Re: [Ntp] [EXT] An NTPv5 design sketch

[Daniel Franke <[e-mail]>]

On Mon, Apr 13, 2020 at 5:07 PM Ulrich Windl
<[e-mail]> wrote:
> > * Time packets carry an unencrypted and unauthenticated correction
> >    field intended for manipulation by middleboxes. The function of this
>
> Doesn't this feature make requiring NTS obsolete? Any MiTM could
> manipulate these fields then.

I address this some in the final paragraph; implementations need to
set a limit on the magnitude of the correction they're willing to
accept, and that limit must be no greater than half the round-trip
time. Without NTS, the magnitude by which a MitM can manipulate your
clock is unlimited. With NTS and half-RTT limit on correction fields,
the magnitude is at most double what it would be with NTS and no
correction fields (up to a whole RTT rather than a half an RTT).

> (also I'm still wondering what's the
> benefit of encrypting the current time when sending it out more or less
> real-time)

Almost certainly none, but given that NTS requires encryption
regardless (for cookie unlinkability), why in the world would we want
to *not* encrypt it? What do we gain by trying to pick and choose
which fields we think really need encryption?