Re: [TICTOC] Updated draft-ietf-tictoc-security-requirements-07

[[e-mail]]

Hello Tal,

I have one comment regarding Sec. 5.1.3.

This section requires that the master MUST authenticate each client. I 
think that this requirement should be a MAY! In the case of a public time 
service there is no need for the master to authenticate its slaves. The 
spoofing attack described in the second example of 3.2.2 can be mitigated 
by other means such as the introduction of a nonce in a time request or 
delay_req message. 

I agree that in the case of authorization of the slave authentication is 
also necessary. 


Greetings
Dieter 






----------------------------------
Physikalisch-Technische Bundesanstalt
Dr. Dieter Sibold
Q.42 - Serversysteme und Datenhaltung
QM-Verantwortlicher der Stelle IT-Infrastruktur
Bundesallee 100 
D-38116 Braunschweig
Tel: [phone]
E-Mail: [e-mail]



Von:    Tal Mizrahi <[e-mail]>
An:     "[e-mail]" <[e-mail]>, "Yaakov Stein 
([e-mail])" <[e-mail]>, "[e-mail]" 
<[e-mail]>
Kopie:  "Shawn M Emery \([e-mail]\)" 
<[e-mail]>
Datum:  23.04.2014 14:40
Betreff:        [TICTOC] Updated 
draft-ietf-tictoc-security-requirements-07
Gesendet von:   "TICTOC" <[e-mail]>



Hi,
 
I have posted an updated draft.
http://tools.ietf.org/html/draft-ietf-tictoc-security-requirements-07
 
 
The most notable changes in this draft:
1.       I updated the draft to address comments from Shawn, the appointed 
secdir reviewer:
http://www.ietf.org/mail-archive/web/secdir/current/msg04315.html
2.       I updated the draft to address comments from Russell Smiley: 
http://www.ietf.org/mail-archive/web/tictoc/current/msg01387.html
This includes:
- In section 5.1.3 and 5.1.4 we decoupled the authentication and 
authorization requirements. The authentication requirement level was 
changed to ‘MUST’ following the good observation made by Russell: “Absence 
of authentication of slaves may enable MITM attacks delaying delay_req 
packets and thereby distorting the delay_req packet arrival times and 
subsequent departure of delay_resp. The resulting asymmetry could distort 
the subsequent slave clock offset calculations.”
- The authorization requirement remains ‘MAY’ for sections 5.1.3 and 
5.1.4.
3.       The requirement level of section 5.8 was changed to ‘MUST’. The 
background is the insight that MITM attacks (sections 3.2.5, 3.2.6) have 
the same impact and level of difficulty to implement as manipulation 
attacks (section 3.2.1). Hence, a similar requirement level is called for 
in the two cases.
Section 5.8 also clarifies that: “While the security mechanism should 
support the ability to detect delay attacks, it is noted that in some 
networks it is not possible to provide the redundancy needed for such a 
detection mechanism.”
4.       Section 5.2: merged the two sub-requirements to a single 
requirement for integrity protection. The previous phrasing called for 
hop-by-hop integrity protection as a MUST and end-to-end as a SHOULD, but 
some of the feedback we received was that in some scenarios or network 
topologies an end-to-end may provide a higher level of security. The 
current phrasing just presents the tradeoff between peer-to-peer and 
end-to-end.
 
Please let me know if there are any comments.
 
Thanks,
Tal.
 _______________________________________________
TICTOC mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/tictoc