[Ntp] Antw: Re: Antw: [EXT] Re: Post NTS, Is shared key authentication interesting?

[Ulrich Windl <[e-mail]>]

>>> Miroslav Lichvar <[e-mail]> schrieb am 27.05.2020 um 12:24 in
Nachricht <20200527102459.GA1749@localhost>:
> On Wed, May 27, 2020 at 11:55:36AM +0200, Kurt Roeckx wrote:
>> I'm not sure I fully understand what you're talking about, but
>> sending an error message that something with the crypto was bad
>> it a bad idea. You should pretend that everything was ok. An
>> attacker should not be able to see the difference between an ok
>> and a not ok message. Look for instance at the TLS RFCs what they
>> write about a Bleichenbacher attack.
> 
> That doesn't look to me like it would apply to the NTP authentication
> using a crypto hash function or AES‑(SIV‑)CMAC. With Autokey and NTS
> the server can respond with a NAK message to let the client know it is
> using an old key/cookie. The client doesn't need to guess what is
> wrong and can quickly start a new key establishment.
> 
> With a symmetric key, there is not much the client can do when it
> receives a NAK, except maybe log an error message. I'm not sure how
> useful that would be. The admin should be able to figure it out what's
> wrong even with no error message.

Whether a server ignores  a non-authentic message or responds with a more or
less verbose error diagnostic should be configurable by the server admin. In
general ignoring would be OK for public servers, but in more controlled
environments an error response can be helpful to debug problems. The protocol
specification should allow receipt of error responses (in a format to be
defined).

> 
> ‑‑ 
> Miroslav Lichvar