Re: [ntpwg] call for adoption (draft-dfranke-ntp-data-minimization)

[Miroslav Lichvar <[e-mail]>]

On Mon, Mar 27, 2017 at 04:50:42PM -0400, Daniel Franke wrote:
> Regardless of your opinion of OpenNTPD design choices, the facts
> remain that it's in wide deployment and sets the precision field to
> zero.  Those facts alone make it a good choice for standardization
> since:
> 
> 1. Matching an existing implementation leads to one less opportunity
> for fingerprinting.

I'm not sure how much that really helps. Even if other implementations
sent packets looking exactly like those from openntpd, the timing of
the packets would still be different. An observer can easily tell if
it's openntpd, busybox (which is based on openntpd), ntpd, chrony, or
something else, without actually looking at the values in the packets.

The fixed one-second timer in ntpd not only helps with fingerprinting
the implementation, it can be also very useful for fingerprinting
individual ntpd instances as they send requests at the same sub-second
fraction.

A specification on how exactly should the timing for a given poll
interval look like (e.g. its distribution and granularity) might help.
However, adjustments of the polling interval that clients normally do
to adapt to the stability of the clock and network could still be
useful for fingerprinting. Suggesting a constant polling interval for
all NTP clients on the Internet would probably not be a good idea.

> 2. Existing widespread use of this value means we can be confident it
> won't break anything.

32 is not as common as 0, but it is used too. Another large precision
that I often see is 118. I've no idea where that comes from.

-- 
Miroslav Lichvar
_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg