Re: [Ntp] An NTPv5 design sketch

[Miroslav Lichvar <[e-mail]>]

On Tue, Apr 14, 2020 at 10:35:16AM -0400, Daniel Franke wrote:
> You're correct — having just a brief ability to receive traffic at a
> particular IP address allows later amplification of traffic to that
> address until the cookie expires. But the same thing is true of
> practically every other protocol on the internet. Modern UDP-based
> protocols like QUIC implement a similar scheme to this one, with the
> same shortcoming and a much larger amplification factor. Anything
> TCP-based is susceptible as well, if the attacker can learn (or guess)
> the initial SYN value.

I'm not sure if QUIC or TCP is comparable to NTP/NTS. It is not
possible to blindly create a new connection, or replay one, is it?

An existing TCP connection can be exploited only as long as the upper
protocol allows it. For example, is it likely that the attacker would
be able to blindly send requests to its own HTTPS connection
continuously for a week?

-- 
Miroslav Lichvar