[Ntp] Antw: Follow-up to yesterday's mic comment about PTP security

"Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de> Wed, 24 July 2019 06:04 UTC

Return-Path: <Ulrich.Windl@rz.uni-regensburg.de>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA84812004E for <ntp@ietfa.amsl.com>; Tue, 23 Jul 2019 23:04:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WRlWYXZ1BNwn for <ntp@ietfa.amsl.com>; Tue, 23 Jul 2019 23:04:49 -0700 (PDT)
Received: from mx4.uni-regensburg.de (mx4.uni-regensburg.de [IPv6:2001:638:a05:137:165:0:4:4e7a]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76B8512003F for <ntp@ietf.org>; Tue, 23 Jul 2019 23:04:49 -0700 (PDT)
Received: from mx4.uni-regensburg.de (localhost [127.0.0.1]) by localhost (Postfix) with SMTP id 6C4A56000052 for <ntp@ietf.org>; Wed, 24 Jul 2019 08:04:46 +0200 (CEST)
Received: from gwsmtp.uni-regensburg.de (gwsmtp1.uni-regensburg.de [132.199.5.51]) by mx4.uni-regensburg.de (Postfix) with ESMTP id 5BEFC600004E for <ntp@ietf.org>; Wed, 24 Jul 2019 08:04:46 +0200 (CEST)
Received: from uni-regensburg-smtp1-MTA by gwsmtp.uni-regensburg.de with Novell_GroupWise; Wed, 24 Jul 2019 08:04:46 +0200
Message-Id: <5D37F4FC020000A1000325EE@gwsmtp.uni-regensburg.de>
X-Mailer: Novell GroupWise Internet Agent 18.1.1
Date: Wed, 24 Jul 2019 08:04:44 +0200
From: "Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de>
To: "Daniel Franke" <dfoxfranke@gmail.com>, "ntp@ietf.org" <ntp@ietf.org>
References: <CAJm83bD89oPE+WouWUD=qVqFzZ5-vw6E3RVsdVRteH0cEXyYjg@mail.gmail.com>
In-Reply-To: <CAJm83bD89oPE+WouWUD=qVqFzZ5-vw6E3RVsdVRteH0cEXyYjg@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/seQCi_L-R9dvI9iN2NBPg_0SFO0>
Subject: [Ntp] Antw: Follow-up to yesterday's mic comment about PTP security
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 24 Jul 2019 06:04:52 -0000

>>> Daniel Franke <dfoxfranke@gmail.com>; schrieb am 23.07.2019 um 18:19 in
Nachricht
<CAJm83bD89oPE+WouWUD=qVqFzZ5-vw6E3RVsdVRteH0cEXyYjg@mail.gmail.com>;:
> My comments yesterday about PTP security shifted context a few times
> so it may have been hard to follow what I was claiming. My assertions
> were:
> 
> 1. If you need 50ms precision, pick some good public NTP servers and use 
> NTS.

Interestingly I think most data centers would like to have 1a: 100µs to 5ms.
Are you saying NTS can't do better than a few ms?

> 
> 2. If you need 100µs precision, colocate a time source in the same
> datacenter as the client systems. Use NTP and NTS; you don't need PTP
> for this.
> 
> 3. If you need 1µs precision, use PTP and physically secure the link
> between the time source and the clients so that cryptographic
> authentication is unnecessary.
> 
> 4. If you need 1µs precision over an adversarial network, good luck!
> This is simply not achievable and no amount of cryptographic pixie
> dust is ever going to save you.
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp