Subject: [ntpwg] Stonger symmetric NTP authentication

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Fri, 14 Nov 2008 23:12:32 +0530

Hi,

Is there any plan underway to use
HMAC-SHA-1/HMAC-SHA-256/HMAC-SHA-384/etc for NTPv4? We could use the
extension field header to encode the new hash digest, or it could be
prepared in such a way that its generic enough to support any crypto
algorithm. The new extension field header could also include a
monotonically increasing sequence number that could help prevent replay
attacks.

Cheers, Manav
 
_______________________________________________
ntpwg mailing list
[email-masked]
https://lists.ntp.org/mailman/listinfo/ntpwg

---

From: "David L. Mills" <[email-masked]>
Date: Mon, 17 Nov 2008 17:29:59 +0000

As I said previously, the encoding format supports 20-octet digests 
should somebody choose to implement it and preserve backward 
compatibility. You cannot use an extension fielf do specify the digest 
algorithm without imposing a deadly circularity.

There is no need to specify an additional sequence number as that 
function is provided by the transmit timestamp and the loopback check. 
See the protocol specification for justification.

---

From: Danny Mayer <[email-masked]>
Date: Mon, 17 Nov 2008 12:43:39 -0500

> monotonically increasing sequence number that could help prevent replay

There is almost no way to replay a NTP packet even without autokey. With
the sent timestamp plus IP address as a 64-bit nonce it would get
dropped immediately as matching nothing that the requestor is waiting
for and you could never guess the timestamp that was being used. I don't
think that there is any real benefit to going to a new digest. SHA-1 is
being deprecated as not strong enough anyway and all users of this are
moving to SHA-2.

Danny

---

From: TSG <[email-masked]>
Date: Mon, 17 Nov 2008 12:41:53 -0800

Yes
I have a new PKI module which not only scales but which will plug in and 
out of NTP. The design is being patented right now, and we will turn the 
license around so that the public can use it as soon as the filing is done.

Todd Glassey

---

From: Danny Mayer <[email-masked]>
Date: Mon, 17 Nov 2008 16:57:22 -0500

> license around so that the public can use it as soon as the filing is done.

Won't happen. IETF cannot accept encumbered items.

Danny

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Tue, 18 Nov 2008 15:01:29 +0530

> I don't

There have been some hash collisions found with SHA-1, but none against
the construct (HMAC-SHA-1) that I was proposing. Moreover, the attacks
found against SHA-1 would not affect the way hashing is used within the
context of NTP.

Cheers, Manav

---

From: "Bhatia, Manav \(Manav\)" <[email-masked]>
Date: Tue, 18 Nov 2008 15:06:53 +0530

Hi David,

> algorithm without imposing a deadly circularity.

So, are you suggesting that we *cannot* use any hashing algorithm that
goes beyond 20 bytes? If we think there can be some backward
compatibility issues then we need to sort those out.

Cheers, Manav

---

From: "David L. Mills" <[email-masked]>
Date: Tue, 18 Nov 2008 14:08:22 +0000

Manav,

Please, please, read the spec. To distinguish between an extension field 
and a possible MAC is a delicate syntactic adventure, most significantly 
to preserve backwards compatibility.

Dave

Bhatia, Manav (Manav) wrote:

>>> monotonically increasing sequence number that could help
>>
>> prevent replay
>>
>>> attacks.
>>>
>>> Cheers, Manav
>>>