Re: [dhcwg] more thoughts about draft-ietf-dhc-sedhcpv6-02.txt

On 25/06/14 13:50, Francis Dupont wrote:
>  In your previous mail you wrote:
> 
>>  > - to document a way for an unsynchronized node to get a good time value,
>>  >  for instance sending an Information-Request or a Solicit without
>>  >  rapid-commit asking for a timestamp option in the ORO
>>  
>>  This has to be a separated document. It remains out of scope for this docume
>>  nt. In most of cases, it is ok to assume a node have a time which has less 5
>>  -min time drift. A brand new node without any knowledge of time is an edge c
>>  ase.
> 
> => to make timestamps more efficient for security you have to allow only
> small drift, so a pre-synchronization procedure should help to solve
> the unsecure/large vs secure/hard-to-implement drift. 
To me it seems that  a pre-synchronisation procedure is a great help for
intruders?

Now you can make sure the target is in time sync with the attack just by
synchronising with it first, really opens the window for attacks.

> Note about the
> first statement I agree it is "not normative".
> 
> Regards
> 
> Francis.Dupont@fdupont.fr
> 
> _______________________________________________
> dhcwg mailing list
> dhcwg@ietf.org
> https://www.ietf.org/mailman/listinfo/dhcwg
> 

-- 
Best regards

Sten Carlsen

No improvements come from shouting:

       "MALE BOVINE MANURE!!!"