Re: [Ntp] Antw: Re: Antw: Re: New rev of the NTP port randomization I-D (Fwd: New Version Notification for draft-gont-ntp-port-randomization-01.txt)

On 5/29/2019 3:13 AM, Ulrich Windl wrote:
>>>> Harlan Stenn <stenn@nwtime.org> schrieb am 29.05.2019 um 12:02 in Nachricht
> <92e2c1f9-a745-c182-6194-c7ce819c8a3c@nwtime.org>:
> 
> 
> [...]
>> That also assumes the client has the correct time.  If somebody is using
>> SNTP, this assumption may be wrong, and the client's time could well be
>> off by much more.  At 33 bits, we're talking about 2 seconds.  If the
>> client might be off by 4-8 minutes then we're talking about 41 bits.
> 
> Do you really think someone planning to attack NTP will start with a clock that is  minutes off the correct time?

An SNTP client, certainly.

But even one that is off by seconds still adds random bits.

And if the client doesn't care if the server can see its time, the
origin timestamp could be completely random.

>>>>
>>>> And remember that:
>>>>
>>>> - the window of time where an attack is possible starts when the client
>>>>   sends its request, and ends when a valid response is received.
>>>
>>> An attacker will probably "spray" attacking packets.
>>
>> OK, so what?  Low end normal machines might handle 2k packets/second,
>> and low end slow machines are lucky to be able to handle 200 packets per
>> second.
> 
> It there a difference between the client being overloaded with attack packets that are "wrong" or attack packets that are "correct"? I was arguing that "enough packets" could easily be created, while you argue the client can't handle them.

Yes.  A correct packet that is correct will satisfy SNTP, and will close
the loopback test gate for NTP.  In the latter case, any further
received packets will be logged, and if they contain a bad MAC will
cause the transmission of a CRYPTO-NAK.

>>>> - a competent client will log bogus responses, at least during this
>>>>   window, and if the client is NTP as opposed to SNTP, will log
>>>>   *any* bogus received packets.
>>>
>>> The point is whether logging unexpected packets actually opens a DoS 
>> windows.
>>
>> That's something logging systems can reasonably be expected to handle,
>> and it's also reasonable to assume that if somebody goes to the trouble
>> to log these events they're also alerting on them.
> 
> Yeah: Filesystem full ;-)

If one does a poor job of managing log files, yes.

"Blessed are those who get what they deserve."

"Live and learn."

These possibilities have been understood for decades, and there are
known ways to address them.

> [...]
> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp
> 

-- 
Harlan Stenn, Network Time Foundation
http://nwtime.org - be a Member!