Subject: Re: [ntpwg] An attack on the random padding proposed in draft-mayer-ntp-mac-extension-field-00

From: Danny Mayer <[email-masked]>
Date: Wed, 22 Jun 2016 07:39:02 -0400

On 6/21/2016 6:17 PM, Daniel Franke wrote:
> The draft at https://www.ietf.org/id/draft-mayer-ntp-mac-extension-field-00.txt
> proposes adding random padding to the end of MAC tags as a means of
> concealing what MAC algorithm is in use. I question whether this is a
> secret worth protecting. Regardless, however, the approach is
> ineffective. An adversary can trivially detect the true length of the
> MAC tag by flipping some bits toward the end and seeing how the
> receiver responds. If the receiver accepts the packet despite the
> flipped bits, then they were part of the random padding. If the
> receiver rejects the packet, then they were part of the MAC tag.
> 
> 

Yes. We were advised that this was not worth doing so we will remove the
language in the next draft.

Danny
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Daniel Franke <[email-masked]>
Date: Tue, 21 Jun 2016 18:17:19 -0400

---

From: Harlan Stenn <[email-masked]>
Date: Wed, 22 Jun 2016 22:12:40 +0000

> receiver rejects the packet, then they were part of the MAC tag.

It's a bit more complicated than that, but I take your point.

As long as the sender and receiver agree on where the padding goes, that
adds another variable to the equation.

It's also possible to allow multiple MACs, of the form:

...[[EF]*[EF-MAC]]*[LEGACYMAC]?

I'm not saying this is a good/bad idea.  But it goes to detecting
tampering.

We know we want to prevent problems whenever possible.  If it's not
possible to prevent a problem, it's useful to detect the problem.

There are other possiblities too, but it's not clear that it's worth the
effort.  For example, we could include a followup MAC(-1) that was a
signature of the entire sent previous packet.  Since we're doing UDP,
there will be dropped packets, but at least this way it would be another
good way to note that the previous packet had been tampered with.  And
this opens up new DoS avenues, too.

H