Subject: Re: [ntpwg] [Ntp] Follow-up to yesterday's mic comment about PTP security

From: "Steve Guendert" <[email-masked]>
Date: Tue, 23 Jul 2019 13:53:31 -0400

Its not so simple and the PTP boat has already left the dock.  When you
have the largest financial institutions in the world, and large government
organizations  doing their own research (PTP vs NTP) , and telling you that
they  no longer want to have NTP as the only option and want to be able to
use PTP, guess what.   You develop the technology and the capabilities
being asked for.

----- Message from Daniel Franke <[email-masked]> on Tue, 23 Jul 2019
12:19:33 -0400 -----
                                                            
      To: NTP WG <[email-masked]>                             
                                                            
 Subject: [Ntp] Follow-up to yesterday's mic comment about  
          PTP security                                      

My comments yesterday about PTP security shifted context a few times
so it may have been hard to follow what I was claiming. My assertions
were:

1. If you need 50ms precision, pick some good public NTP servers and use
NTS.

2. If you need 100µs precision, colocate a time source in the same
datacenter as the client systems. Use NTP and NTS; you don't need PTP
for this.

3. If you need 1µs precision, use PTP and physically secure the link
between the time source and the clients so that cryptographic
authentication is unnecessary.

4. If you need 1µs precision over an adversarial network, good luck!
This is simply not achievable and no amount of cryptographic pixie
dust is ever going to save you.

_______________________________________________
ntp mailing list
[email-masked]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_ntp&d=DwICAg&c=jf_iaSHvJObTbx-siA1ZOg&r=dnqYsHrrVRSypZ48WZIgRYgKABCdVEOsjIfUjPARpGM&m=L5DEVtw3ew_HIJLSbD9dGfs7dQOlwd6undZleLc4UfA&s=5IJqsAZ1c4UK0ng1NTk3uMG1lxar5YzIJ7-O_slcl24&e=

   Regards,                                                                           
                                                                                      
   Steve                                                                              

   Steve Guendert, Ph.D.                                                              
   IBM Z Hardware Systems Architect                                                   
   IBM Z Engineering and Development                                                  
   My  IBM Research Homepage                                                          
                                                                                      
   Member, IBM Academy of Technology                                                  
   Member, Mainframe Hall of Fame                                                     

   Phone: 1-845-433-3664 | Mobile: 1-614-397-2322                                                                             IBM 
   E-mail: [email-masked]                                                                                                 
   Chat:Sametime:  Stephen R (Steve) Guendert                                                                  2455 South Rd Bldg 
   Find me on: LinkedIn: https://www.linkedin.com/in/stephenguendert/ Twitter:                                          707-1-C38 
   https://twitter.com/DrSteveGuendert and within IBM on: IBM Connections:                                       Poughkeepsie, NY 
   https://w3-connections.ibm.com/profiles/html/profileView.do?email=[email-masked]#&tabinst=Updates           12601-5400 
                                                                                                                    United States