[Ntp] Antw: Re: Follow-up to yesterday's mic comment about PTP security

>>> Daniel Franke <dfoxfranke@gmail.com> schrieb am 24.07.2019 um 16:09 in
Nachricht
<CAJm83bA74UiYbVbfYOHk4Vsw=go0d5P70uwbJ7CDvFrkdtcbfw@mail.gmail.com>:
> On Wed, Jul 24, 2019 at 3:00 AM <kristof.teichel@ptb.de> wrote:
>> 1.
>> It is established in general (and I have a proof lying around for a model
of 
> NTS in particular) that a client performing a request-response exchange with

> NTS and using all relevant checks gets a strong guarantee that the error in

> its measured offset is no larger than half the added flight times of the 
> packets (plus some negligibly small delta accounting for frequency 
> instability of the clocks used on client and server side).
>> For anyone wondering why we bothered to prove this again: this guarantee is

> 100%, and the new part is "no matter what a Man-in-the-Middle attacker did
in 
> the process".
> 
> The "half the RTT" error bound can be improved somewhat if you know
> the physical distance between yourself and the server. In which case

The probem is the "distance" here, as it definitely refers to "cable length",
or more specifically "route length". Back in the time when the WWW started,
connections inside Germany were routed via USA sometimes (that was the time
whan a "good" transferrate was near 5kB/s). To make matters worse, you cannot
safely assume that the route (length) from A to B will be the same as from B to
A.

> the error bound is ±(RTT/2 - distance / speed_of_light), because it is
> safe to assume that the network adversary does not have a wormhole
> through which to route your packets. (If you do have one, Akamai wants
> your resume).
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 