IETF Logo Mail Archive

Re: [Ntp] Details of the fragmentation attacks against NTP and port randomization

Tony Finch <dot@dotat.at> Wed, 05 June 2019 11:44 UTC

Return-Path: <dot@dotat.at>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 240DE12011E for <ntp@ietfa.amsl.com>; Wed, 5 Jun 2019 04:44:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.898
X-Spam-Level:
X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sS9n01s1WzwA for <ntp@ietfa.amsl.com>; Wed, 5 Jun 2019 04:44:15 -0700 (PDT)
Received: from ppsw-40.csi.cam.ac.uk (ppsw-40.csi.cam.ac.uk [131.111.8.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62CC91200B2 for <ntp@ietf.org>; Wed, 5 Jun 2019 04:44:15 -0700 (PDT)
X-Cam-AntiVirus: no malware found
X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus
Received: from grey.csi.cam.ac.uk ([131.111.57.57]:57544) by ppsw-40.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.138]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1hYUKv-001SfJ-jW (Exim 4.92) (return-path <dot@dotat.at>); Wed, 05 Jun 2019 12:44:09 +0100
Date: Wed, 05 Jun 2019 12:44:07 +0100
From: Tony Finch <dot@dotat.at>
To: Warner Losh <imp@bsdimp.com>
cc: Ask Bjørn Hansen <ask@develooper.com>, NTP WG <ntp@ietf.org>, Danny Mayer <mayer@pdmconsulting.net>
In-Reply-To: <CANCZdfqYzqeKeKykSdGh1k74jNegSVNhFFo-eWRHA_RNASJbEw@mail.gmail.com>
Message-ID: <alpine.DEB.2.20.1906051240570.25023@grey.csi.cam.ac.uk>
References: <CAN2QdAGS20q=7+r+qMFEBBu4gNmSDR9-vYDbvgC=ZnqWLEU-6w@mail.gmail.com> <739c2eaa-05f1-0b30-4b64-fc5d3f91ce5b@pdmconsulting.net> <a3a545cf-d83d-a2c7-ad6c-3e349de78615@si6networks.com> <9f75e400-cf2f-053f-ed06-f4d6df415eaf@pdmconsulting.net> <E3F91EE1-4EE8-4D3C-95E9-135D1CB1DF8A@develooper.com> <CANCZdfqYzqeKeKykSdGh1k74jNegSVNhFFo-eWRHA_RNASJbEw@mail.gmail.com>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/mnL3IedjF8gLKAtLfOHqJF-fPL0>
Subject: Re: [Ntp] Details of the fragmentation attacks against NTP and port randomization
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 05 Jun 2019 11:44:17 -0000

Warner Losh <imp@bsdimp.com> wrote:
>
> Also, the time isn't a random 64 bit number, also limiting the domain to
> search, no?

It is if you use OpenNTPD or chrony

https://chrony.tuxfamily.org/comparison.html

Tony.
-- 
f.anthony.n.finch  <dot@dotat.at>  http://dotat.at/
Isle of Man: South or southwest 3 to 5. Slight, occasionally moderate.
Showers. Good, occasionally moderate.

v2.23.0 | Report a Bug | By Email