Re: [Ntp] Comments on draft-langer-ntp-nts-for-ptp

[Hal Murray <[e-mail]>]

heiko.gerstung=[e-mail] said:
> The question is how often we need to change the S2C and C2S keys to avoid
> that some MITM gets enough time to break the keys before they change. As 
> far as I understood, those keys are part of the cookie and could change in
> every cookie. That would result in the NTS/PTP client to use a different
> key after every successful unicast negotiation... 

The S2C and C2S keys are in the cookie so the NTP server doesn't have to 
maintain any per-client state.  For NTP, they don't change without the client 
going back to the KE server.

The numbers are such that the MITM doesn't see enough traffic over the 
lifetime of a client to worry the crypto guys.

The keys in the cookie are encrypted with the NTP server's cookie-key.  That 
key gets used on all the traffic to the server.  That's a different set of 
MITM numbers.  The cookie-key gets rotated daily.

I know close to nothing about PTP.  If you are willing to have enough 
per-client state on the PTP server, there is no need to have cookies.

If your unicast traffic is periodic from the server rather than a response to 
a client request, then you need a counter or such to prevent replay attacks.

If your unicast traffic is high enough volume, then you need a re-keying 
mechanism to get a new S2C.


-- 
These are my opinions.  I hate spam.