[TICTOC] security requirements

[Douglas Arnold <[e-mail]>]

I have a couple of comments on the security requirements document:

1.  First of all this document is a gem.  So many elements of security are
cataloged in such a brief document that it works as a handy reference
guide.

2.  In section 7.1 the author discusses the challenges of not impacting
time transfer accuracy when one-step clocks are used in PTP.  Given that
one-step clocks are popular I wonder if the requirement that security not
impact timing performance be a SHOULD rather than a MUST

3.  It may be our of scope for this document, but it could be interesting
to discuss the exploitation of timing protocols for use in DOS attacks
against non-timing infrastructure. For example a node could request that
PTP unicast sync messages be sent to a spoofed IP address.  There are
issues of this time possible with NTP as well.

-- 
Doug Arnold
Principal Technologist
*JTime!* Meinberg USA
[phone]