Re: [Ntp] Antw: [EXT] Re: WGLC: draft-ietf-ntp-port-randomization

[Fernando Gont <[e-mail]>]

Hi, Ulrich,

On 8/9/20 04:26, Ulrich Windl wrote:
[...]
>>> ‑ Section 7: "However, the NTP specification has traditionally followed
>>> a pattern of employing common settings and code even when not strictly
>>> necessary, which at times has resulted in negative security and privacy
>>> implications (see e.g. [I‑D.ietf‑ntp‑data‑minimization])." Subjectively,
>>> I find the tone of this unnecessarily negative, and think the document
>>> might be better off if the sentence is dropped and the sentence
> 
> To me it sounds like a justification for ntp-data-minimization, but the logik
> is broken:
> You can't say ntp-data-minimization is needed because of what it does. You
> should "name the child" (security problems).

I'm a bit lost here. The text does say "which at times has resulted in 
negative security and privacy implications".

Should we remove the reference to I‑D.ietf‑ntp‑data‑minimization ? 
Something else?



>> Could you pleas clarify which part you deem as being overly negative?
>> And, also, which part you suggest to leave off?
>>
>>
>>> afterward updated in order to fit the context but remain more objective
>>> (also, that sentence might benefit from being split in two by a period
>>> before "[such] unnecessary usage").
>>
>>      " The use of the NTP service port
>>      (123) for the srcport and dstport variables is not required for all
>>      operating modes. Such unnecessary usage comes at the expense of
>>      reducing the amount of work required for an attacker to
> successfully..."
>>
>> ?
> 
> Also: ?

FWIW, this was suggested tweak in response to Kristof's comment...

Thanks!

Regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492