Re: [ntpwg] The next step of draft-ietf-ntp-checksum-trailer

[Harlan Stenn <[e-mail]>]

Hi Dieter,

[e-mail] writes:
> "ntpwg" <ntpwg-bounces+dieter.sibold=[e-mail]> schrieb am 
> 07.03.2016 14:16:25:
> 
> > Von: Miroslav Lichvar <[e-mail]>
> > An: Harlan Stenn <[e-mail]>
> > Kopie: "'[e-mail]'" <[e-mail]>, "Karen 
> > ODonoghue \([e-mail]\)" <[e-mail]>, Suresh 
> > Krishnan <[e-mail]>
> > Datum: 07.03.2016 14:40
> > Betreff: Re: [ntpwg] The next step of draft-ietf-ntp-checksum-trailer
> > Gesendet von: "ntpwg" <ntpwg-bounces+dieter.sibold=[e-mail]>
> > 
> > On Mon, Mar 07, 2016 at 12:35:56PM +0000, Harlan Stenn wrote:
> > > Originally, if there was an extension field there MUST be a MAC.
> > 
> > Right. That requirement was not necessary and it was later removed.

The above claim has not yet been proven.

> > > Tal wrrote Errata 3627 (or whatever) and removed that requirement.
> > 
> > Yes, but why is that a problem?

The above is under discussion.

> > > MAC protection is good.  NTS uses a 'single' Field Type, but the first
> > > few packets have no MAC protection.  Therefore, the first few packets 
> of
> > > an NTS exchange arguably MUST have MAC protection outside the NTS
> > > packet
> > 
> > With what key would that MAC be generated? Unless I misunderstood how
> > NTS is supposed to work, the first few packets are simply not
> > authenticated and can't be used for anything except initialization of
> > the NTS association.

Answered in a separate email - symmetric key is AVAILABLE for this.
Doing this is a MAY/SHOULD.  Not a MUST.

> Harlan, I do not agree that you need to protect the association and key 
> exchange of NTS. The goal of the first exchanged messages of NTS is to 
> securely authenticate the server and exchange the cookie. And yes, tough 
> these messages are piggybacked on NTP messages, they do not protect NTP's 
> time stamps. However the NTS messages in itself and especially the cookie 
> exchange message are cryptographically protected. A client has the choice 
> to trust or not to trust the time stamps exchanged during the association 
> and cookie exchange.  After the cookie is being exchanged all following 
> time requests and responses are of course protected by a MAC. So, a client 
> always has the option only to trust the authenticated time stamps. I don't 
> see that anyone want to distribute manually symmetric keys only for the 
> purpose to protect the first three message exchanges of NTS. And if you 
> are in a situation in which you can exchange symmetric keys with your 
> customers you don't need to apply NTS. But in most cases, distribution of 
> symmetric keys are realistically not an option.

Correct.  I am not saying MUST.

Are you saying that each of these 6 initial packets MUST NOT be
protected by any sort of MAC?

H
_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg