Subject: Re: [ntpwg] [Technical Errata Reported] RFC5905 (4505)

From: Sharon Goldberg <[email-masked]>
Date: Tue, 2 Feb 2016 14:10:30 -0500

Hi All,

Sorry for the delayed reaction in joining this conversation.  I do hope
that the RFCs will address this errata as it could lead to security
vulnerabilities.   We do not want packets that should be rejected to be
able to set the state variables, as this could be a very nice vector for
attacks (that circumvent TEST2 (origin timestamp validation)).  We really
want to ensure that TEST2 is robust.

Thanks,
Sharon

Sharon Goldberg
Computer Science, Boston University
http://www.cs.bu.edu/~goldbe

On Fri, Oct 16, 2015 at 8:28 AM, Brian Haberman <[email-masked]>
wrote:

> Hi Miroslav,
>
> On 10/16/15 2:24 AM, Miroslav Lichvar wrote:
> > On Thu, Oct 15, 2015 at 02:49:27PM -0400, Brian Haberman wrote:
> >> NTP'ers,
> >>      I am inclined to Reject this erratum. One, because the appendix is
> >> informative and the body of the RFC takes precedence. Two, the
> >> pseudo-code in the appendix was taken from the reference implementation
> >> at the time of publication, so this looks like a change to the protocol.
> >> Protocol changes are inappropriate for errata.
> >
> > The RFC text doesn't seem to say at what point the authentication
> > should be checked and I'm not sure how could it be a change in the
> > protocol. A packet that fails to authenticate should be ignored.
>
> If the above is the case, the erratum should be fixing the body of the
> RFC and not the appendix.  The appendix is informative and can be
> ignored during implementation.
>
> >
> > It just follows the change that was done in the ntp and chrony
> > implementations to fix the security issue with DoS attack on
> > authenticated symmetric associations. If the example code doesn't have
> > this security issue, perhaps it will prevent others making the same
> > mistake.
> >
>
> So, this sounds like a protocol change.  If that is the case, we need to
> update 5905 through the WG process, not the errata system.
>
> Regards,
> Brian
>
>
> _______________________________________________
> ntpwg mailing list
> [email-masked]
> http://lists.ntp.org/listinfo/ntpwg
>
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg