Subject: [TICTOC] security requirements

From: Douglas Arnold <[email-masked]>
Date: Mon, 21 Jul 2014 13:44:22 -0400

I have a couple of comments on the security requirements document:

1.  First of all this document is a gem.  So many elements of security are
cataloged in such a brief document that it works as a handy reference
guide.

2.  In section 7.1 the author discusses the challenges of not impacting
time transfer accuracy when one-step clocks are used in PTP.  Given that
one-step clocks are popular I wonder if the requirement that security not
impact timing performance be a SHOULD rather than a MUST

3.  It may be our of scope for this document, but it could be interesting
to discuss the exploitation of timing protocols for use in DOS attacks
against non-timing infrastructure. For example a node could request that
PTP unicast sync messages be sent to a spoofed IP address.  There are
issues of this time possible with NTP as well.

-- 
Doug Arnold
Principal Technologist
*JTime!* Meinberg USA
+1-707-303-5559