Re: [Ntp] NTPv5 draft

[Philip Prindeville <[e-mail]>]

> On Nov 30, 2020, at 4:44 PM, Salz, Rich <rsalz=[e-mail]> wrote:
> 
>>   I think that there is a possibility of a non safety-critical closed network application of ntp that does not need security.
> 
> I am strongly opposed to this for three and a half reasons:
> 1. The use-case is not known, so we should assume that NTPv4 is good enough.
> 1.5 If this is not the case, those who need this need to make the argument to this WG.
> 2. Security should no longer be optional for IETF protocols.
> 3. "Closed network" is increasingly unlikely; we're seeing more things "in the cloud" for example.
> 


Plus everything Rich said.

(2) in particular because there are so many things that might require accurate time that are potentially exploitable if this is defeated.

For instance, if I warp a clock sufficiently forward or backward, I can cause X.509 certificates to be outside of their validity windows, which could cause loadable kernel module (LKM) signature verification to fail, creating a denial-of-service of critical system services, protocol and device drivers, etc.  It could cause other trust-based (PKI) services like DNSSec to fail… Ssh… HTTPS… CRL’s themselves to be ignored (yeah, that’s a bit of a mind-twister, isn’t it?)…  secure firmware updates might fail, so exploitable vulnerabilities never get flushed out of the universe of IoT’s…