Subject: Re: [Ntp] Roughtime and Delay Attacks

From: Hal Murray <[email-masked]>
Date: Wed, 03 Apr 2019 00:22:55 -0700

[email-masked] said:
> Roughtime deliberately looks at the associations to single server and  tries
> to judge whether (and potentially prove that) each single given  server is
> showing signs of malfeasance. 

You can't do that unless you know your local time is accurate.  You probably 
need to know how accurate.

Even if you have something like GPS, you need to be suspicious of it.  There 
have been many firmware bugs, and a 1024 week rollover is coming up this 
weekend.

-- 
These are my opinions.  I hate spam.

---

From: [email-masked]
Date: Wed, 3 Apr 2019 10:03:56 +0200

Perhaps I should have been more precise in my description.
Roughtime does look at associations with many different servers, and from 
that tries to find the "outliers" that suggest server malfeasance.
Its criterion for ruling "server X is bad" is not discrepancy with the 
client's local time, but examples where timestamps from one server visibly 
don't fit into the same timing context with timestamps from a majority of 
other servers.
Specifically, it does not have to rely on local time.

But I think all that is pretty far beside the point (the point being that 
the models of Chronos and Roughtime don't fit together well enough to 
transfer techniques against delay attacks from Chronos to Roughtime in a 
helpful way), don't you?

Best regards,
Kristof

Von:    "Hal Murray" <[email-masked]>
An:     [email-masked]
Kopie:  "Hal Murray" <[email-masked]>
Datum:  03.04.2019 09:23
Betreff:        Re: [Ntp] Roughtime and Delay Attacks
Gesendet von:   "ntp" <[email-masked]>

> showing signs of malfeasance. 

You can't do that unless you know your local time is accurate.  You 
probably 
need to know how accurate.

Even if you have something like GPS, you need to be suspicious of it. 
There 
have been many firmware bugs, and a 1024 week rollover is coming up this 
weekend.

_______________________________________________
ntp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ntp

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 4 Apr 2019 10:00:05 +0100

Sorry I am struggling to understand how the protection works.

If C (who has just woken) sends a request to S, then all C knows is that 
T ~ Ts - 1/2 RTT. C can know that it was S that replied, but C cannot 
possibly know if S was lying or if an on-path router delayed the packet.

C can keep asking S, and within the limits of the server delay and the 
variation in the routing path and queuing delays RTT stay sort of 
constant, so C can be suspicious if it changes after it has been running 
or if Ts - 1/2 RTT changes by more than the known drift in its local 
clock. However routing paths do change and there are traffic congestion 
delays in networks.

C can ask S', S'' etc and build up a picture of various servers time, 
but it has to be careful that the paths are disjoint and that S, S' and 
S'' have truly independent and authoritative master clocks.

On the other hand, if the routers are compromised, then there are much 
worse things that can do, so we normally assume that they are truthful.

So how does this design do better than "T ~ Ts - 1/2 RTT assuming S did 
not lie and also was not simply wrong"?

- Stewart

---

From: Watson Ladd <[email-masked]>
Date: Thu, 4 Apr 2019 09:55:16 -0700

> possibly know if S was lying or if an on-path router delayed the packet.

Correct.

> not lie and also was not simply wrong"?

It doesn't. But this is fine. RTTs can be seconds, not hours.

---

From: <[email-masked]>
Date: Thu, 4 Apr 2019 19:16:40 +0000

Actually, T ~ Ts - RTT.  Asymmetry could be up to 99+% in malicious or broken environment.

Greg Dowd
Principal Engineering Technologist, FTD
Microsemi 
3870 N. First St. | San Jose | CA 95134 | USA
Office: 408.964.7643
Email: [email-masked]
Company Website:  www.microsemi.com

-----Original Message-----
From: ntp [mailto:[email-masked]] On Behalf Of Watson Ladd
Sent: Thursday, April 4, 2019 9:55 AM
To: Stewart Bryant <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ntp] Roughtime and Delay Attacks

External E-Mail

On Thu, Apr 4, 2019 at 2:00 AM Stewart Bryant <[email-masked]> wrote:
> If C (who has just woken) sends a request to S, then all C knows is 
> that T ~ Ts - 1/2 RTT. C can know that it was S that replied, but C 
> cannot possibly know if S was lying or if an on-path router delayed the packet.

Correct.

> constant, so C can be suspicious if it changes after it has been 
> running or if Ts - 1/2 RTT changes by more than the known drift in its 
> local clock. However routing paths do change and there are traffic 
> congestion delays in networks.
>
> but it has to be careful that the paths are disjoint and that S, S' 
> and S'' have truly independent and authoritative master clocks.
>
> So how does this design do better than "T ~ Ts - 1/2 RTT assuming S 
> did not lie and also was not simply wrong"?

---

From: Joachim Fabini <[email-masked]>
Date: Thu, 4 Apr 2019 23:15:52 +0200

As a side note: the paper on delay attacks and possible constraints that
triggered this discussion is currently under review for a journal. Its
pre-print can be downloaded from arxiv.org
(https://arxiv.org/abs/1811.08569 ) and may support in identifying
challenges and solutions in guaranteed clock synchronization accuracy.

Joachim

---

From: Stewart Bryant <[email-masked]>
Date: Tue, 9 Apr 2019 19:08:54 +0100

Right, that is all you know.

Rather than develop a whole new protocol couldn't we just carry SNTP 
over an encrypted channel and get the same benefit?

- Stewart