Re: [Ntp] Roughtime and Delay Attacks

[[e-mail]]

Hey Tony and everyone,

I believe this idea sadly cannot work, due to the difference contexts of 
how Chronos resists delay attacks versus how delay attacks potentially 
affect the workings of Roughtime.
Chronos mitigates delay attacks (and, actually, all kinds of attacks or 
malfeasance) by evaluating time signals from many sources and using this 
large collection of data to make smart estimations about the true time.
Roughtime deliberately looks at the associations to single server and 
tries to judge whether (and potentially prove that) each single given 
server is showing signs of malfeasance.
Their aims and scopes are so different (looking at the whole system to 
find the best estimation for a global truth versusbasically performing 
audits of singular parts of said system) - I just don't see how to combine 
or borrow techniques in the way you suggest.

Best regards,
Kristof




Von:    "Tony Finch" <[e-mail]>
An:     [e-mail]
Kopie:  "Tal Mizrahi" <[e-mail]>, [e-mail], "Aanchal 
Malhotra" <[e-mail]>, "Watson Ladd" <[e-mail]>
Datum:  02.04.2019 17:52
Betreff:        Re: [Ntp] Roughtime and Delay Attacks



[e-mail] <[e-mail]> wrote:

> - Roughtime (AFAIK) still needs to include some considerations of RTT in
> its analysis somehow (see below).

Maybe roughtime clients should use the Chronos clock selection algorithm,
because it is supposed to be resistant to delay attacks.

https://tools.ietf.org/html/draft-schiff-ntp-chronos-02

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
North Foreland to Selsey Bill: Westerly or southwesterly 5 or 6, becoming
variable 3 or 4. Slight, occasionally moderate at first. Rain or showers,
occasionally thundery. Good, occasionally moderate.