Subject: [ntpwg] WGLC on draft-ietf-ntp-bcp-02

From: Karen O'Donoghue <[email-masked]>
Date: Sun, 26 Mar 2017 17:05:25 +0000

Folks,

This message begins an NTP WGLC on the following draft:

https://datatracker.ietf.org/doc/html/draft-ietf-ntp-bcp

Please review and comment as soon as possible. This document has been around for a long time, and we need to get it published. There have been suggestions of additional text, but this text has not been forthcoming. If there is some material you feel is important for this first version, please contribute it with your comments.

This is a three week working group last call. Please submit comments to the mailing list by 17 April.

Thank you!
Karen and Dieter

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Daniel Franke <[email-masked]>
Date: Sun, 26 Mar 2017 17:06:41 -0400

Section 5.2 Autokey contains several false or at least gravely
misleading statements.

> Autokey was designed in 2003 to provide a means for clients to
> authenticate servers.  By 2011, security researchers had identified
> computational areas in the Autokey protocol that, while secure at the
> time of its original design, were no longer secure.

Autokey was never secure. The attacks discovered in 2011 were already
readily tractable on 2003-era hardware, and do not depend on any sort
of theoretical advances which occured in the interim. I.e., if
Roettger were eight years older and had gone to grad school in 2003, I
think he could have come up with this attack just as easily.

> It is recommended that Autokey not be used.  Know that as of the fall
> of 2011, a common(?) laptop computer could crack the security cookie
> used in the Autokey protocol in 30 minutes' time.  If you want to use
> Autokey, know that your session keys should be set to expire in under
> 30 minutes' time.

Where does this 30 minute estimate come from? The computational cost
of attacking an autokey association is that of 2**32 short-message MD5
computations. Going by
https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40, one
Nvidia GTX 1080 GPU can perform about 25 billion MD5 computations per
second, leading to a break in maximum of 172ms; the average time would
be half this (86ms). In other words, an adversary with $500 in
hardware resources can break your association before you've even
finished the handshake.

Even if the 30 minute estimate were accurate, the advice to expire
session keys after 30 minutes would still be nonsensical because the
attack is trivially parallelizable. If one 2011 laptop can break an
association in 30 minutes, then 30 of them can break it in one minute.

> If you have reason to believe your autokey-protected associations
> will be attacked, you should read https://lists.ntp.org/pipermail/
> ntpwg/2011-August/001714.html and decide what resources your
> attackers might be using, and adjust the session key expiration time
> accordingly.

What is the relevance of the clause "If you have reason to believe
your autokey-protected associations will be attacked"? If you're
somehow certain that it *won't* be attacked (you're running NTP over a
LAN located in a remote wilderness cabin with no outside connectivity)
then there is no reason to use Autokey at all. In all other
situations, there is *also* no reason to use Autokey, because it won't
protect you.

I propose that this section be replaced with the following language:

Autokey was designed in 2003 to provide a means for clients to
authenticate servers.  However, by 2011, security researchers had
identified grave vulnerabilities leading to a complete break of the
protocol in real time on commodity hardware [add appropriate
citation]. It is recommended that Autokey not be used.

Other issues: several sections of this document reference ntp.conf
configuration directive, which are implementation-specific and not
described by any standard. I question the appropriateness of this;
such advice seems better placed in ntpd documentation than in an IETF
document.

The document also contains numerous references to Wikipedia and other
volatile URLs, which I'm pretty sure is contrary to IETF policy. Can
these be replaced with more durable citations?

The issues with the Autokey section are sufficiently severe that I
cannot support advancing this draft to the IESG in its current form.
If my recommended language is substituted then I will have no
objection to advancement, notwithstanding the other issues I've
raised.
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Sharon Goldberg <[email-masked]>
Date: Sun, 26 Mar 2017 17:19:09 -0400

I agree with Daniel regarding the autokey language.

Sharon

On Sunday, March 26, 2017, Daniel Franke <[email-masked]> wrote:

> [email-masked] <javascript:;>

-- 
Sharon Goldberg
Computer Science, Boston University
http://www.cs.bu.edu/~goldbe
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Daniel Franke <[email-masked]>
Date: Mon, 27 Mar 2017 13:56:12 -0400

> these be replaced with more durable citations?

I just chatted with some of the folks at the RFC Editor desk about
this point. The gist of the conversation was that the most important
thing about URLs cited in RFCs is that they stable and have static
content. The citations to Wikipedia can stay, but the links should
point to a particular revision, not to the current one. In my
judgement (i.e., I am not speaking for the RFC Editor on this), the
links to ntp.org download page and bitkeeper repo should probably go
away, since the former is a dynamic page and the latter is likely to
change (I'm assuming that NTF is not committing to remaining on
Bitkeeper indefinitely). The link to bcp38.info seems unnecessary;
just citing the RFC should be sufficient.
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: "Ulrich Windl" <[email-masked]>
Date: Tue, 28 Mar 2017 08:17:56 +0200

>>> Daniel Franke <[email-masked]> schrieb am 27.03.2017 um 19:56 in
Nachricht
> point to a particular revision, not to the current one. In my

AFAIK Wikipedia has ist own proposals for citing. And even for static pages it's advisable to include the date of retrieval.

---

From: Denis Reilly <[email-masked]>
Date: Tue, 28 Mar 2017 12:29:55 +0000

Daniel,

You make good points on Autokey, and I like your wording better than what is currently in the document, so we'll incorporate it (or something similar to it) in the next revision.

I can look for more stable URL's if sources like Wikipedia will cause a problem, so you can expect to see changes there, too. If anyone has particular suggestions for better citations, please contribute!

I believe we've discussed the document's references to ntpd and ntp.conf before. I think it's more acceptable to reference implementation-specific things in a BCP than in any other IETF document -- lots of people in the community are using it, after all, and the document is a reflection of the current state of the community. Also, most of the submissions we've had so far are from people familiar with ntpd. We're happy to take submissions specific to other implementations if there are any practices that are worthwhile to share.

Thank you!

--
Denis Reilly  |  Lead Engineer  |  [email-masked]  (585)321-5837

This e-mail and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you received this e-mail in error please note that any use, dissemination, forwarding, printing, or copying of this e-mail is strictly prohibited.

-----Original Message-----
From: ntpwg [mailto:ntpwg-bounces+denis.reilly=[email-masked]] On Behalf Of Daniel Franke
Sent: Sunday, March 26, 2017 5:07 PM
To: [email-masked]
Subject: Re: [ntpwg] WGLC on draft-ietf-ntp-bcp-02

Section 5.2 Autokey contains several false or at least gravely misleading statements.

> time of its original design, were no longer secure.

Autokey was never secure. The attacks discovered in 2011 were already readily tractable on 2003-era hardware, and do not depend on any sort of theoretical advances which occured in the interim. I.e., if Roettger were eight years older and had gone to grad school in 2003, I think he could have come up with this attack just as easily.

> Autokey, know that your session keys should be set to expire in under

Where does this 30 minute estimate come from? The computational cost of attacking an autokey association is that of 2**32 short-message MD5 computations. Going by https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40, one Nvidia GTX 1080 GPU can perform about 25 billion MD5 computations per second, leading to a break in maximum of 172ms; the average time would be half this (86ms). In other words, an adversary with $500 in hardware resources can break your association before you've even finished the handshake.

Even if the 30 minute estimate were accurate, the advice to expire session keys after 30 minutes would still be nonsensical because the attack is trivially parallelizable. If one 2011 laptop can break an association in 30 minutes, then 30 of them can break it in one minute.

> If you have reason to believe your autokey-protected associations will 
> be attacked, you should read https://lists.ntp.org/pipermail/ 
> ntpwg/2011-August/001714.html and decide what resources your attackers 
> might be using, and adjust the session key expiration time 
> accordingly.

What is the relevance of the clause "If you have reason to believe your autokey-protected associations will be attacked"? If you're somehow certain that it *won't* be attacked (you're running NTP over a LAN located in a remote wilderness cabin with no outside connectivity) then there is no reason to use Autokey at all. In all other situations, there is *also* no reason to use Autokey, because it won't protect you.

Autokey was designed in 2003 to provide a means for clients to authenticate servers.  However, by 2011, security researchers had identified grave vulnerabilities leading to a complete break of the protocol in real time on commodity hardware [add appropriate citation]. It is recommended that Autokey not be used.

Other issues: several sections of this document reference ntp.conf configuration directive, which are implementation-specific and not described by any standard. I question the appropriateness of this; such advice seems better placed in ntpd documentation than in an IETF document.

The document also contains numerous references to Wikipedia and other volatile URLs, which I'm pretty sure is contrary to IETF policy. Can these be replaced with more durable citations?

The issues with the Autokey section are sufficiently severe that I cannot support advancing this draft to the IESG in its current form.
If my recommended language is substituted then I will have no objection to advancement, notwithstanding the other issues I've raised.
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Daniel Franke <[email-masked]>
Date: Tue, 28 Mar 2017 10:57:06 -0400

On 3/28/17, Denis Reilly <[email-masked]> wrote:
> I can look for more stable URL's if sources like Wikipedia will cause a
> problem, so you can expect to see changes there, too. If anyone has
> particular suggestions for better citations, please contribute!

I'll see what I can dig up and send suggested text changes.

> I believe we've discussed the document's references to ntpd and ntp.conf
> before. I think it's more acceptable to reference implementation-specific
> things in a BCP than in any other IETF document -- lots of people in the
> community are using it, after all, and the document is a reflection of the
> current state of the community. Also, most of the submissions we've had so
> far are from people familiar with ntpd. We're happy to take submissions
> specific to other implementations if there are any practices that are
> worthwhile to share.

My feelings on the ntp.conf references are more along the lines of
"this doesn't seem right" than "this is wrong". Karen/Dieter, might I
suggest requesting an early review from GEN-ART?
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Karen O'Donoghue <[email-masked]>
Date: Wed, 29 Mar 2017 03:36:23 +0000

> On Mar 28, 2017, at 9:57 AM, Daniel Franke <[email-masked]> wrote:
> 

For the record, I have requested an early GEN-ART review. 

Karen

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 29 Mar 2017 08:59:33 -0500

All,

I have some feeling (that I have expressed with a few of you during the last few meetings) that parts of Section 4 of the BCP draft  could use some more specific description and wording. In particular i am working on clarifying and strengthening sections 4.1 and 4.2. I will submit my recommended text updates in the next few days. I don’t want to just make general suggestions but put forth alternate text for consideration. I know we are up to the deadline so I will get those out this week.

Rob

Robert Nagy
CEO and Senior DiveMaster
c:  408.480.5133
[email-masked]
www.deepdivenetworking.com

> On Mar 28, 2017, at 10:36 PM, Karen O'Donoghue <[email-masked]> wrote:
> 
>