IETF Logo Mail Archive

Re: [Ntp] New Version Notification for draft-gruessing-ntp-ntpv5-requirements-03.txt

Danny Mayer <mayer@pdmconsulting.net> Fri, 15 October 2021 17:29 UTC

Return-Path: <mayer@pdmconsulting.net>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 393513A0906 for <ntp@ietfa.amsl.com>; Fri, 15 Oct 2021 10:29:29 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aNLNC4zkBj-K for <ntp@ietfa.amsl.com>; Fri, 15 Oct 2021 10:29:24 -0700 (PDT)
Received: from chessie.everett.org (chessie.everett.org [IPv6:2001:470:1:205::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7AD933A08FF for <ntp@ietf.org>; Fri, 15 Oct 2021 10:29:23 -0700 (PDT)
Received: from newusers-MBP.fios-router.home (pool-108-26-179-179.bstnma.fios.verizon.net [108.26.179.179]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by chessie.everett.org (Postfix) with ESMTPSA id 4HWCtl6jrGzMNQF; Fri, 15 Oct 2021 17:29:19 +0000 (UTC)
To: "Salz, Rich" <rsalz=40akamai.com@dmarc.ietf.org>, James <james.ietf@gmail.com>, Doug Arnold <doug.arnold@meinberg-usa.com>
Cc: NTP WG <ntp@ietf.org>
References: <163386015957.12424.6997038478834885480@ietfa.amsl.com> <CAO+dDx=6baLhf9LwSMvR1F0ieuLO6NXmExYLDvcCF2tgchHs8w@mail.gmail.com> <DB8PR02MB5772AC97BFE2D7C1139EFDC0CFB89@DB8PR02MB5772.eurprd02.prod.outlook.com> <E469D9A7-7445-49D9-A8A2-82BA7BF1FA27@gmail.com> <1985d4ff-d4a9-5ca3-e1b8-3d5f9a2fcc4b@pdmconsulting.net> <05E3CA12-9828-4EF6-8C47-20A7D07788AA@akamai.com>
From: Danny Mayer <mayer@pdmconsulting.net>
Message-ID: <fda9f648-5f63-e33d-6604-42db3a83a073@pdmconsulting.net>
Date: Fri, 15 Oct 2021 13:29:19 -0400
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.14.0
MIME-Version: 1.0
In-Reply-To: <05E3CA12-9828-4EF6-8C47-20A7D07788AA@akamai.com>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/K4sabAzD5l62TZYD517VlcDQmc4>
Subject: Re: [Ntp] New Version Notification for draft-gruessing-ntp-ntpv5-requirements-03.txt
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Network Time Protocol <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 15 Oct 2021 17:29:29 -0000

On 10/15/21 1:03 PM, Salz, Rich wrote:
> ➢ Encryption needs to be off the table. It's not just a bad idea, it provides no benefits. Time is not a confidential matter. If you have some use cases for encryption, please state them.
>
> I am not so sure it provides no benefits.  We used to think that DNS was a public repository and that there were no privacy concerns, and it turns out we were wrong.  Sure, time itself is not confidential -- anyone can buy a watch :) -- but the story around the meta-data for time services is not as clear.
>
The reason to do encryption is to make the contents confidential so 
noone else can know what the contents are. There's nothing in the NTP 
packet that needs to be hidden from prying eyes. The DNS issue is again 
not a matter of confidentiality. As a former DNS Developer I can tell 
you that the issue resolved with DNSSEC was to prevent spoofing. The DNS 
packet is NOT encrypted, it just has content to prevent spoofing. The 
Kaminsky attack shows an example of that.

Danny

v2.23.0 | Report a Bug | By Email