Subject: [Ntp] Wtrlt: Antw: Re: Ambiguous parsing in draft-stenn-ntp-extension-fields

From: "Ulrich Windl" <[email-masked]>
Date: Tue, 27 Mar 2018 07:52:05 +0200

(Forgot to send reply to the list also)
>>> Ulrich Windl <[email-masked]> schrieb am 27.03.2018 um 07:51
in Nachricht <[email-masked]>:
>>>> Miroslav Lichvar <[email-masked]> schrieb am 26.03.2018 um 16:03 in
> Nachricht <20180326140329.GA26324@localhost>:
> > On Fri, Mar 23, 2018 at 11:11:25PM -0700, Harlan Stenn wrote:
> >> I submit it doesn't matter.  If the "other side" gets the packet and
> >> can't recognize the keyID because the sender is using an expired
> >> autokey, then it is free to return either a crypto-NAK or an
> >> unauthenticated response.
> 
> I think replying unauthenticated really just complicates things, 
> specifically if both cases lead to re-negotiating autokey.
> IMHO an invalid keyID alsways should be answered with a cryptoNAK.
> 
> > 
> > In either case it may be an unexpected response for the client.
> > 
> >> If it sends back a crypto-NAK then the sender knows it has to
> >> re-negotiate autokey.
> > 
> > Are clients sending unauthenticated packets with extension fields
> > supposed to accept packets with crypto-NAKs for synchronization of the
> > clock?
> > 
> >> If it sends back an unauthenticated response, the originating side sees
> >> a packet that passes the loopback test, and is unauthenticated when the
> >> association requires authentication.  So re-negotiate autokey.
> > 
> > I don't see this in the Autokey specification or the ntpd code. The
> > client should restart the protocol when it stops getting useful
> > replies, but this is a change in the protocol.
> > 
> > -- 
> > Miroslav Lichvar
> > 
> > _______________________________________________
> > ntp mailing list
> > [email-masked] 
> > https://www.ietf.org/mailman/listinfo/ntp 
> 
> 
> 
>

---

From: Harlan Stenn <[email-masked]>
Date: Mon, 26 Mar 2018 23:53:55 -0700

>> IMHO an invalid keyID alsways should be answered with a cryptoNAK.

Was the above comment yours Ulrich?

The *only* time this could happen is if the replying systems does not
know that it should be using authentication with the sending side, and I
haven't looked to see how this could happen.

But we're also talking about autokey, which is being deprecated.  Is it
worth spending much time on this?

H
--

-- 
Harlan Stenn <[email-masked]>
http://networktimefoundation.org - be a member!

---

From: "Ulrich Windl" <[email-masked]>
Date: Tue, 27 Mar 2018 09:05:30 +0200

>>> Harlan Stenn <[email-masked]> schrieb am 27.03.2018 um 08:53 in Nachricht

> Was the above comment yours Ulrich?

Yes, forwarding added another level of quoting; sorry!