Subject: Re: [Ntp] NTP pool and NTS brainstorming

From: Hal Murray <[email-masked]>
Date: Sun, 01 Mar 2020 20:43:12 -0800

[email-masked] said:
> You are right that NTS does not extend any trust to the servers in a pool,
> but NTS still makes sense in that application. This is mainly because it
> provides protection against MITM attacks. They are quite common in practice,
> since many ISPs MITM all NTP traffic from their networks. 

Why would an ISP MITM all NTP traffic?

Last I knew, most ISPs didn't even offer NTP servers for their customers.  I 
admit to not having any data to back that up.  Should we conduct a quick 
informal survey?  If ISPs did offer even half-way decent NTP service we 
wouldn't need the pool.

-- 
These are my opinions.  I hate spam.

---

From: Thomas Peterson <[email-masked]>
Date: Mon, 2 Mar 2020 08:25:58 +0000

In my observations ISPs that offer or mandate their own CPE do have NTP 
services, however that is not necessarily a prerequisite. For the 
largest UK ISPs representing ~80% market share, the following NTP 
services exist:

* Virgin Media: ntp.virginmedia.com
* Sky: ntp[1|2].isp.sky.com
* TalkTalk: [0-2].ntp.talktalk.net
* BT: ntp-gss.vision.bt.com

Perhaps other markets differ.

Regards

---

From: Marcus Dansarie <[email-masked]>
Date: Mon, 2 Mar 2020 20:57:08 +0100

> Why would an ISP MITM all NTP traffic?

I have no idea why any sane ISP would do that. Yet, it happens. Steven
Sommars' presentaton at PTTI 2016 [1] gave some examples of this. (It is
because of that presentation that Ragnar and I started talking about NTP
security.)

Kind regards,
Marcus

[1] S. E. Sommars, “Challenges in Time Transfer using the Network Time
Protocol (NTP),” in Proceedings of the Annual Precise Time and Time
Interval Systems and Applications Meeting, PTTI, 2017, pp. 271–290, doi:
10.33012/2017.14978.

---

From: Watson Ladd <[email-masked]>
Date: Mon, 2 Mar 2020 12:17:42 -0800

> * BT: ntp-gss.vision.bt.com

Unfortunately there doesn't seem to be a way for the ISPs to advertise
these servers to their customers via DHCP the NTP server. This would
significantly help by enabling OS configurations to use those
services.

It's also worth noting that aggressive policing of NTP and dropping of
extra length packets takes place to protect ISP networks from the
traffic in a major amplification attack. While not MITM in sensu
stricto, it nevertheless interferes with NTP operations.

> _______________________________________________
> ntp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ntp

---

From: Thomas Peterson <[email-masked]>
Date: Mon, 2 Mar 2020 22:08:31 +0000

Option 42 in DHCPv4 refers to NTPv3, and RFC 5908 describes DHCPv6 options
for NTPv4. Given that many OS vendors have opted for making their own
hosting arrangements (e.g. time.apple.com, NTP Pool vendor zones, etc) I
suspect very few consumer-level devices would support it, and that the
hosts I previously mentioned serve ISPs own hardware first, and minority
customers who understand NTP only incidentally.

I think the DHCP horse has already bolted.

Regards

---

From: "Patrik Fältström" <[email-masked]>
Date: Tue, 03 Mar 2020 08:01:37 +0100

Regardless, DHCP is the mechanism to use NTP server is provisioned. Whether people use it or not is a different matter.

What we talk about here is that computers here and there (Apple is one example) is not checking that DHCP option. That we should try to change. With NTS and a cleaner pool, I think we can get that to happen. The interest in our work in the world is increasing.

I am not giving up.

   Patrik

On 2 Mar 2020, at 23:08, Thomas Peterson wrote:

> Option 42 in DHCPv4 refers to NTPv3, and RFC 5908 describes DHCPv6 options for NTPv4. Given that many OS vendors have opted for making their own hosting arrangements (e.g. time.apple.com, NTP Pool vendor zones, etc) I suspect very few consumer-level devices would support it, and that the hosts I previously mentioned serve ISPs own hardware first, and minority customers who understand NTP only incidentally.
>

---

From: Erik Kline <[email-masked]>
Date: Mon, 2 Mar 2020 23:13:03 -0800

<random>
At some point further down the road (much further, perhaps), their could be
an "ntpServers" key (or something) added to the provisioning domains
information (which at least mobile OSes are interested in watching).
That's some time away still, though.
</random>

On Mon, Mar 2, 2020 at 11:01 PM Patrik Fältström <paf=
[email-masked]> wrote:

> Regardless, DHCP is the mechanism to use NTP server is provisioned.
> Whether people use it or not is a different matter.
>
> What we talk about here is that computers here and there (Apple is one
> example) is not checking that DHCP option. That we should try to change.
> With NTS and a cleaner pool, I think we can get that to happen. The
> interest in our work in the world is increasing.
>
> I am not giving up.
>
>    Patrik
>
> > Option 42 in DHCPv4 refers to NTPv3, and RFC 5908 describes DHCPv6
> options for NTPv4. Given that many OS vendors have opted for making their
> own hosting arrangements (e.g. time.apple.com, NTP Pool vendor zones,
> etc) I suspect very few consumer-level devices would support it, and that
> the hosts I previously mentioned serve ISPs own hardware first, and
> minority customers who understand NTP only incidentally.
> >
> >> On Mon, Mar 2, 2020, 12:26 AM Thomas Peterson <
> [email-masked]>
> >> wrote:
> >>>