Re: [Ntp] New Version Notification for draft-gruessing-ntp-ntpv5-requirements-03.txt

[James <[e-mail]>]

Danny,
It turns out DNS does need confidentiality in addition to authentication, because:

* DNSSEC is not universal, and due to broken implementations and operators who don’t bother implementing it fully not everything is covered by it
* It turns out there is a significant market for DNS query data as it allows for passive tracking of individual users and systems. Some of this is good (e.g. intrusion detection in corporate networks), but a lot of it is bad (such as ISPs violating customer’s expectations of privacy by reselling their data)
* AXFR/IXFR related traffic, which if observed in flight could expose inner details of multi-horizon or “hidden master” deployment patterns, or in insecure deployments cause hijacking of zones or records. RFC 9103 addresses some of these risks by using DNS over TLS.

DNS information may be public, but one can’t know the data unless they know what they are looking for. The TLDR Project[1] was a good example of this, and it uncovered details on the DPRK’s public DNS[2] which was previously not fully known. DNSSEC allowing for enumeration of zones was never seen as a neutral or good feature, it is seen as a security issue, which is where NSEC3 came about.

Back to the topic of NTP, I could elaborate further on the threat model in my draft to cover scenarios where confidentiality may be a useful mitigation. However, as has been mentioned by Rich and others in the past the overall trend for internet-facing protocols (which I assume NTPv5 would be) is to provide confidentiality even if optional, in part because of all the details RFC 7624 describes, amongst other guidance we’ve received from the IESG and other reviews for protocols of recent times.

Perhaps you can elaborate why you think confidentiality in NTP is a bad idea?

- J

1: https://github.com/mandatoryprogrammer/TLDR <https://github.com/mandatoryprogrammer/TLDR>
2: https://github.com/mandatoryprogrammer/NorthKoreaDNSLeak <https://github.com/mandatoryprogrammer/NorthKoreaDNSLeak>

> On 15 Oct 2021, at 19:29, Danny Mayer <[e-mail]> wrote:
> 
> 
> On 10/15/21 1:03 PM, Salz, Rich wrote:
>> ➢ Encryption needs to be off the table. It's not just a bad idea, it provides no benefits. Time is not a confidential matter. If you have some use cases for encryption, please state them.
>> 
>> I am not so sure it provides no benefits.  We used to think that DNS was a public repository and that there were no privacy concerns, and it turns out we were wrong.  Sure, time itself is not confidential -- anyone can buy a watch :) -- but the story around the meta-data for time services is not as clear.
>> 
> The reason to do encryption is to make the contents confidential so noone else can know what the contents are. There's nothing in the NTP packet that needs to be hidden from prying eyes. The DNS issue is again not a matter of confidentiality. As a former DNS Developer I can tell you that the issue resolved with DNSSEC was to prevent spoofing. The DNS packet is NOT encrypted, it just has content to prevent spoofing. The Kaminsky attack shows an example of that.
> 
> Danny
> 
>