Re: [Ntp] New rev of the NTP port randomization I-D (Fwd: New Version Notification for draft-gont-ntp-port-randomization-01.txt)

[Fernando Gont <[e-mail]>]

On 4/6/19 12:47, Harlan Stenn wrote:
> 
> 
> On 6/3/2019 11:37 PM, Fernando Gont wrote:
>> On 29/5/19 21:58, Fernando Gont wrote:
>>> Harlan,
>>>
>>> Responding this one in a separate email, since it seems we're converging
>>> on something...
>>>
>>> On 29/5/19 13:15, Harlan Stenn wrote:
>>>>
>>> [....]>> Using randomized port numbers requires yet additional effort on
>>> the side
>>>>> of the attacker. And means that the attacker now needs to guess the
>>>>> client port, or otherwise his packets will not even make it to the ntp
>>>>> process.
>>>>
>>>> If your point is to change the last sentence of RFC590 9.1 where it says:
>>>>
>>>>    srcport: UDP port number of the server or reference clock.  This
>>>>    becomes the destination port number in packets sent from this
>>>>    association.  When operating in symmetric modes (1 and 2), this field
>>>>    must contain the NTP port number PORT (123) assigned by the IANA.  In
>>>>    other modes, it can contain any number consistent with local policy.
>>>>
>>>> to:
>>>>
>>>>    ... In other modes, it SHOULD contain any number consistent with
>>>>    local policy.
>>>>
>>>> I'm fine with that.>
>>> Yes. That's the whole point of this document.
>>
>>
>> Sorry. THe point of the document is to change that to "SHOULD randomize
>> the port number". THat's the BCP of the transport area.
> 
> If your local policy is randomization, that's fine.


The transport area has produced a BCP recommending that ephemeral port
numbers should be randomized.

Are we just implicitly saying that we don't care about the advice of the
transport area?


-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492