Re: [Ntp] Comments on draft-langer-ntp-nts-for-ptp

Hi all,

orginal text:

There might be a more general question that needs to be answered
first. What exactly it means for "NTS" to be applied to a time
synchronization protocol? IIRC we originally had a general NTS
draft and a separate NTS-for-NTP draft.

PTP, like the NTP broadcast mode, cannot be secured to the same extent
as the NTP client-server mode. We had some attempts and they failed.

If I understand it correctly, this draft is not trying to apply the
NTS-NTP principles to PTP. That's not possible. It just reuses the
NTS-KE protocol for its own security protocol. I think that's
perfectly fine as long as there is no confusion about the NTS part.

--

Miroslav Lichvar

Hello Miroslav,

The generic NTS draft has expired and was not continued.

The multicast connections are not comparable to the broadcast connections in NTP.
In NTP, TESLA-secured communication could be broken, because delay attacks are not
detectable. However, in PTP we have two-way communication (Delay Request/Response)
during multicast, which can be used to register runtime changes (RTT). However, a formal
analysis is indeed not available.

Our NTS4PTP design is still in the early phase. In my opinion, it is already fully functional, but
it could still have various design weaknesses. Of course they have to be eliminated ;)

best regards,

martin

-------------------
Martin Langer, M.Eng.
Ostfalia Hochschule für angewandte Wissenschaften
- Hochschule Braunschweig/Wolfenbüttel
University of Applied Sciences

Labor Datentechnik, Labor Design Digitaler Systeme
Fakultät Elektrotechnik
Salzdahlumer Straße 46/48
38302 Wolfenbüttel
Germany

Tel.: +49 5331 939 43370
Web: https://www.ostfalia.de/cms/de/pws/bermbach/mitarbeiter/martin-langer

________________________________
Von: ntp <ntp-bounces@ietf.org> im Auftrag von Miroslav Lichvar <mlichvar@redhat.com>
Gesendet: Montag, 8. März 2021 11:36
An: Watson Ladd
Cc: NTP WG
Betreff: Re: [Ntp] Comments on draft-langer-ntp-nts-for-ptp

On Fri, Mar 05, 2021 at 11:55:22AM -0800, Watson Ladd wrote:
> I think this is an important draft that covers a real usecase, but
> should try to break the flow of NTS a bit less. I hope these comments
> are useful.

There might be a more general question that needs to be answered
first. What exactly it means for "NTS" to be applied to a time
synchronization protocol? IIRC we originally had a general NTS
draft and a separate NTS-for-NTP draft.

PTP, like the NTP broadcast mode, cannot be secured to the same extent
as the NTP client-server mode. We had some attempts and they failed.

If I understand it correctly, this draft is not trying to apply the
NTS-NTP principles to PTP. That's not possible. It just reuses the
NTS-KE protocol for its own security protocol. I think that's
perfectly fine as long as there is no confusion about the NTS part.

--
Miroslav Lichvar

_______________________________________________
ntp mailing list
ntp@ietf.org
https://www.ietf.org/mailman/listinfo/ntp