Re: [Ntp] NTP Security (was NTPv5: big picture)

[Magnus Danielson <[e-mail]>]

Kurt,

On 2021-01-18 22:15, Kurt Roeckx wrote:
> On Mon, Jan 18, 2021 at 09:17:49PM +0100, Magnus Danielson wrote:
>> Hi,
>>
>> On 2021-01-18 17:25, Miroslav Lichvar wrote:
>>> On Mon, Jan 18, 2021 at 04:46:22PM +0100, Magnus Danielson wrote:
>>>> 6) If verified time matches that of the initial handshake request (as
>>>> updated using local time progess), then unauthenticated time in step 2
>>>> and 3 was valid, and thus the verification was valid and progress, else
>>>> fail.
>>>>
>>>> So, we see how unauthenticated time can be used to bootstrap the
>>>> handshake. Notice that this is not used to initiate node time, but only
>>>> for that handshake. Only after things is secured, you accept time as
>>>> being secured.
>>> I don't quite follow. If A was compromised at some point, how do you
>>> know you are not talking to the attacker intercepting your requests
>>> and giving you old signatures? Isn't the whole point of the validity
>>> period to prevent such attacks? If you don't know the current time,
>>> how can you validate anything that's not supposed to be trusted
>>> forever?
>>>
>> You actually do not trust the time you get initially. You validate it.
>> If your DNSSEC is invalid because of time, then the DNSSEC does not
>> validate. If your DNSSEC is invalid because false data, the DNSSEC does
>> not validate. Then, if and only if DNSSEC validate, only then you get
>> time but using the data-validated path, and only then you validate if
>> the original time and the validated time match up. If they don't, then
>> you do not trust either. If you can spoof the DNSSEC to validate, you
>> are toast anyway, if you have put your trust there.
> In case keys are compromised, an attacker can send you an invalid
> initial time. That same attacker can create DNSSEC records, which
> you're happy to validate with the wrong time. So now you think DNS
> is working properly and ask for the time again, and still get the
> wrong time.
The DNSSEC records need to validate data-wise for the time-attack to do
any good. The design goal was just to enable the DNSSEC validation to
have good enough time for time-validation for bootstrap.
>
> As far as I know, this requires at least 2 things to be compromised:
> Both DNSSEC and the X509 certificate. This is less likely than
> just 1 being compromised, but still possible. It would at least
> help that the DNSSEC and X509 certificate are not managed by the
> same organization.

For sure. If you have updated your basic DNSSEC key to be valid enough,
DNSSEC validation should be difficult. At the time it is "broken" we are
not alone to need the upgrade.

>
> The only options I see is:
> 1) You have enough sources so that all being compromised is
>    unlikely enough for your use case. This can be things like:
>    - A battery to keep your clock
>    - A source of time that makes you a stratum 1 servers like a
>      GPS receiver.
>    - 1 or more ntp servers (using NTS)
>    - Other sources of time like roughtime
Regular update that RTC. I've seen NTP fail because the RTC drifted away
and was not maintained.
> 2) The machine should trust something external:
>    - A human that sets the time correct
>    - An external DNS server that does DNSSEC validation for it,
>      and probably uses 1) itself.

If you trust DNSSEC and that key-chain as well as trust the X.509 chain,
then you put your core trust there. The bootstrap procedure I describe
is to bootstrap out of the situation you do not trust your own time well
enough. In fact, as you wake up, you also need to consider that your own
local time can be at error, and you need to bootstrap out of that. You
can test it through similar enough procedure, but if that fails, you
need to bootstrap time from external source.

Look at the DHS Resilient PNT common framework, already for Level 1 you
need to be able to in the field be able to reset to "factory settings"
to override any internal state that can be incorrect. It turns out from
bitter experience, you can't trust that at all times. Once you done your
homework, that's another story, and you need to maintain it just as with
keys.

Cheers,
Magnus