Re: [Ntp] NTS4UPTP draft

WG chair hat off!

I think it is common understanding that communication across the 
internet should be protect by security means. It also is common practice 
to protect LAN based communication since experience taught that it is a 
false sense of security to rely only on security gateways to  protect 
against adversaries.

In the past PTP is applied mainly in local networks but today it is 
going to be applied across Internet connection also. From my point of 
view: it is out of question, that an inherent security approach is 
necessary for PTP. Instead, it is necessary to find good arguments for 
not specifying a PTP specific security protocol. Up to now I didn’t 
heard any convincing argument against a PTP specific security approach. 
Hence, I would argue that the two relevant questions are 1) who shall 
specify this approach  and 2) if the working group will be ready to do 
that, which draft should be the basis for this effort?

Who? Basically there is the P1588 wg of IEEE who is currently in charge 
to update  the PTP spec and the NTP wg of IETF who already did work in 
context of PTP (in fact not really the NTP but the TICTOC wg).
- P1588 wg: the member of this group have a lot of elaborated knowledge 
of PTP but their focus and experience are not in the field of security.
- NTP wg: compared to P1588 this wg has less knowledge of PTP. However 
it has better knowledge regarding security protocols and with IETF’s 
security area much more resources in this area too.

Which draft?
Currently, we have three proposals for an PTP security approach. Two 
drafts, one from Heiko and one from Martin and a sketch form Daniel. The 
drafts from Heiko and Martin apply elements of NTS in order to protect 
PTP messages. Both approaches need to extent NTS in order to meet 
requirements specific to PTP. Heiko’s draft focuses on PTP’s unicast 
mode (which is not to be confused with NTP’s message exchange) whereas 
Martin’s draft is more comprehensive and considers all PTP modes. 
Daniel’s proposes to use NTS secured NTP to protect PTP, which is a 
watchdog like approach (certainly, this is a somewhat simplified 
description).

If the wg will do the effort it has to decide which of these drafts 
shall be considered. One of them, all of them or a combination?

Regards
Dieter

On 2 Jun 2021, at 13:28, Heiko Gerstung wrote:

> So far the feedback regarding our draft is more or less trying to make 
> the point that
> instead of securing the currently unsecure protocol B, users should 
> better change the protocol so that it looks almost like secure 
> protocol A
> try to use parts of protocol B to enhance protocol A
> use protocol A to establish a secure error boundary for protocol B but 
> do not care for all the other possible attack vectors of protocol A.
>
>
> Apologies for oversimplifying this, but I believe I explained in 
> detail why none of these three approaches is as good as securing 
> protocol B.
>
>
>
> I read a few times that other WG members are agreeing that PTP needs 
> to be secured. NTS4UPTP is trying to deliver this for the unicast mode 
> of PTP. Given the experience you went through with NTS4NTP I believe 
> it is a sensible approach to divide the job of securing the two 
> different variants of PTP into two drafts. This will enable us to get 
> to a point where we can secure at least unicast PTP a lot faster 
> compared with one big draft that is trying to cover both unicast and 
> multicast. It is clear that you need two different approaches for 
> those two quite different variants and I propose to do this in two 
> drafts instead of one big draft with two parts.
>
>
>
> Regards,
>
>    Heiko
>
>
>
>
> -- 
>
> Heiko Gerstung
>
> Managing Director
>
>
>
> MEINBERG® Funkuhren GmbH & Co. KG
>
> Lange Wand 9
>
> D-31812 Bad Pyrmont, Germany
>
> Phone: +49 (0)5281 9309-404
>
> Fax: +49 (0)5281 9309-9404
>
>
>
> Amtsgericht Hannover 17HRA 100322
>
> Geschäftsführer/Management: Günter Meinberg, Werner Meinberg, Andre 
> Hartmann, Heiko Gerstung
>
>
>
> Email:
>
> heiko.gerstung@meinberg.de
>
> Web:
>
> Deutsch https://www.meinberg.de
>
> English https://www.meinbergglobal.com
>
>
>
> Do not miss our Time Synchronization Blog:
>
> https://blog.meinbergglobal.com
>
>
>
> Connect via LinkedIn:
>
> https://www.linkedin.com/in/heikogerstung

> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp