Re: [secdir] secdir review of draft-ietf-tictoc-multi-path-synchronization-05

[Tal Mizrahi <[e-mail]>]

Hi Ben,

Just to clarify, we are talking about an attacker that adds a malicious delay that may be as low as, say five microseconds (yes, microseconds) beyond the ‘normal’ path delay. A five microsecond additional delay is certainly enough to kill the protocol in various environments such as mobile base stations or power substations.

Five microseconds is just an example. The point is that the attacker adds some additional delay which is at least an order of magnitude lower than the path delay.

Correct me if I am wrong, but a challenge/response will probably not be effective in detecting delay attacks in this order of magnitude.

Best regards,
Tal.

From: Ben Laurie [mailto:[e-mail]]
Sent: Monday, September 19, 2016 2:01 PM
To: Tal Mizrahi
Cc: Watson Ladd; [e-mail]; Karen ODonoghue ([e-mail]); <[e-mail]>; Suresh Krishnan; [e-mail]
Subject: Re: [secdir] secdir review of draft-ietf-tictoc-multi-path-synchronization-05


On 19 September 2016 at 01:34, Tal Mizrahi <[e-mail]<mailto:[e-mail]>> wrote:
Time protocols have a pretty unique property: even if you use the strongest cryptographic mechanisms, the protocol can still easily be attacked by a man-in-the-middle who simply adds a constant delay to some of the packets, and thereby easily manipulates the protocol. The only way to mitigate delay attacks is by redundancy: multiple time sources and/or multiple network paths.

Surely not - challenge/response, for example, would also reveal a delay.