Re: [Ntp] An NTPv5 design sketch

[Daniel Franke <[e-mail]>]

On Tue, Apr 14, 2020 at 7:25 AM Miroslav Lichvar <[e-mail]> wrote:

> If I understand it correctly, the main advantage is that it makes
> exploiting of follow-up messages more difficult. But it doesn't
> prevent amplification attacks completely, right? An attacker who has
> even a brief access to the victim's network, could capture a client
> request asking for a follow-up message, or generate its own request,
> and use this request for an attack until the server rotates the key
> out.

NTS and the scheme for preventing abuse of follow-up messages aren't
particularly closely connected. The NTS cookie provides a convenient
place to hang the network address binding, but if it weren't already
there it would be easy to add a protocol message to acquire it,
following a similar pattern to DTLS's HelloVerifyRequest.

You're correct — having just a brief ability to receive traffic at a
particular IP address allows later amplification of traffic to that
address until the cookie expires. But the same thing is true of
practically every other protocol on the internet. Modern UDP-based
protocols like QUIC implement a similar scheme to this one, with the
same shortcoming and a much larger amplification factor. Anything
TCP-based is susceptible as well, if the attacker can learn (or guess)
the initial SYN value. Basically, I think we're already going
above-and-beyond in terms of anti-amplification measures and such a
very weak attack, with not even a factor-of-2 amplification if it
succeeds, is not one we need to worry about any further.