Re: [TICTOC] WGLC on NTS: Why not run over IPsec?

[Yoav Nir <[e-mail]>]

Hi. IPsec guy here.

I’m sorry I haven’t been following this discussion, so I’m not sure what the requirements of NTS are.  Whatever they are, I’m pretty sure that AH is not the answer, because AH is being deprecated in many stacks (we’ve done it in 2003).

There are modes of IPsec that do not require per association state, but that depends on what kind of traffic you have and on your trust model (that’s like “threat model” only looking on the bright side of life). For example, there is GDOI where a single key is used for all associations. That’s fine as long as you trust the group members to not impersonate each other.

As for the complexity of IPsec, this is largely a myth. IPsec is no more or less complex then the record layer of TLS/DTLS. The IKE protocol has many more knobs than SSLv3, but by the current version of TLS (TLS 1.2) they’ve caught up with the complexity, offering PFS and non-PFS, PSKs, passwords and what have you. It seems simpler because most of us get to see TLS encased in a browser, while an IKE daemon is usually installed separately and configured through a text file or arcane command-lines.  All consumer operating systems these days have IPsec clients (either L2TP or IKEv2) that are extremely easy to configure.

If you’re really interested in pursuing this, I suggest you summarize the requirements and send a message to the ipsec list. Lots of IPsec people there, including the author of [2].

Yoav

From: TICTOC [mailto:[e-mail]] On Behalf Of Sharon Goldberg
Sent: Friday, March 25, 2016 12:32 AM
To: [e-mail]
Cc: NTP Working Group; [e-mail]
Subject: Re: [TICTOC] WGLC on NTS: Why not run over IPsec?

PPS: Out of curiosity: is there a mode for IPsec which does what NTS is trying to achieve (namely requiring on the server side neither a per-association state nor classic asymmetric cryptography like digital signatures)? If so, some text might be in order somewhere (NTP BCP document?), stating that if IPsec is used for securing NTP, said mode would be the best one to use.

This is a really good question and I tried and failed to answer it so far. IPsec is amazingly complex and easy to configure wrongly.  One thing that I can tell so far is that traffic should be secured in "AH Transport" mode but I cannot figure out what IPsec KE is appropriate.  It does seem that by default IPsec uses mutual authentication of client and server, (while NTS "MUST" accommodate one-sided authentication).  I wonder if IPsec also supports one-sided authentication; at the moment I have not figured out if/how this works.

Maybe if folks from this WG go to IETF (sadly I am not) someone could ask one of the IPsec folks for advice on what KE they suggest?

Anyway I've talked to several friends who are who do research on crypto flaws in practice, and they say the complexity of IPsec is both a barrier to its adoption and also a security risk [1].

Sigh.

Sharon

[1] http://www.spiegel.de/media/media-35529.pdf
[2] https://nohats.ca/wordpress/blog/2014/12/29/dont-stop-using-ipsec-just-yet/



Email secured by Check Point.