Re: [Ntp] I-D Action: draft-ietf-ntp-ntpv5-requirements-02.txt

[Miroslav Lichvar <[e-mail]>]

On Sat, Jul 29, 2023 at 08:45:52AM -0700, [e-mail] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This Internet-Draft is a work item of the Network Time Protocols
> (NTP) WG of the IETF.
> 
>    Title           : NTPv5 use cases and requirements
>    Author          : James Gruessing
>    Filename        : draft-ietf-ntp-ntpv5-requirements-02.txt

Thanks for updating the draft.

>From 3.1:
  NTPv4 has previously suffered from DDoS amplification attacks using a
  combination of IP address spoofing and private mode commands used in
  many NTP implementations,

I suggest replacing "many" with "some". AFAIK only the ntp.org ntpd
and its fork ntpsec have this issue.

>From 4.1:
   Client and server protocol modes MUST be supported, and other modes
   such as symmetric and broadcast MAY be supported and SHOULD NOT be
   required by implementors to implement.  Considerations should be
   made in these modes to avoid implementations and deployments from
   vulnerabilities and attacks.

So we are postponing the decision on which modes to support to the
protocol specification? I was hoping the requirements draft would
provide more guidance than "MAY".

I think I suggested this before. Instead of naming modes, why not
simply say: "NTPv5 MUST be resilient to off-path and replay attacks"?
I think that is a reasonable requirement for any internet protocol
that nobody should have any objections to it.

The people who think symmetric and/or broadcast need to be
supported will be forced to find a fix, or if they cannot do that at
least understand it well enough to realize why they shouldn't be
supported.

-- 
Miroslav Lichvar