Subject: [Ntp] NTS4UPTP draft

From: Heiko Gerstung <[email-masked]>
Date: Wed, 2 Jun 2021 13:28:33 +0200

So far the feedback regarding our draft is more or less trying to make the point that
instead of securing the currently unsecure protocol B, users should better change the protocol so that it looks almost like secure protocol A
try to use parts of protocol B to enhance protocol A
use protocol A to establish a secure error boundary for protocol B but do not care for all the other possible attack vectors of protocol A. 

Apologies for oversimplifying this, but I believe I explained in detail why none of these three approaches is as good as securing protocol B. 

I read a few times that other WG members are agreeing that PTP needs to be secured. NTS4UPTP is trying to deliver this for the unicast mode of PTP. Given the experience you went through with NTS4NTP I believe it is a sensible approach to divide the job of securing the two different variants of PTP into two drafts. This will enable us to get to a point where we can secure at least unicast PTP a lot faster compared with one big draft that is trying to cover both unicast and multicast. It is clear that you need two different approaches for those two quite different variants and I propose to do this in two drafts instead of one big draft with two parts. 

Regards,

   Heiko

-- 

Heiko Gerstung 

Managing Director 

MEINBERG® Funkuhren GmbH & Co. KG 

Lange Wand 9 

D-31812 Bad Pyrmont, Germany 

Phone: +49 (0)5281 9309-404 

Fax: +49 (0)5281 9309-9404 

Amtsgericht Hannover 17HRA 100322 

Geschäftsführer/Management: Günter Meinberg, Werner Meinberg, Andre Hartmann, Heiko Gerstung 

Email: 

[email-masked]

Web: 

Deutsch https://www.meinberg.de

English https://www.meinbergglobal.com

Do not miss our Time Synchronization Blog: 

https://blog.meinbergglobal.com

Connect via LinkedIn: 

https://www.linkedin.com/in/heikogerstung

---

From: "Dieter Sibold" <[email-masked]>
Date: Wed, 02 Jun 2021 23:40:49 +0200

WG chair hat off!

I think it is common understanding that communication across the 
internet should be protect by security means. It also is common practice 
to protect LAN based communication since experience taught that it is a 
false sense of security to rely only on security gateways to  protect 
against adversaries.

In the past PTP is applied mainly in local networks but today it is 
going to be applied across Internet connection also. From my point of 
view: it is out of question, that an inherent security approach is 
necessary for PTP. Instead, it is necessary to find good arguments for 
not specifying a PTP specific security protocol. Up to now I didn’t 
heard any convincing argument against a PTP specific security approach. 
Hence, I would argue that the two relevant questions are 1) who shall 
specify this approach  and 2) if the working group will be ready to do 
that, which draft should be the basis for this effort?

Who? Basically there is the P1588 wg of IEEE who is currently in charge 
to update  the PTP spec and the NTP wg of IETF who already did work in 
context of PTP (in fact not really the NTP but the TICTOC wg).
- P1588 wg: the member of this group have a lot of elaborated knowledge 
of PTP but their focus and experience are not in the field of security.
- NTP wg: compared to P1588 this wg has less knowledge of PTP. However 
it has better knowledge regarding security protocols and with IETF’s 
security area much more resources in this area too.

Which draft?
Currently, we have three proposals for an PTP security approach. Two 
drafts, one from Heiko and one from Martin and a sketch form Daniel. The 
drafts from Heiko and Martin apply elements of NTS in order to protect 
PTP messages. Both approaches need to extent NTS in order to meet 
requirements specific to PTP. Heiko’s draft focuses on PTP’s unicast 
mode (which is not to be confused with NTP’s message exchange) whereas 
Martin’s draft is more comprehensive and considers all PTP modes. 
Daniel’s proposes to use NTS secured NTP to protect PTP, which is a 
watchdog like approach (certainly, this is a somewhat simplified 
description).

If the wg will do the effort it has to decide which of these drafts 
shall be considered. One of them, all of them or a combination?

Regards
Dieter

On 2 Jun 2021, at 13:28, Heiko Gerstung wrote:

> instead of securing the currently unsecure protocol B, users should 
> better change the protocol so that it looks almost like secure 
> protocol A
> use protocol A to establish a secure error boundary for protocol B but 
> do not care for all the other possible attack vectors of protocol A.
>
>
> Apologies for oversimplifying this, but I believe I explained in 
> detail why none of these three approaches is as good as securing 
> protocol B.
>
>
>
> I read a few times that other WG members are agreeing that PTP needs 
> to be secured. NTS4UPTP is trying to deliver this for the unicast mode 
> of PTP. Given the experience you went through with NTS4NTP I believe 
> it is a sensible approach to divide the job of securing the two 
> different variants of PTP into two drafts. This will enable us to get 
> to a point where we can secure at least unicast PTP a lot faster 
> compared with one big draft that is trying to cover both unicast and 
> multicast. It is clear that you need two different approaches for 
> those two quite different variants and I propose to do this in two 
> drafts instead of one big draft with two parts.
>
>
>
> Regards,
>
>    Heiko
>
>
>
>
> -- 
>
> Heiko Gerstung
>
> Managing Director
>
>
>

> _______________________________________________
> ntp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ntp

---

From: Miroslav Lichvar <[email-masked]>
Date: Thu, 3 Jun 2021 10:02:47 +0200

On Wed, Jun 02, 2021 at 11:40:49PM +0200, Dieter Sibold wrote:
> In the past PTP is applied mainly in local networks but today it is going to
> be applied across Internet connection also.

Just to clarify, do you mean that people are now using PTP to
synchronize clocks over Internet, or that the servers are
accessible from Internet and that's why they need to be secured?

The former wouldn't make sense to me as PTP relies on hardware support
in routers/switches, which is generally missing on Internet.

-- 
Miroslav Lichvar

---

From: Doug Arnold <[email-masked]>
Date: Fri, 4 Jun 2021 16:45:52 +0000

I always recommend to network operators that  If you are transfer time across the Internet it should be NTP.  Nevertheless, Inevitably someone is going to run PTP this way.  However, I don’t know that it is something that we need to protect or encourage.

People do run PTP over large telecom networks.  Power grid operators sometime run PTP between substations on large telecom like networks to back up GNSS.  Financial data centers sometime like to get time over fiber from a remote national lab.  These applications will likely eventual want to improve the robustness by a having a secure version of PTP.

Doug

From: ntp <[email-masked]> on behalf of Miroslav Lichvar <[email-masked]>
Date: Thursday, June 3, 2021 at 4:03 AM
To: Dieter Sibold <[email-masked]>
Cc: Heiko Gerstung <heiko.gerstung=[email-masked]>, NTP WG <[email-masked]>
Subject: Re: [Ntp] NTS4UPTP draft

--
Miroslav Lichvar

---

From: "Ulrich Windl" <[email-masked]>
Date: Mon, 07 Jun 2021 09:22:06 +0200

>>> Doug Arnold <doug.arnold=[email-masked]> schrieb am
04.06.2021 um 18:45 in Nachricht
<[email-masked]>

> I always recommend to network operators that  If you are transfer time
across 
> the Internet it should be NTP.  Nevertheless, Inevitably someone is going to

> run PTP this way.  However, I don’t know that it is something that we need
to 
> protect or encourage.
> 
> People do run PTP over large telecom networks.  Power grid operators 
> sometime run PTP between substations on large telecom like networks to back

> up GNSS.  Financial data centers sometime like to get time over fiber from a

> remote national lab.  These applications will likely eventual want to
improve 
> the robustness by a having a secure version of PTP.

Hi!

Another question is: if PTP is used mostly for corporate "private" networks,
wouldn't "PTP over VPN" do?
If companies have a "private (more or less) fiber", isn't that "security
enough"? 
I mean NTP being a "public" protocol, the "NTP over VPN" wouldn't work.
(Timing-issues left aside)

Regards,
Ulrich

> 
> Doug
> 
> From: ntp <ntp‑[email-masked]> on behalf of Miroslav Lichvar 
> <[email-masked]>
> ‑‑

---

From: Heiko Gerstung <[email-masked]>
Date: Mon, 7 Jun 2021 09:47:47 +0200

>> I always recommend to network operators that  If you are transfer time across
>> run PTP this way.  However, I don’t know that it is something that we need to
>> protect or encourage.
>> remote national lab.  These applications will likely eventual want to improve

> wouldn't "PTP over VPN" do?

It would probably do the trick in some cases, but not in all of them. Especially if you have to set up a VPN infrastructure for a nationwide telecommunication network where you want to synchronize 20k+ devices. 

> If companies have a "private (more or less) fiber", isn't that "security
No. Does your company use SSH or HTTPS or other encrypted/security protocols in your internal LAN?

> (Timing-issues left aside)
One of the reasons PTP is not used over public networks is the fact that it is not secure as-is. Once we fixed that, this might change and open up a whole new set of use-cases and applications. But the main target here is to secure sync in these private wide-area-networks where unicast PTP is in use today. 

Regards,
   Heiko

-- 
Heiko Gerstung 
Managing Director 

 
Email: 

Connect via LinkedIn:

---

From: Doug Arnold <[email-masked]>
Date: Mon, 7 Jun 2021 14:20:36 +0000

PTP over VPN might work.  VPNs are usually carry encrypted traffic and that could lead to a lot of timestamp jitter, if the nodes decrypt messages before deciding whether it should be timestamped or not.

Doug

On 6/7/21, 3:48 AM, "Heiko Gerstung" <heiko.gerstung=[email-masked]> wrote:
>>>> Doug Arnold <doug.arnold=[email-masked]<mailto:doug.arnold=[email-masked]>> schrieb am
> <[email-masked]<mailto:[email-masked]>>
>

Regards,
   Heiko

--
Heiko Gerstung
Managing Director

Email:
[email-masked]<mailto:[email-masked]>
Web:
Deutsch https://www.meinberg.de
English https://www.meinbergglobal.com

Connect via LinkedIn:

Am 07.06.21, 09:22 schrieb "ntp im Auftrag von Ulrich Windl" <[email-masked]<mailto:[email-masked]> im Auftrag von [email-masked]<mailto:[email-masked]>>:

    >
    > Doug
    >
    > From: ntp <ntp‑[email-masked]<mailto:ntp‑[email-masked]>> on behalf of Miroslav Lichvar
    > <[email-masked]<mailto:[email-masked]>>
    > To: Dieter Sibold <[email-masked]<mailto:[email-masked]>>
    > Cc: Heiko Gerstung <heiko.gerstung=[email-masked]<mailto:heiko.gerstung=[email-masked]>>, NTP WG
    > <[email-masked]<mailto:[email-masked]>>
    > [email-masked]<mailto:[email-masked]>

    _______________________________________________
    ntp mailing list
    [email-masked]<mailto:[email-masked]>
    https://www.ietf.org/mailman/listinfo/ntp