Subject: Re: [Ntp] I-D Action: draft-ietf-ntp-using-nts-for-ntp-15.txt

From: Hal Murray <[email-masked]>
Date: Sat, 19 Jan 2019 03:22:50 -0800

Do we need to pay attention to key lifetime for C2S and S2C?

I'm not a crypto geek.  I think there is generally some upper limit on how 
much data can be encrypted with the same key before an attacker's job gets 
easier.  I assume that holds for authentication too.

Is that number so large for the algorithms we will use that we don't have to 
consider it?  Assume the client is sending 1 packet per second...  If the 
answer is over 100 years, I'm happy.

-- 
These are my opinions.  I hate spam.

---

From: Daniel Franke <[email-masked]>
Date: Sat, 19 Jan 2019 10:13:18 -0500

> answer is over 100 years, I'm happy.

The recommendation for AES-SIV is to encrypt no more than 2**48
messages under the same key. At one message per second that's almost 9
million years. If you (unwisely) use AES-GCM instead, where the
recommended limit is 2**32 messages, that's still 136 years.

---

From: Daniel Franke <[email-masked]>
Date: Sat, 19 Jan 2019 10:20:45 -0500

Btw, a related concern is the reason why we chose AES-SIV as the MTI
cipher. A completely stateless server 1) has to resort to random
nonces since it can't keep track of sequence numbers; 2) can't
rate-limit since it can't keep track of packet counts. So an adversary
can keep replaying the same packet and cause it to emit responses at
line rate. With AES-SIV, even so it will still be a very long time
before the server ever collides a nonce, and even once it does the
consequences are insignificant.