Subject: [Ntp] Comments on dratf-ietf-ntp-chronos-02

From: Watson Ladd <[email-masked]>
Date: Fri, 5 Mar 2021 12:12:24 -0800

Dear NTP WG,

One minor editorial comment: would be nice to include the recommended
parameters in the table for ease of readers. I had to go searching to
see them.

This draft seems to imply that the pool is being used. Otherwise the
requerying doesn't produce more servers. Reachability and increased
load on a volunteer shared resource are questions that need to be
addressed. We're happy to handle every device on the internet if it's
well behaved, but most parties in the pool cannot. Gathering can be a
passive DNS based approach, but this runs into potential caching
issues.

I also take issue with the assertion that chronos addresses network
adversaries. Nothing prevents a network adversary from controlling all
packets with dst=123 and shifting the time except authentication.
Chronos only solves byzantine attackers, which authentication of
trusted time servers also does. That's not to say it isn't useful, but
I think the claims are too broad.

Sincerely,
Watson Ladd

-- 
Astra mortemque praestare gradatim

---

From: Neta R S <[email-masked]>
Date: Mon, 8 Mar 2021 23:23:41 +0200

Dear Watson,

Thank you for your feedback.
Please see my comments inline.

Best regards,
Neta

> parameters in the table for ease of readers. I had to go searching to
Thanks, I will include the default parameters in the table in the next
draft.

> passive DNS based approach, but this runs into potential caching
We found that when a client requery the pool once an hour for 24 hours,
hundreds of servers are received.
However, to avoid overloading time servers, we suggest that Chronos will be
used as NTP watchdog with lower frequency compared to NTPv4.

> I think the claims are too broad.
You refer to an attacker that can act as a man in the middle between a
client and any time server.
This is considered as an extremely strong attacker with respect to the
specific client, which we do not consider in this work.
An attacker with  such proximity and control on the client traffic can
probably use more efficient ways to attack it than time shifting.
Nevertheless, we think of authentication as an orthogonal effort for
improving NTP security.

> _______________________________________________
> ntp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ntp
>