Subject: Re: [ntpwg] [TICTOC] WGLC on NTS: Why not run over IPsec?

From: [email-masked]
Date: Wed, 23 Mar 2016 14:01:43 +0100

Hello Sharon,

essentially, the answer to this question is that at some point it was determined that an inherent solution would benefit NTP more than one which was along the lines of tunneling NTP traffic over some external security protocol.

The main reasoning here was, I believe, that an inherent solution would be easier to tailor to a time synchronization protocol's special needs, particularly for the additional delays caused by the cryptographic operations on time-sensitive packets to be small (and ideally symmetrical).

Best regards,

Kristof

PS: I also want to add that as far as I know, there is nothing in any NTP-related specification that would keep anyone from running NTP over IPsec. On the other hand, there doesn't seem to be a special need for a specification on using IPsec to run NTP over it. I believe this is why, currently, IPsec is simply not mentioned anywhere in an NTP or NTS context.

PPS: Out of curiosity: is there a mode for IPsec which does what NTS is trying to achieve (namely requiring on the server side neither a per-association state nor classic asymmetric cryptography like digital signatures)? If so, some text might be in order somewhere (NTP BCP document?), stating that if IPsec is used for securing NTP, said mode would be the best one to use.

-----"TICTOC" <[email-masked]> schrieb: -----

>An: [email-masked], [email-masked]
>Von: Sharon Goldberg
>Gesendet von: "TICTOC"
>Datum: 23.03.2016 10:07
>Betreff: [TICTOC] WGLC on NTS: Why not run over IPsec?
>
>Dear WG,
>
>Another question, and please forgive me if this was discussed already
>and I missed it.
>
>It would be helpful to know why NTS is not just just running over
>IPsec. (I can see why running NTP over TLS makes little sense, since
>TLS runs over TCP while NTP runs over UDP so everything would
>probably
>break.) But NTP runs over IP. I suppose there are some performance
>hits to using IPsec? What are they?
>
>Thanks,
>Sharon
>
>--
>Sharon Goldberg
>Computer Science, Boston University
>http://www.cs.bu.edu/~goldbe
>
>_______________________________________________
>TICTOC mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tictoc
>

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Sharon Goldberg <[email-masked]>
Date: Wed, 23 Mar 2016 04:01:41 -0400

Dear WG,

Another question, and please forgive me if this was discussed already and I
missed it.

It would be helpful to know why NTS is not just just running over IPsec. (I
can see why running NTP over TLS makes little sense, since TLS runs over
TCP while NTP runs over UDP so everything would probably
break.) But NTP runs over IP. I suppose there are some performance
hits to using IPsec? What are they?

Thanks,
Sharon

---

From: Kurt Roeckx <[email-masked]>
Date: Wed, 23 Mar 2016 18:27:41 +0100

> hits to using IPsec? What are they?

I think the main problem is that they don't want that many IPsec
tunnels at the same time.  As far as I understand it, the design
wants to avoid storing this much state information on the server
side.  I'm not sure I agree with this design decision.

It could also use DTLS instead of TLS, which does work over UDP.

(D)TLS can already store the session on the client side, and
give that to the server on "resumption".  But maybe that would
require too many packets?

I'm also worried about the soundness of the crypto.  I have a
feeling this is designed by people that don't have enough
background to design something like this.  I think it needs to be
looked at by several people who do.  I've asked about this before
but nobody ever replied to it.

Kurt

---

From: Dieter Sibold <[email-masked]>
Date: Thu, 24 Mar 2016 11:04:32 +0100

> Am 23.03.2016 um 18:27 schrieb Kurt Roeckx <[email-masked]>:
> 

At the time we discovered that we cannot use NTP’s autokey approach we also considered to use DTLS. However at this time there has been hardly any implementation of it. Also we learned from  [1] that DTLS is not target for an application with a communication pattern like NTP. 

"Note that the requirement to create a session means that DTLS is primarily suited for long- lived “connection-oriented” protocols as opposed to to- tally connectionless ones like DNS. Connectionless proto- cols are better served by application layer object-security protocols.“  

It might be that today DTLS’ scope has broadened. 

I also want to point out that last year Florian Weimer proposed to utilize DTLS for the key exchange. We regarded his suggestion and moved the CMS based key exchange into an appendix. In the normative part of the document we specified the requirements that have to be meet during the initial phase of NTS. See 6.1.1 in https://tools.ietf.org/html/draft-ietf-ntp-network-time-security-12 <https://tools.ietf.org/html/draft-ietf-ntp-network-time-security-12>
The NTS for NTP draft requires that the CMS-based key exchange is to be implemented. However it allows also the implementation of an alternative key exchange, e.g. DTLS, see 4.1 in https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp-04 <https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp-04>

> but nobody ever replied to it.

We frequently invited people to review the documents. So did the chair of NTP’s working group. Also Kristof gave a presentation of the documents in the SAAG session of 91st IETF.

---

From: Dieter Sibold <[email-masked]>
Date: Thu, 24 Mar 2016 11:36:10 +0100

Sorry, I forgot to add the reference [1]. It is:

1.	Modadugu, N. and E. Rescorla. The Design and Implementation of Datagram TLS. in NDSS. 2004.

> Am 24.03.2016 um 11:04 schrieb Dieter Sibold <[email-masked] <mailto:[email-masked]>>:
> 
>> 
>> Am 23.03.2016 um 18:27 schrieb Kurt Roeckx <[email-masked] <mailto:[email-masked]>>:
>> 
>> [email-masked] <mailto:[email-masked]>
>> http://lists.ntp.org/listinfo/ntpwg <http://lists.ntp.org/listinfo/ntpwg>
> 
> [email-masked] <mailto:[email-masked]>
> https://www.ietf.org/mailman/listinfo/tictoc <https://www.ietf.org/mailman/listinfo/tictoc>

---

From: Sharon Goldberg <[email-masked]>
Date: Thu, 24 Mar 2016 18:35:29 -0400

Kurt,

> You make a really good point here.  I would like to understand better why
DTLS does not work here.

Even if NTS does not run over DTLS, it would be helpful to go over the DTLS
RFCs anyway, since several issues that affect DTLS might also affect NTS.

For example:

1) Have we confirmed the NTS's KE messages can fit in a single IP packet?
If not, and since this is all sent over UDP, there is no guarantee that the
packets arrive in order.  DTLS explicitly addresses this issue, see Section
4.2.3 of the [1] the DTLS RFC.   How will NTS deal with this?

2) Similarly, the KE for NTS will need reliable delivery: if one of the KE
messages fails to arrive, the KE won't complete.  But again, this is sent
over UDP. See Section 4.2.4 of the DTLS RFC [1] for more on this. How will
NTS deal with this issue?

Thanks,
Sharon

[1] https://tools.ietf.org/html/rfc4347

---

From: Harlan Stenn <[email-masked]>
Date: Sat, 26 Mar 2016 00:48:19 +0000

> It could also use DTLS instead of TLS, which does work over UDP.

As I recall when we started the implementation we looked at DTLS and
CMS.  I don't recall why CMS was chosen, but there were good reasons.
Also, there's no reason DTLS could not be used instead.

H