Subject: Re: [Ntp] draft-ietf-ntp-mode-6-cmds - WGLC comment resolution

From: Miroslav Lichvar <[email-masked]>
Date: Tue, 3 Jul 2018 13:48:57 +0200

On Tue, Jun 26, 2018 at 02:18:06PM -0400, Brian Haberman wrote:
> All,
>      First, I want to thank those who provided feedback on the mode 6
> commands draft during the last call period. Rather than do a
> blow-by-blow response to those comments, I am going to list out my
> proposed changes to address the comments provided.

Thank you for your work on this, Brian.

> I will wait a week or so before publishing a revision with the above
> proposed changes.

If there is still time, I'd like to suggest adding another important
issue to the security considerations. The protocol is vulnerable to
replay attacks. It was described in CVE-2015-8140. If an attacker
observes mode-6/7 packets that modify the configuration of the server
in any way, the attacker can apply the same change at any time later
simply by sending the packets to the server again. No modification or
update of the MAC is necessary.

-- 
Miroslav Lichvar

---

From: "Ulrich Windl" <[email-masked]>
Date: Tue, 03 Jul 2018 14:23:04 +0200

Hi!

Recently this came into my mind thinking of the mode-6 protocol: Maybe the RFC
for NTP should encourage implementers to provide some monitoring capabilities
(for verifying the correctless of the service and implementation). Then the RFC
may suggest to implement either the mode-6 protocol (for compatibility with
most NTP implementations) or an SNMP-based solution (for compatibility,
also)...

This is about the question whether this draft is needed at all...

Regards,
Ulrich

>>> Miroslav Lichvar <[email-masked]> schrieb am 03.07.2018 um 13:48 in
Nachricht <20180703114857.GA22600@localhost>:
> On Tue, Jun 26, 2018 at 02:18:06PM ‑0400, Brian Haberman wrote:
>> All,
>> blow‑by‑blow response to those comments, I am going to list out my
> replay attacks. It was described in CVE‑2015‑8140. If an attacker
> observes mode‑6/7 packets that modify the configuration of the server
> ‑‑ 
> _______________________________________________
> ntp mailing list
> [email-masked] 
> https://www.ietf.org/mailman/listinfo/ntp

---

From: [email-masked]
Date: Tue, 3 Jul 2018 15:12:20 +0200

Speaking as NTP WG member:

This is a very well written draft. Especially I found the Security 
Consideration to be very useful. I consider it to be ready for 
publication. I found only a small typo in the Sec. 6 in which "nosts 
should be replaced by "hosts".

Dieter

-------------------------------------
Dr. Dieter Sibold
Physikalisch-Technische Bundesanstalt
Q.42 - Zeitverteilung mittels IP
QM-Verantwortlicher der Stelle IT
Bundesallee 100 
D-38116 Braunschweig
Tel:    +49-531-592-84 20
E-Mail: [email-masked]

"ntp" <[email-masked]> schrieb am 26.06.2018 20:18:06:

> Von: "Brian Haberman" <[email-masked]>
> An: "[email-masked]" <[email-masked]>
> Datum: 26.06.2018 20:18
> Betreff: [Ntp] draft-ietf-ntp-mode-6-cmds - WGLC comment resolution
> Gesendet von: "ntp" <[email-masked]>
> 
> All,
>      *If you are not satisfied that your comments were not addressed,
> please respond to the list.*
> 
> 1. I will clarify the limitations on the packet size and the references
> to fields within the packet. This should help with readability and
> comprehension.
> 
> 2. The goal of this draft is to resurrect the mode 6 commands from the
> now-deprecated RFC 1305. Other than the addition of some new commands,
> this document is not meant to enhance the definition of or encourage the
> implementation of mode 6 commands. Rather, it provides a stable
> reference for those implementations that still support mode 6 commands.
> That is why it is an Informational document rather than a Standards
> Track one. The abstract and the introduction will be enhanced to make
> this point clear to the reader upfront.
> 
> 3. Several people asked about when should mode 6 commands be accepted
> and from who. I will add text to the Security Considerations section to
> recommend restricting access to this facility to just those trusted
> devices within your network. I will also see what text might make sense
> for amplification-type attacks.
> 
> Brian
> [Anhang "signature.asc" gelöscht von Dieter Sibold/PTB]

---

From: Brian Haberman <[email-masked]>
Date: Mon, 16 Jul 2018 13:38:01 -0400

All,
     This is my proposed -06 version to address the changes proposed
below as well as the changes suggested after I sent the below note.

http://www.innovationslab.net/~brian/draft-ietf-ntp-mode-6-cmds-06.txt

Regards,
Brian