Re: [Ntp] A simpler way to secure PTP

[Miroslav Lichvar <[e-mail]>]

On Tue, May 11, 2021 at 09:14:55AM +0200, Heiko Gerstung wrote:
>PTP is different from NTP on multiple levels and offers a number of features that you do not find in NTP, for example higher packet rates to increase the number of samples you feed into your statistics.

Isn't this the other way around? The maximum rate of delay requests is
limited by the TX HW timestamping rate. The few PTP appliances I saw
supported only a very small number of clients. This can exploited for
a DoS attack. The same applies to NTP using HW timestamps+xleave, but
at least it can fall back to SW timestamps and clients should handle
that well.

> It also offers hardware timestamping in the network infrastructure components, i.e. switches and routers, which can improve your sync performance dramatically.

Would you expect the network devices to gain support for the new
security protocol quickly, or is it more likely the leaf clocks would
need to bypass them and send their secured requests to new designated
clocks (avoiding the benefits of the hardware support)?

> However, especially unicast PTP is a great traffic amplification tool, maybe one of the biggest traffic amplification machines of all times. And I also believe that it would be great to (re)use the general concepts of NTS to secure the other popular time transfer protocol out there. 

Yes, the near infinite amplification factor of the unicast PTP mode is
a major concern, but I don't see what can be reused from NTS to fix
that. NTS in NTP avoids amplification by the protocol design, not by a
security mechanism.

-- 
Miroslav Lichvar