IETF Logo Mail Archive

[Ntp] Re: Wrong NTS key exporter context in use for AES-128-GCM-SIV

Martin Mayer <martin.mayer@m2-it-solutions.de> Mon, 16 September 2024 11:42 UTC

Return-Path: <martin.mayer@m2-it-solutions.de>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AB9EFC151536 for <ntp@ietfa.amsl.com>; Mon, 16 Sep 2024 04:42:54 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Level:
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=neutral reason="invalid (unsupported algorithm ed25519-sha256)" header.d=m2-it-solutions.de header.b="xZo/DJ0D"; dkim=pass (1024-bit key) header.d=m2-it-solutions.de header.b="TO+S21gF"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sSwS1KqOcS3t for <ntp@ietfa.amsl.com>; Mon, 16 Sep 2024 04:42:50 -0700 (PDT)
Received: from mailgate01.m2-it-solutions.de (mailgate01.m2-it-solutions.de [87.128.29.23]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 196E4C151087 for <ntp@ietf.org>; Mon, 16 Sep 2024 04:42:49 -0700 (PDT)
Received: from 40.93.78.49 by mailgate01.m2-it-solutions.de (Tls12, Aes256, Sha384, DiffieHellmanEllipticKey384); Mon, 16 Sep 2024 11:42:46 GMT
DKIM-Signature: v=1; c=relaxed/relaxed; d=m2-it-solutions.de; s=dkim6519e; t=1726486966; bh=GKWrfIqsd+qXSGUANyILUV//bHl5XfuC4O8YJX7JzKs=; h= Subject:Subject:From:From:Date:Date:ReplyTo:ReplyTo:Cc:Cc:Message-Id:Message-Id; a=ed25519-sha256; b= xZo/DJ0DU+yjFpWy1jExr8/4Az888ad4PZMn49CykLxcmY14S7tGrih7g1+hkD/3v6JPb0w3dF6cRDDwkgrpCw==
DKIM-Signature: v=1; c=relaxed/relaxed; d=m2-it-solutions.de; s=dkim6519r; t=1726486966; bh=GKWrfIqsd+qXSGUANyILUV//bHl5XfuC4O8YJX7JzKs=; h= Subject:Subject:From:From:Date:Date:ReplyTo:ReplyTo:Cc:Cc:Message-Id:Message-Id; a=rsa-sha256; b= TO+S21gF4supIcK6pPbe46gbB7jJ2EWailogp1c0INnU929/ePR3/vuAI9arScFbfXP0HeHz2YMGfX7h94lDqc6dt/XtshPt3HkUOFduYnsOcXLTdBFgzBNdUvzg9OpPLuoJL8I5DN9YdvZJTD56moCwjsi7OLEK8FnIpbdUFS8=
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=k4acRiT+u5sql4Y5g2mv1ZSGLe8fYUEkdPxitWCaMO1SDanC/utbs8TZmiBJeOGmu87zwymkXa0JtTracPMi8rd5u3ozgkq/4CmrZGSD+YslnDdde96F5Qr0wLfXHeLjIcEMmOEL0yiLVtHGHpSpoVFbtadhZaXvmxtt4PzOQOJd2zb+W6W63G3iERA/Vpdb5psGysQzkKAvh9DZDEW8B4lqbf9vbApq/97ruTIVPfpu8QDsarGbORaIdnMgt2YT21zVK94bbHGxBeWpmvDHk1eYah9vq0n3RDCpY5wd8nqsCLl1YjTWA/Qt1w/COLPNGGW7QbRIc4tScw9hbpybDQ==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GKWrfIqsd+qXSGUANyILUV//bHl5XfuC4O8YJX7JzKs=; b=dbbHNg6VkSDm9+ahG/TMa43YILxcxGyIFkckmWKYXu0d1wrf5BsIv71WkrAzSBzJonQu1ZB7PiKNC3q8RNXRetjuLfk/ujH0cLVZ70GJ3T4vfWOlu8GTJiCDsVrE2mbdyiVpTacEmWUbA/5cFPHl5s+SWS2BZLd3DOhvIA/hDy7KHxpjE1TP0P/8i3hbRPSsCvBcIKWxOu7TM6gZRY1wZrZMGT3r16it/XHH5raBwh+JgvQYwfdt+YzQ9OZ1WHX9tbaoJndh8f8H59gKeEzI3Scr2a1vrZhGHNGG+MknvfncNuh86y0+XR4hDP+YswG4AJdR1P456FilMt8gErLYrg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=m2-it-solutions.de; dmarc=pass action=none header.from=m2-it-solutions.de; dkim=pass header.d=m2-it-solutions.de; arc=none
From: Martin Mayer <martin.mayer@m2-it-solutions.de>
To: "ntp@ietf.org" <ntp@ietf.org>
Thread-Index: AdsIKyGZ//t+BaK4TL2O4Nsibd5mTA==
Message-ID: <BE1P281MB301366BF1CEB7A97E74D69DCBC602@BE1P281MB3013.DEUP281.PROD.OUTLOOK.COM>
Accept-Language: de-DE, en-US
Content-Language: de-DE
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=m2-it-solutions.de;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: BE1P281MB3013:EE_|FR4P281MB3833:EE_
x-ms-office365-filtering-correlation-id: ad057856-e2fa-42fb-bc9c-08dcd644abc9
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|1800799024|376014|38070700018;
x-microsoft-antispam-message-info: 2DbSjtL0ZCqMfmLmEoDN64wtpH5CCcg3oY688MNp/1oFWLMkIz17rWWrvAc2iYJOdAGUhjvJRJ8dA7B3Zu+uPxiYkLfdheCV/gdRvBbIuO1OT6uS/8t1EJgUd4w7fgeYAe7BWLH9tgxlpoGlosVWj7e6JHG7W2XeP0KNWC4kOJBdcCLzMNKMrlFKXhZ4RpNftJGLnszlbSujuG9pg820GiTA2giR2qVZGI4aQCqAIPQi5XvVab/2oJy2pTuXXrzzTVxZxq9UWuPPqRvJG+9onCss6pMSgEHF+BnJbzzGl/9DmUtPi8oeEk/UpgSEkYN7mQUiNvb99PfptgfaT7Pb5GHaFrFLFdZL4nkG6lJ0pzd+n/RLj20qPfvbGjCJ8sQMzrbGrVcX278czQo7qraSTc2aagjRM2ve8dTIjud0YaATrJUJrcXxpvAh1OHhSnPHQ0YZxk6ltjG39eWRNDOds3itSk3N/ERK/TAqqUsoLetT5RbemzN2L3RXjlu4McJbHfuEFUJybvnRO3sPZWya9f3v8n4n9lJqZKNT47H7lkdLeXns5TZk9SARevYXrS/SJACM1G2D6TxXPHZZGXFXV7kEZxnEPzZZ+SwcL8bfSAmWZS2N6XXn47pi/o2mGsXw+PH/effROkDUkV/LERsVG+5wl5jeTsIvqRd3lyIliw+ubSq+9kJGggKzy4O4iT9run9ea6jsAv3T3oY7Npg2XzIRmq17gIXc8Y8BUK/qLkoljY77bWEM2aVH2SkriLpjH3IVwCh0J47X7ywiGJPARmdv4BFBSutBxdwWnccRDEtWjlgCpOzlwRI4ntEyQvFBiEQAcrWer36leWyWRtON47jW3YgatdpVA7JLnsapm4ZjJeZ04YMCsZWjAk1nRMh5JhOC+BgSX3IHZPi/zzhCqEnkwMO+W/JFn1KHLUDRooPOKmSqjK3UUvl5buffV1KfMszUribWUkExhl4i4Aq1wOUI82QMzMpnembT6tylkrkC1FAuObS6WsN8Yv/82ISm7AT8PIYpB32sDLhZJbz5cYIMYcqPnbr75EPrF1sNxxl7Scf4P0ffhGamo/JMtkdnG7wV8tnsPncxdm7kPzAP9k2oIaKYPY/PUk8NSx+QXz3PqQgGM3zb8Cec5zgzPHvR3rUYL7lAye3oeIYOJmAltxsDeNYZRrGlm+9KCiknxU3KHGaBGQS5Bo8rKhuHs5xvVHG77jkyZc2IBMfWP5sP4Pbe7Wj2z1l/7MISnLJTWc26GUULQsy/xrRyy7EN3rmBGxo42R2tIKIKAQSQrhVd8y4hKMgYXXcz9I8hSNfSSZwV2pS0CN+lsGwBtxdYzBUuKrizwUTl9R/ln1ow1v9RuQ==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BE1P281MB3013.DEUP281.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(38070700018);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: pyrPTequb+SSIHhCh84z2/C8+/O9Q1+WNH95LSthVgaCSGSDo75jom+g1Y5Yk07yUnW8MqovcN1g32orapYWrPMVzs5ZWGiKfM9s7af4fxIzUmWVuvQciCN1NmUz6rbFehs8sOqVF0qoYnIa8Zqfd8HhnXhovy8vfbazmCIiStKlcvsP5B8eBTPnU1Xb5d2taS1wX6Jsk7JGruogfxYTN7jWCozxUe+V9qOEkjn71Lcm9VvU3njk2Q+aTOh3UbQB74Kp54d701Aga9aQSIFDGVN5B2gKSfOjs8qqBi7VSqC4SHm+PJHF/OxzwiLET61O1/30OSrY2XMujNaTBX/iy2qjhKcxhxaV2Kgvrv1aBt0LvkI2D9nSx1geYWl4FrUN9qKHsRCAaPRaDr6J4fCSoMEfm6AbDAGEbHdnc02OvlKVfibwMYyzzb3ncjRLWp5x9lntCPoPCt5V62r8DyoxLgdlD2gCK8e1IA2FC7TJfuwMpbq9IC4/wu9WHs/cHqPGWCQfQg3GvJnxerE5q77RtewCoqPF1Du4yvE2qgIAdjb3mlhHlv1Zz56pcXOhGiCvt9J95YwlIcYBcZZL+ytchweu9uK/zYV6Zt9VDijhAO6pqJArPLkw2jum5jfYWqnzqUEh0j8NIFNSJLLnV4+ZLrwPE1afcOevlMx+D6DciTmhv92ECAlVo9sXQGNS976r3vh6hoZFcEfHTIUQ+BU3vvaHmrSiHYJIcdQunPt86lQIXp2Tjvbg85EgsqS05we3rcOiDVXKkDgK5Jm9SDTzUZHChjw2Ur58vrUpNenenSr7mLWWJr+c6i6UZnX69hzJqfWtrEpdN5zQnDiv5ke4LQncR6+bxN7/+uQmmmr3OMhvLN8eex36+O2fst4cFENsEYdmsGDLjgvS4gMiXIMBmguyBPJU601ohjpDiWWQYwViuja9ALBsFGrJ4VYKP5EMCNVz6dSmV5pGmPelUOOzkemYQx9kPR+6TPZq99ijaGCQLAmO/WYxxN5GPpWe2BYpjJwQCZcagBnXmLcULy/5zm+13U9vpO3K7gkzyK+FzKg9FFbq6t0uW0+6ECPjyoA+uJPfsduz0F9K2VYdjuN7khttJEQatDhTqb118fXbyMZNCc3ZFlF3H4im64GqAKsp2IkNdxQlW5akAqqE7cl5UhP1C+26RtlUpXUQeru/yVwqq8VIabljh5LD6Tewm4z43hFmI85b2AvvnlYrTRAUuW9Hy11F1Ne/QIEOr/vCwZjJ9fWyZFPlUaccxRLnZXh/LRiGYtiu3V5ln1xoDDxzEQiZOKsvpO5DB9hngOPgVuFjfaWWxP2I4rzQdg5Jim067523gbGZN2dtaK/XLt+/ihCKlgCaEdkwHuRcKRGVNJ7QqW+BdrkZfxNyaqQdV9gtDNQIvvNm/1aPkGRTzbhZEV8kIUnK/ujlR9E17EFPrP2A7DE+N1gkKQyNpGWtp9IIAwnAUyIEx97GyBmoIBkT3QlW3cQoD3iQCo3K4ylpW+YCjhE046Dk+IOtNVtN6z12X82PtDiUYtfV5OBPL+raqGftOAvMfcoXbgjT3RJb8a+8h8UP1IFRn7KJyOiiSFC278QrBaPH6PY/Mf6wZ7j9bwMNK5w3rICYYx1tF5yJ3RzuP1RDq0GQk7dxSbs24xvHN8NX7i6yQbf5uFG/yn0RLg==
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 9Ds2pr4niCQswFHsua4VgNQNlzybDprLjlRATdxL3YQdTIHHXfIbNUME9ouqsxnfM7W3LCV6YQgcCCXqxRbPrUln7M0QSoTJj47iqC6wRLZCtABjmv1LH+85Ppz2BcB4jV8DcStJFF+Y5qCUb4mAEJBU0g7US/yPvAXQYw6G7s/hFgwu0Op1HsnVj4YsIsQzQgAyEn84d+VPNjqApuOfTTJuRWInhwFAr3VmpAINBdXVVziDVUs6aVJeBv9I3bdREjRuw1TiPspspmH7eIxe3ZErvrmNg5chDCVzOhXHuj7nBDhPNo6WsKjAxYBG4JCBYS/rI/2MSkV1Srblfhb0DoEFbu3Y/udpi7NN9lhvoHq/bY6aSvL9Ex6LFH+n+Kmd4UcGagnXbRuv7TGgMND+uOC6xa0aJI//kIlfRi0bVjdO59sq9/hDdIDP6augm2ZyiWuORJSC+a8sYGfW83VpH52MZLXAxPCVofct5TameJF6TUp8rEbGfooqfBZamMTsHEAS0UXXSuf9O9SA7jkWXiqu/vIRJuE8jtczuL5CUnl0PFkUnwBzj0iOhPmCCwC5i7gqEgG532KeNuYWXOeVkQqMi/dB1dF1vmtYJuknE/HiVSjpMNF31k602xAJrPnF
X-OriginatorOrg: m2-it-solutions.de
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: BE1P281MB3013.DEUP281.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: ad057856-e2fa-42fb-bc9c-08dcd644abc9
X-MS-Exchange-CrossTenant-originalarrivaltime: 16 Sep 2024 11:42:40.7569 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 62df63d0-2fdf-4174-a799-d6eb3262ce92
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 4M6B2ie/cHpfPCDcnrqdk0LJXwbUP/HR0LFLqHtSfL7X9h5CKZFuRJ103Z2G0IFe+VIp+yDfnjREpeMuMaQx7yjVTYlSpREDAJVCYAhQpOE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: FR4P281MB3833
X-MailFrom: martin.mayer@m2-it-solutions.de
X-Mailman-Rule-Hits: nonmember-moderation
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ntp.ietf.org-0
Message-ID-Hash: NAUDNBFF5LGR22CD5RWOCVYSKEMZHW3V
X-Message-ID-Hash: NAUDNBFF5LGR22CD5RWOCVYSKEMZHW3V
X-Mailman-Approved-At: Tue, 08 Oct 2024 11:19:52 -0700
X-Mailman-Version: 3.3.9rc5
Precedence: list
Subject: [Ntp] Re: Wrong NTS key exporter context in use for AES-128-GCM-SIV
List-Id: Network Time Protocol <ntp.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/P8RRxxopBCzwtAEUBAjzpvsw_qg>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Owner: <mailto:ntp-owner@ietf.org>
List-Post: <mailto:ntp@ietf.org>
List-Subscribe: <mailto:ntp-join@ietf.org>
List-Unsubscribe: <mailto:ntp-leave@ietf.org>
Date: Mon, 16 Sep 2024 11:44:54 -0000
X-Original-Date: Mon, 16 Sep 2024 11:42:40 +0000

Hello Miroslav,

is it an issue of any kind if a KoD is intentionally used to detect an old version?

Per RFC a KoD should be used if the data cannot be validated or authenticated, which will happen on NTP requests from an RFC-conformant client using AES-128-GCM-SIV and also from a patched chrony version.
Chrony could remember that first (failed) stage to re-initiate one (and only one) second NTS-KE run in 'compatibility mode' using the non-conformant context.

This could be helpful to phase-out old server versions while no other clients support AES-128-GCM-SIV.

Martin

v2.27.8 | Report a Bug | By Email | System Status