[Ntp] Re: Grease in Roughtime

[Marcus Dansarie <[e-mail]>]

Hallo Kristof,

On 2024-09-25 09:38, kristof.teichel=[e-mail] wrote:
> Hey Marcus,
> 
> sorry, I just don't see how it works.
> I see the stated purpose: forcing client implementations to actually 
> verify signatures rather than cheaping out and skipping that operation.
> I also see the stated measure: instructing server implementations to 
> occasionally give bad time with faulty signatures.
> But I cannot see how the latter achieves the former.


The idea is that if a faulty (i.e. non-signature verifying) 
implementation provides the wrong time with some non-negligible 
probability, people will discover this and investigate.

The fault may be either due to the client not performing signature 
verification at all, or due to a bug in the client. Both are of course 
important to detect.

> (As a side note, the stated purpose already seems weird to me: why would 
> clients deliberately cheap out and forgo a major benefit of the whole 
> protocol? And why would anyone else want or need to enforce that they 
> don't? It literally only hurts the client itself)

People are lazy.

Consider that the lazy programmer may be a library author. Someone 
importing and using that library in their application may not be aware 
of the fact that it does not check signatures. Grease may make them 
aware of this fact.

>  From where I'm standing, the client implementations are still 100% free 
> to cheap out.
> Sure, they will have false time if they do, but... they won't 
> necessarily even know that, and thus not have any reason to change 
> anything.
> If it is meant as a deterrent (and TBH I think anything that I won't 
> even notice if it happens is a terrible deterrent) - wouldn't the 
> possibility of there being an attacker already achieve that, too?

The problem with attacks is that they are rare events. Greasing 
signatures will make them common enough to be something that must be 
considered by all implementations.

And yes, there are ways to circumvent this greasing. For example, a 
client could make two requests with some interval between and check the 
responses for consistency. If the responses are inconsistent, the client 
could assume that at least one was greased. This approach does however 
seem more complex to implement that just verifying the signatures.

> It seems like we're instructing implementations to randomly behave badly 
> for no (to me) tangible benefit.
> Would appreciate any help in understanding this.

I am not the most knowledgeable here when it comes to grease. Could 
someone else explain this better for us?

Kind regards,
Marcus