Re: [secdir] secdir review of draft-ietf-tictoc-multi-path-synchronization-05

[Watson Ladd <[e-mail]>]

On Sun, Sep 18, 2016 at 4:22 PM, Tal Mizrahi <[e-mail]> wrote:
> Dear Watson,
>
> Thanks for reviewing the draft.
>
> To address your comments, I would like to suggest the following text for the Security Considerations section.
> Please let us know if this addresses the comments:
>
>
> The security aspects of time synchronization protocols are discussed in detail in [TICTOCSEC]. The methods describe in this document propose to run a time synchronization protocol through redundant paths, and thus allow to detect and mitigate man-in-the-middle attacks, as described in [DELAY-ATT]. It should be noted that when using multiple paths, these paths may partially overlap, and thus an attack that takes place in a common segment of these paths is not mitigated by the redundancy. Moreover, an on-path attacker may in some cases have access to more than one router, or may be able to migrate from one router to another. Therefore, when using multiple paths it is important for the paths to be as diverse and as independent as possible, making the redundancy scheme more tolerant to on-path attacks.

Multipath shouldn't be discussed as a security measure at all. My
reading of the document was that it was simply to get more reliable
packet delays and synchronization. You cannot throw this claim into
the security considerations alone without explaining the rest of the
picture. Why not remove it entirely?

Real attackers get the job done: they grab the community strings and
use them to own every single router you have, or own the sysadmins PC
and go for all the routers at once.  And it's not uncommon for
machines to be connected to only one router: most desktops and laptops
have a single Ethernet port. The proposed text makes extremely common
things sound rare.

>
>
>
> Regards,
> Tal.
>
>>-----Original Message-----
>>From: Watson Ladd [mailto:[e-mail]]
>>Sent: Sunday, September 18, 2016 10:41 PM
>>To: <[e-mail]>; [e-mail]; draft-ietf-tictoc-multi-path-
>>[e-mail]
>>Subject: secdir review of draft-ietf-tictoc-multi-path-synchronization-05
>>
>>I have reviewed this document as part of the security directorate's ongoing
>>effort to review all IETF documents being processed by the IESG.  These
>>comments were written primarily for the benefit of the security area
>>directors.  Document editors and WG chairs should treat these comments just
>>like any other last call comments.
>>
>>The document presents a mechanism for servers and clients to conduct
>>synchronization protocols over multiple paths. I didn't see anything wrong
>>with the mechanism, but I am worried that its security benefits are
>>overstated: independent paths may only be partially independent, and
>>attackers can easily migrate from one router to another in most networks.
>>
>>Sincerely,
>>Watson Ladd



-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.