Re: [ntpwg] Antw: Re: Antw: Re: call for adoption (draft-dfranke-ntp-data-minimization)

[Daniel Franke <[e-mail]>]

On 3/28/17, Harlan Stenn <[e-mail]> wrote:
> The NTP Project's software will alert whenever an unexpected origin
> timestamp arrives.  So if you start seeing thousands of these arrive you
> have knowledge that a bad guy is spoofing you to your server.

By "alert" you mean "increment a counter whose value can be queried
using ntpq". Few users know this counter exists and almost none
outside this very small community check it routinely. It's absurd to
demand of users that they be keeping constant vigil over the state of
their ntp daemon, and any security model which assumes that they will
do so is useless.

Even if you *do* immediately notice the attack, what are you expected
to do about it? You can either do nothing and let your clock get
manipulated, or disassociate with the peer being spoofed, and if
they're all being spoofed then you're left with letting your clock
free-run. But with proper origin timestamp randomization, you can just
ignore the attack because it will have a negligible chance of success.

> Also, for client responses, the "gate" for using this is pretty short -
> it's the window between sending the initial request to the server, and
> the time the response comes back.

That assumes the legitimate server is alive. The correct "gate" on
which to base success-probability calculations is the MAXDIST
parameter.
_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg