Subject: Re: [ntpwg] [TICTOC] NTP Extension Field without Authentication

From: Dieter Sibold <[email-masked]>
Date: Fri, 02 Nov 2012 14:59:48 +0100

Hi,

I just read through this email thread. As some of you know, I'm 
currently working on an new autokey design. In this design a time 
request would need to use an extension field to submit a hash of the 
clients public key to the server. This also would be an extension field 
without a MAC.

Greetings
Dieter

Am 11.12.11 16:30, schrieb Tal Mizrahi:
> Hi,
>
> Revisiting an issue that was raised a few months ago and is yet to be
> resolved:
>
> RFC 5905 defines an extension field. The RFC states that a MAC must be
> present when there is an extension field.
>
> Obviously, it would be beneficial for various purposes to allow
> Extension Fields independent of whether the MAC is present.
>
> Some people thought this is a mistake in the spec, and that it should be
> included in the errata. Others thought that Extension Fields without MAC
> are something new that needs to be defined in a new document.
>
> This was discussed in IETF 81, and then revisited in the ad-hoc meeting
> in October, but no conclusion was reached.
>
> It would be great to hear the opinion of the WG and the chairs about how
> to proceed with this.
>
> Thanks,
>
> Tal.
>
>
>
> _______________________________________________
> ntpwg mailing list
> [email-masked]
> http://lists.ntp.org/listinfo/ntpwg
>

-- 
Physikalisch-Technische Bundesanstalt
Q.42 - Server Administration
Bundesallee 100
D-38116 Braunschweig
Germany
Tel:    +49 531 592 69 8420
Mobile: +49 152 5487 0739
E-Mail: [email-masked]

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: "David L. Mills" <[email-masked]>
Date: Fri, 02 Nov 2012 15:30:58 +0000

Dieter ,

As the original designer of theAutokey syntax, I have always intended 
that the extension fields be authentiacted using a MAC or be 
self-authenticated; but, even if self-authenticated, the MAC be present 
as all zeros. There are instances in theprotocol dances where the packet 
cannot be reliably authenticated, and in that case the NTP header data 
cannot be used for timekeeping calculations.

Whatever the interpretation of or lack of a MAC, correct packet syntax 
must be assured without necessarily requiring a MAC calculation.

Dave
Dieter Sibold wrote:

> clients public key to the server. This also would be an extension 
> field without a MAC.
>
> Greetings
> Dieter
>
>------------------------------------------------------------------------
>

---

From: [email-masked]
Date: Fri, 2 Nov 2012 16:54:52 +0100

Dave,

thanks for your response. Yes a Null-MAC could solve this question.

Dieter

----------------------------------
Physikalisch-Technische Bundesanstalt
Q.42 - Server Administration
Bundesallee 100 
D-38116 Braunschweig
Tel:    +49-531-592-84 20
E-Mail: [email-masked]

Von:    "David L. Mills" <[email-masked]>
An:     Dieter Sibold <[email-masked]>, 
Kopie:  Tal Mizrahi <[email-masked]>, [email-masked]
Datum:  02.11.2012 16:30
Betreff:        Re: [ntpwg] [TICTOC] NTP Extension Field without 
Authentication

Dieter ,

As the original designer of theAutokey syntax, I have always intended that 
the extension fields be authentiacted using a MAC or be 
self-authenticated; but, even if self-authenticated, the MAC be present as 
all zeros. There are instances in theprotocol dances where the packet 
cannot be reliably authenticated, and in that case the NTP header data 
cannot be used for timekeeping calculations.

Dave
Dieter Sibold wrote: 
Hi, 

I just read through this email thread. As some of you know, I'm currently 
working on an new autokey design. In this design a time request would need 
to use an extension field to submit a hash of the clients public key to 
the server. This also would be an extension field without a MAC. 

Greetings 
Dieter 

Thanks, 

Tal.