[Ntp] Roughtime: Proving inaccuracy of servers.

[Hal Murray <[e-mail]>]

Looking at section 9.2 Measurement sequence

    The client randomly permutes three servers from
    the list, and seqeuntially queries them. The first
    probe uses a NONC that is randomly generated.
    The second query uses H(resp||rand) where rand
    is a random 32 byte value and resp is the entire
    response to the first probe. The third query uses
    H(resp||rand) for a different 32 byte value.

I don't see how you can prove much from that.  All you know is that the first 
packet was sent before the second and also before the third.

If the first server replies with a time from yesterday, you can't prove that 
you didn't save a packet from then.

If the second or third server replies with a time from tomorrow, you can't 
prove anything unless you go through another step to get another time stamped 
signing for your data collection.

If the NONC for the third server is based on the resp from the second server, 
then you have the second server bracketed.

If you want tight proof on all 3 servers, I think you have to make an extra 
probe before probing the 3 and another after.  The one after is optional.  
It's only needed if you want to prove the 3rd server gave a time from the 
future.  That's assuming that each NONC is based on a hash of the previous 
packet.


What sort of bounds are you thinking of?  seconds? days? microseconds?



Here is an idea for your prove-it collection.  Use NTS.

Every NTP+NTS response already contains the time and a nonce authenticated by 
the server.

The catch is that they are authenticated by a working key which you don't know 
so I can't prove to you that they were authenticated by the server.  That's 
easy to fix.  The server needs a public/private key.  That's in addition to 
the public/private keys for the TLS certificate.  Extend the NTS-KE protocol 
to include signing the working key with its private key.

If I want to prove anything, I have to expose the working key.  Be sure to get 
a new one first.

I'm assuming the nonce would be H(rand||several recent packets)
  That's packets from NTS servers supporting the new extension.
  I'm ignoring other traffic.

Normally, NTP tries to spread the requests out in time.  The polling interval 
is usually somewhere between a minute and 15 minutes.

If you get a bogus time in the future, it would be easy to fire off a reqest 
to another NTS server.

If you get a time in the past, you can only prove it if the time is older than 
your most recent resonse.  You could get time from a good server, then try the 
bad one again.



-- 
These are my opinions.  I hate spam.