Re: [Ntp] Antwort: Re: A simpler way to secure PTP

[Kurt Roeckx <[e-mail]>]

On Tue, May 11, 2021 at 11:50:16AM +0200, Joachim Fabini wrote:
> On 5/11/21 10:38 AM, Kurt Roeckx wrote:
> > On Tue, May 11, 2021 at 09:59:10AM +0200, Joachim Fabini wrote:
> > > On 5/10/21 7:05 PM, [e-mail] wrote:
> > > > @Doug: Daniel is correct; you can apply all kinds of magic, but
> > > > ultimately, your hard, 100% certain guarantees are going to be at best
> > > > "half of RTT" for two-way time transfer and "none at all" for one-way
> > > > transfer.
> > > 
> > > "At best" is too little. 100% certain guarantees (for two-way time sync)
> > > apply for *RTT* - and definitely *not* for half of RTT. The link symmetry
> > > assumption is one of the weakest point of today's network time
> > > synchronization protocols that malicious actors can exploit.
> > 
> > I don't agree. Because we compensate for half the RTT, the maximum
> > error is reduced to half the RTT. Without the compensation for
> > half the RTT I would agree.
> > 
> > Assume the real time it takes between peers is 1 ms and that there
> > are no other sources of errors. If there is an artificial
> > additional delay of 998 ms in the reply direction, we measure an
> > RTT of 1000 ms.
> 
> I guess my concept of error differs - for me it's the slave's uncertainty
> interval. The half RTT error can happen in both directions.
> 
> Assume that the slave sends the request at local time ts0 and receives the
> server response at local time ts1=ts0+1000ms, slave-measured RTT is 1000ms.
> The master inserted its local timestamp tm into the message. We're ignoring
> local drift/skew.
> 
> Theoretical link delay asymmetry for <forwardLink;reverseLink> can range
> anyhwere from <0,1000> to <1000,0>. The only guaranteed bounds for the slave
> is that abs(ts0) < abs(tm) < abs(ts1) (where - an uncertainty interval of
> one full RTT. Unless physical link properties and constraints are known, any
> other assumption is probabilistic.

What we do to reduce the error, is add 500 ms to tm, and then have an
error from -500 ms to +500 ms. Without adding that 500 ms, the
error is from +0 to +1000 ms.


Kurt