Re: [TICTOC] WGLC on NTS: Why not run over IPsec?

kristof.teichel@ptb.de Wed, 23 March 2016 13:14 UTC

MIME-Version: 1.0
Importance: Normal
In-Reply-To: <CAJHGrrQH0Ce+UFTy6m=SrzTk0AWmBFywC88HccHy0+WG16ibdQ@mail.gmail.com>
References: <CAJHGrrQH0Ce+UFTy6m=SrzTk0AWmBFywC88HccHy0+WG16ibdQ@mail.gmail.com>
From: kristof.teichel@ptb.de
To: Sharon Goldberg <goldbe@cs.bu.edu>, ntpwg@lists.ntp.org, tictoc@ietf.org
Message-ID: <OF4B113298.5D5188A9-ONC1257F7F.0046A923-C1257F7F.0047919A@ptb.de>
Date: Wed, 23 Mar 2016 14:01:43 +0100
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html; charset="ISO-8859-1"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tictoc/JrSGkbc9Ti7-X_VgrWL7Fd8OYK4>
Subject: Re: [TICTOC] WGLC on NTS: Why not run over IPsec?
Precedence: list

Hello Sharon,

essentially, the answer to this question is that at some point it was determined that an inherent solution would benefit NTP more than one which was along the lines of tunneling NTP traffic over some external security protocol.

The main reasoning here was, I believe, that an inherent solution would be easier to tailor to a time synchronization protocol's special needs, particularly for the additional delays caused by the cryptographic operations on time-sensitive packets to be small (and ideally symmetrical).

Best regards,

Kristof

PS: I also want to add that as far as I know, there is nothing in any NTP-related specification that would keep anyone from running NTP over IPsec. On the other hand, there doesn't seem to be a special need for a specification on using IPsec to run NTP over it. I believe this is why, currently, IPsec is simply not mentioned anywhere in an NTP or NTS context.

PPS: Out of curiosity: is there a mode for IPsec which does what NTS is trying to achieve (namely requiring on the server side neither a per-association state nor classic asymmetric cryptography like digital signatures)? If so, some text might be in order somewhere (NTP BCP document?), stating that if IPsec is used for securing NTP, said mode would be the best one to use.

-----"TICTOC" <tictoc-bounces@ietf.org> schrieb: -----

>An: tictoc@ietf.org, ntpwg@lists.ntp.org
>Von: Sharon Goldberg
>Gesendet von: "TICTOC"
>Datum: 23.03.2016 10:07
>Betreff: [TICTOC] WGLC on NTS: Why not run over IPsec?
>
>Dear WG,
>
>Another question, and please forgive me if this was discussed already
>and I missed it.
>
>It would be helpful to know why NTS is not just just running over
>IPsec. (I can see why running NTP over TLS makes little sense, since
>TLS runs over TCP while NTP runs over UDP so everything would
>probably
>break.) But NTP runs over IP. I suppose there are some performance
>hits to using IPsec? What are they?
>
>Thanks,
>Sharon
>
>--
>Sharon Goldberg
>Computer Science, Boston University
>http://www.cs.bu.edu/~goldbe
>
>_______________________________________________
>TICTOC mailing list
>TICTOC@ietf.org
>https://www.ietf.org/mailman/listinfo/tictoc
>

[TICTOC] WGLC on NTS: Why not run over IPsec? Sharon Goldberg
Re: [TICTOC] WGLC on NTS: Why not run over IPsec? kristof.teichel
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… Kurt Roeckx
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… Dieter Sibold
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… Dieter Sibold
Re: [TICTOC] WGLC on NTS: Why not run over IPsec? Sharon Goldberg
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… Sharon Goldberg
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… Harlan Stenn
Re: [TICTOC] WGLC on NTS: Why not run over IPsec? Yoav Nir
Re: [TICTOC] WGLC on NTS: Why not run over IPsec? kristof.teichel
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… Hal Murray
Re: [TICTOC] [ntpwg] WGLC on NTS: Why not run ove… kristof.teichel