Subject: Re: [ntpwg] New Draft: draft-mizrahi-ntp-checksum-trailer-00

From: Danny Mayer <[email-masked]>
Date: Mon, 29 Jul 2013 12:54:49 -0400

I have serious concerns about this draft. I effect it seems to say that
any intermediate mode can alter the contents of the packet in flight and
thus encourage a MIM attack. Furthermore it recommends recomputing the
MAC. Why bother to do it this way if you can just recompute the MAC (if
any) and then UDP checksum and place it in the UDP checksum field. I'd
rather have the new timestamp placed in the extension field so that the
receiving server can use it or not.

The security considerations makes no mention of these issues.

Danny
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Tal Mizrahi <[email-masked]>
Date: Mon, 29 Jul 2013 23:46:18 +0300

Hi Danny,

I understand your concern, and I would like to clarify an important point: I believe the functionality described in this draft is useful in unauthenticated mode, and not useful in authenticated mode. In authenticated mode, an intermediate entity that changes the packet would have to re-compute the MAC, so re-computing the UDP checksum as well does not significantly complicate the intermediate entity.

I tried to explain this point in the draft (the text is quoted below), but if the working group feels strongly about it I am willing to make it a stronger statement - that the checksum trailer is only  relevant to unauthenticated mode, and is not to be used in authenticated mode.

Danny, does this make sense?

Quoting from section 3.4 of the draft:
   While a Checksum Trailer MAY be used when authentication is enabled,
   in practice the Checksum Trailer is more useful in unauthenticated
   mode, allowing the intermediate entity to perform serial processing
   of the packet without storing-and-forwarding it.

Tal.

-----Original Message-----
From: Danny Mayer [mailto:[email-masked]] 
Sent: Monday, July 29, 2013 6:55 PM
To: Tal Mizrahi
Cc: [email-masked]; [email-masked]; David L. Mills
Subject: Re: [ntpwg] New Draft: draft-mizrahi-ntp-checksum-trailer-00

I have serious concerns about this draft. I effect it seems to say that any intermediate mode can alter the contents of the packet in flight and thus encourage a MIM attack. Furthermore it recommends recomputing the MAC. Why bother to do it this way if you can just recompute the MAC (if
any) and then UDP checksum and place it in the UDP checksum field. I'd rather have the new timestamp placed in the extension field so that the receiving server can use it or not.

Danny

---

From: Danny Mayer <[email-masked]>
Date: Mon, 29 Jul 2013 17:15:15 -0400

> Danny, does this make sense?

Not to me. If you are already changing the packet directly why not
change the packet UDP checksum as well while you're at it?

I'd rather see the corrected time in an extension field rather than
changing the packet itself.

Danny