and destination timestamps.  If
>          * unsynchronized or bogus, abandon ship.
>          */
>         p->org = r->xmt;
>         p->rec = r->dst;
>         if (!synch)
>                 return;                 /* unsynch */
> 
>         /*
>          * The timestamps are valid and the receive packet matches the
>          * last one sent.  If the packet is a crypto-NAK, the server
>          * might have just changed keys.  We demobilize the association
>          * and wait for better times.
>          */
>         if (auth == A_CRYPTO) {
>                 clear(p, X_CRYPTO);
>                 return;                 /* crypto-NAK */
>         }
> 
>         /*
>          * If the association is authenticated, the key ID is nonzero
>          * and received packets must be authenticated.  This is designed
>          * to avoid a bait-and-switch attack, which was possible in past
>          * versions.
>          */
>         if (!AUTH(p->keyid || (p->flags & P_NOTRUST), auth))
>                 return;                 /* bad auth */
> 
> 
> Corrected Text
> --------------
>         /*
>          * If the packet is a valid crypto-NAK, the server might have
>          * just changed keys.  We demobilize the association and wait
>          * for better times.
>          */
>         if (synch && auth == A_CRYPTO) {
>                 clear(p, X_CRYPTO);
>                 return;                 /* crypto-NAK */
>         }
> 
>         /*
>          * If the association is authenticated, the key ID is nonzero
>          * and received packets must be authenticated.  This is designed
>          * to avoid a bait-and-switch attack, which was possible in past
>          * versions.
>          */
>         if (!AUTH(p->keyid || (p->flags & P_NOTRUST), auth))
>                 return;                 /* bad auth */
> 
>         /*
>          * Update the origin and destination timestamps.  If
>          * unsynchronized or bogus, abandon ship.
>          */
>         p->org = r->xmt;
>         p->rec = r->dst;
>         if (!synch)
>                 return;                 /* unsynch */
> 
> 
> Notes
> -----
> The state variables must be updated after the authentication is checked in order to prevent DoS attacks on authenticated symmetric associations (CVE-2015-1799).
> 
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party (IESG)
> can log in to change the status and edit the report, if necessary. 
> 
> --------------------------------------
> RFC5905 (draft-ietf-ntp-ntpv4-proto-13)
> --------------------------------------
> Title               : Network Time Protocol Version 4: Protocol and Algorithms Specification
> Publication Date    : June 2010
> Author(s)           : D. Mills, J. Martin, Ed., J. Burbank, W. Kasch
> Category            : PROPOSED STANDARD
> Source              : Network Time Protocol
> Area                : Internet
> Stream              : IETF
> Verifying Party     : IESG
> 

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: RFC Errata System <[email-masked]>
Date: Thu, 15 Oct 2015 07:23:44 -0700 (PDT)

Section: A.5.1

Original Text
-------------
        /*

        /*

        /*

Corrected Text
--------------
        /*

        /*

        /*

Notes
-----

Instructions:
-------------

---

From: Miroslav Lichvar <[email-masked]>
Date: Fri, 16 Oct 2015 08:24:57 +0200

> Protocol changes are inappropriate for errata.

The RFC text doesn't seem to say at what point the authentication
should be checked and I'm not sure how could it be a change in the
protocol. A packet that fails to authenticate should be ignored.

It just follows the change that was done in the ntp and chrony
implementations to fix the security issue with DoS attack on
authenticated symmetric associations. If the example code doesn't have
this security issue, perhaps it will prevent others making the same
mistake.

-- 
Miroslav Lichvar

---

From: Brian Haberman <[email-masked]>
Date: Fri, 16 Oct 2015 08:28:10 -0400

Hi Miroslav,

> protocol. A packet that fails to authenticate should be ignored.

If the above is the case, the erratum should be fixing the body of the
RFC and not the appendix.  The appendix is informative and can be
ignored during implementation.

> this security issue, perhaps it will prevent others making the same

So, this sounds like a protocol change.  If that is the case, we need to
update 5905 through the WG process, not the errata system.

Regards,
Brian