Re: [Ntp] [Tsv-art] Tsvart early review of draft-ietf-ntp-alternative-port-02

[Hal Murray <[e-mail]>]

[e-mail] said:
> FWIW, I don't see this assignment as appropriate. 

Without a new port, it will be close to impossible to widely deploy NTP 
security.


Years ago (2013), NTP was used in a giant DDoS attack.  That was due to a 
bug/oversight that had been around since the early NTP work.  (I've tracked it 
back to 1989.)
  https://www.spamhaus.org/news/article/695/answers-about-recent-ddos
  https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification
The Wikipedia chart could use another column -- the number of sites available. 
 Almost all Linux or *BSD sites were running ntpd.

The fix was trivial, but there are many essentially unattended sites running 
old versions of ntpd that will never get fixed.

Many many many sites have quietly installed filters in their routers.  Set and 
forget.

A typical filter drops UDP traffic to port 123 with a length other than 48.  
That lets old unauthenticated NTP through but authenticated packets are longer 
and get dropped.

To use authentication on the existing port would require removing those 
filters.  Even if you could track down the right people, they would probably 
drag their feet until most of the sites running old unattended ntpd were fixed.

An alternative would be to implement BCP 38.  How long has that been in 
progress?

-- 
These are my opinions.  I hate spam.