Re: [Ntp] Roughtime and Delay Attacks

Perhaps I should have been more precise in my description.
Roughtime does look at associations with many different servers, and from 
that tries to find the "outliers" that suggest server malfeasance.
Its criterion for ruling "server X is bad" is not discrepancy with the 
client's local time, but examples where timestamps from one server visibly 
don't fit into the same timing context with timestamps from a majority of 
other servers.
Specifically, it does not have to rely on local time.

But I think all that is pretty far beside the point (the point being that 
the models of Chronos and Roughtime don't fit together well enough to 
transfer techniques against delay attacks from Chronos to Roughtime in a 
helpful way), don't you?

Best regards,
Kristof

Von:    "Hal Murray" <hmurray@megapathdsl.net>
An:     ntp@ietf.org
Kopie:  "Hal Murray" <hmurray@megapathdsl.net>
Datum:  03.04.2019 09:23
Betreff:        Re: [Ntp] Roughtime and Delay Attacks
Gesendet von:   "ntp" <ntp-bounces@ietf.org>

kristof.teichel@ptb.de said:
> Roughtime deliberately looks at the associations to single server and 
tries
> to judge whether (and potentially prove that) each single given  server 
is
> showing signs of malfeasance. 

You can't do that unless you know your local time is accurate.  You 
probably 
need to know how accurate.

Even if you have something like GPS, you need to be suspicious of it. 
There 
have been many firmware bugs, and a 1024 week rollover is coming up this 
weekend.

-- 
These are my opinions.  I hate spam.

_______________________________________________
ntp mailing list
ntp@ietf.org
https://www.ietf.org/mailman/listinfo/ntp