Re: [Ntp] Antw: Follow-up to yesterday's mic comment about PTP security

"ntp" <ntp-bounces@ietf.org> schrieb am 24.07.2019 08:04:44:

> Von: "Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de>
> An: "Daniel Franke" <dfoxfranke@gmail.com>, "ntp@ietf.org" 
<ntp@ietf.org>
> Datum: 24.07.2019 08:05
> Betreff: [Ntp] Antw: Follow-up to yesterday's mic comment about PTP 
security
> Gesendet von: "ntp" <ntp-bounces@ietf.org>
> 
> >>> Daniel Franke <dfoxfranke@gmail.com> schrieb am 23.07.2019 um 18:19 
in
> Nachricht
> <CAJm83bD89oPE+WouWUD=qVqFzZ5-vw6E3RVsdVRteH0cEXyYjg@mail.gmail.com>:
> > My comments yesterday about PTP security shifted context a few times
> > so it may have been hard to follow what I was claiming. My assertions
> > were:
> > 
> > 1. If you need 50ms precision, pick some good public NTP servers and 
use 
> > NTS.
> 
> Interestingly I think most data centers would like to have 1a: 100µs to 
5ms.
> Are you saying NTS can't do better than a few ms?

Depends on what you need: with NTS, you get a 100% security and 
correctness guarantee for the error in your measured offset being at most 
half of the flight time (plus a negligible delta).
Now, it is very likely that your measured offset is much better than that 
- but the more you're relying on the assumption of symmetric packet travel 
times, the less certainty you get - and the more susceptible you become 
towards delay attacks.
 
> > 
> > 2. If you need 100µs precision, colocate a time source in the same
> > datacenter as the client systems. Use NTP and NTS; you don't need PTP
> > for this.
> > 
> > 3. If you need 1µs precision, use PTP and physically secure the link
> > between the time source and the clients so that cryptographic
> > authentication is unnecessary.
> > 
> > 4. If you need 1µs precision over an adversarial network, good luck!
> > This is simply not achievable and no amount of cryptographic pixie
> > dust is ever going to save you.
> > 
> > _______________________________________________
> > ntp mailing list
> > ntp@ietf.org 
> > https://www.ietf.org/mailman/listinfo/ntp 
> 
> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp