Re: [Ntp] WGLC for draft-ietf-ntp-mac

Paul Gear <ntp@libertysys.com.au> Thu, 10 August 2017 23:29 UTC

Return-Path: <ntp@libertysys.com.au>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6F391326E1 for <ntp@ietfa.amsl.com>; Thu, 10 Aug 2017 16:29:23 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=libertysys.com.au
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Vr2dkIJRcf3 for <ntp@ietfa.amsl.com>; Thu, 10 Aug 2017 16:29:22 -0700 (PDT)
Received: from mail.libertysys.com.au (ppp178-79.static.internode.on.net [150.101.178.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB51A126BFD for <ntp@ietf.org>; Thu, 10 Aug 2017 16:29:21 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1]) by mail.libertysys.com.au (Postfix) with ESMTP id F035D92489 for <ntp@ietf.org>; Fri, 11 Aug 2017 09:29:18 +1000 (AEST)
X-Virus-Scanned: Debian amavisd-new at mail2.gear.dyndns.org
Received: from mail.libertysys.com.au ([127.0.0.1]) by localhost (mail.gear.dyndns.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LBh_owwgwJkO for <ntp@ietf.org>; Fri, 11 Aug 2017 09:29:12 +1000 (AEST)
Received: from [172.22.64.102] (eber-home.gear.dyndns.org [172.22.64.102]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.libertysys.com.au (Postfix) with ESMTPSA id 202C19207F for <ntp@ietf.org>; Fri, 11 Aug 2017 09:29:12 +1000 (AEST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=libertysys.com.au; s=2016; t=1502407752; bh=xVUblCFwRR/w0NQixZlag+FdB50tG5FLZBZpdjUAbIA=; h=Subject:To:References:From:Date:In-Reply-To; b=CSemL7D3soW8UmlvPe1ZBKVMkKXFhctlbYfo5rj5CPlC+xSlJgKddiVXWvuaOi/Cs 7zqxQhEgWraQzg7rLPKMMknrzwtj2LFgt2PAX1QTJaQ3CGem8QLX2+zs35RkVDKkr3 TMFS6E5EvrRN+3cVSOmOqExAZyOMdfw9JmxC5IXI=
To: ntp@ietf.org
References: <CF57EAFE-31F0-4ADD-A209-1802DB6CA643@isoc.org>
From: Paul Gear <ntp@libertysys.com.au>
Message-ID: <9d4f0475-89f7-d4c7-a8aa-787678c0a0e2@libertysys.com.au>
Date: Fri, 11 Aug 2017 09:29:11 +1000
MIME-Version: 1.0
In-Reply-To: <CF57EAFE-31F0-4ADD-A209-1802DB6CA643@isoc.org>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
Content-Language: en-AU
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/GwNpfyq_mXDZnibQIO_jcMtkysQ>
Subject: Re: [Ntp] WGLC for draft-ietf-ntp-mac
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 10 Aug 2017 23:29:24 -0000

On 09/08/17 14:53, Karen O'Donoghue wrote:
> Folks,
>
> This begins a three week working group last call (WGLC) for "Message
> Authentication Code for the Network Time Protocol"
> https://datatracker.ietf.org/doc/draft-ietf-ntp-mac/
>
> Please review and provide comments to the mailing list by no later
> than 31 August 2017. Earlier comments and discussion would be
> appreciated. Please note that the chairs will be using this WGLC to
> determine consensus to move this document forward to the IESG.

Hi everyone,

(Apologies in advance if this isn't an appropriate forum for these
questions - please redirect me if this is the case.)

I'm trying to get a handle on this draft so I can intelligently answer
questions about it next month at AusNOG, and I'm wondering if someone
can comment on the on-the-wire implications for NTP implementations.  As
I understand it, there are no proposed changes to the protocol's wire
format under this draft, rather a simple substitution of the 128-bit MD5
field for a 128-bit AES-CMAC field.

How then would an implementation distinguish between MACs in the two
formats?  Is there an implicit assumption that if this draft is
accepted, it will be rolled into a new protocol version specification
for NTPv5, in which case any NTPv4 packet would be MD5, and any NTPv5
packet would be AES-CMAC?

As a secondary issue, are there any working implementations of this
change, and if so any benchmarks showing the effect (if any) of the change?

Thanks,
Paul