Re: [mif] New Charter Items - NTP in RA for DNSSEC

[Margaret Wasserman <[e-mail]>]

On Mar 13, 2016, at 5:26 AM, Markus Stenberg <[e-mail]> wrote:
> NTP RA option would not really fix the solution securely anyway, as secure RA does not really happen. And secure NTP is also something that does not really happen. So there is chicken and egg problem there that is relatively far out of MIF scope I think.

Since we get our information on how to reach the DNS from RAs, getting our NTP information there isn't any less secure than getting our time information somewhere else, and then using to to reach the DNS we received in an RA, is it?

Having NTP information passed in an RA doesn't make RAs more secure, but it does change the threat model of a DNS lookup.  For regular DNS, the attacker only needs to spoof a DNS server (ours or one higher up in the tree), whereas to attack us in the case where we are getting an NTP server in an RA and using DNSSEC, the attacker also needs to be able to inject traffic on our local network that looks like it came form our router.  So, configuring an NTP Server via RAs and using DNSSEC is more secure than just using DNS, even if we can't/don't secure the mechanism via which our DNS and NTP Server are configured.

> IETF being IETF, we cannot specify insecure things these days officially but all base things are insecure and/or undeployed.

The spectre of the intractable security AD who blocks your work until you secure the entire Internet is just a holdover from a less reasonable time, IMO.  With the current ADs, you can generally specify something that is (1) more secure than the alternative, and/or (2) not less secure than what you are replacing.  It sometimes requires that you work with the ADs to help them understand that.

I am really quite sure that the security ADs would not block a new RA option because we didn't figure out how to get the world to deploy SEND.

Margaret