Re: [Ntp] Roughtime and Delay Attacks

[Stewart Bryant <[e-mail]>]

Sorry I am struggling to understand how the protection works.

If C (who has just woken) sends a request to S, then all C knows is that 
T ~ Ts - 1/2 RTT. C can know that it was S that replied, but C cannot 
possibly know if S was lying or if an on-path router delayed the packet.

C can keep asking S, and within the limits of the server delay and the 
variation in the routing path and queuing delays RTT stay sort of 
constant, so C can be suspicious if it changes after it has been running 
or if Ts - 1/2 RTT changes by more than the known drift in its local 
clock. However routing paths do change and there are traffic congestion 
delays in networks.

C can ask S', S'' etc and build up a picture of various servers time, 
but it has to be careful that the paths are disjoint and that S, S' and 
S'' have truly independent and authoritative master clocks.

On the other hand, if the routers are compromised, then there are much 
worse things that can do, so we normally assume that they are truthful.

So how does this design do better than "T ~ Ts - 1/2 RTT assuming S did 
not lie and also was not simply wrong"?

- Stewart