Subject: Re: [ntpwg] NTS: DTLS and symmetric mode

From: Miroslav Lichvar <[email-masked]>
Date: Tue, 1 Aug 2017 09:38:54 +0200

On Mon, Jul 31, 2017 at 02:59:30PM -0400, Daniel Franke wrote:
> On 7/31/17, Harlan Stenn <[email-masked]> wrote:
> > Is DTLS well-suited for symmetric associations, which require mutual
> > authentication?
> 
> Yes. DTLS supports mutual authentication through the use of client
> certificates or pre-shared keys.

That will work nicely for an active-passive association, but I'm still
not sure about active-active associations. You said the source port of
a DTLS client is supposed to be random. How will an active peer know
that an incoming connection corresponds to a peer it has already
connected to or it's trying to connect to? With symmetric keys/autokey
it was possible to have multiple associations with the same IP address
(e.g. multiple machines behind NAT).

I think a bigger problem with NTP over DTLS might be that timing
messages are sent on a different port than 123 and are encrypted. This
makes it incompatible with existing HW/configuration and future NTP
extensions.

Here is the list of issues I posted previously (with no response) [1]:

- no stateless passive mode
- problematic pairing of DTLS sessions
- requires timestamping of messages on a new port
  - won't work with HW which can timestamp only packets on port 123
    (or 319)
  - will require changes in QoS classification on routers/switches
- won't work with future NTP extensions for delay corrections in
  routers/switches

[1] http://lists.ntp.org/pipermail/ntpwg/2017-June/003307.html

-- 
Miroslav Lichvar
_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: [email-masked]
Date: Tue, 1 Aug 2017 17:04:32 +0200

Hi Miroslav,

see my comments below.

"ntpwg" <ntpwg-bounces+dieter.sibold=[email-masked]> schrieb am 
01.08.2017 09:38:54:

> Von: Miroslav Lichvar <[email-masked]>
> An: Daniel Franke <[email-masked]>
> Kopie: ntpwg <[email-masked]>
> Datum: 01.08.2017 09:39
> Betreff: Re: [ntpwg] NTS: DTLS and symmetric mode
> Gesendet von: "ntpwg" <ntpwg-bounces+dieter.sibold=[email-masked]>
> 
Daniel considered this question. He provided a discussion in Sec. 4 of the 
current NTS draft (version -09).

> - requires timestamping of messages on a new port
I don't understand the issue of this.

>   - won't work with HW which can timestamp only packets on port 123
Yes, but the vast majority of NTP servers and clients don't use HW based 
time stamping. Also note, that HW based time stamping is going to be 
difficult for mode 3 and 4 packets also. This packets are protected by NTS 
extension fields and HW time stamping NICs are not able to calculate the 
NTS AEAD information (at least currently).

>   - will require changes in QoS classification on routers/switches
Yes, this is true.

> - won't work with future NTP extensions for delay corrections in
That is probably true. But I don't see the use case for this. Typically 
you apply symmetric mode in a closed environment. If you require the 
additional accuracy of delay corrections in router/switches you would 
apply PTP which already provide these features.

---

From: Miroslav Lichvar <[email-masked]>
Date: Thu, 3 Aug 2017 10:56:10 +0200

> current NTS draft (version -09).

That clarifies some of the issues we discussed before, but it seems to
me it still assumes there can be only one NTS peer per IP address.
That wasn't the case with older authentication mechanisms (symmetric
key, autokey).

> NTS AEAD information (at least currently).

HW doesn't need to know about NTS, it can still be a SW implementation
of NTP+NTS. The problem is with receiving packets. Some HW can provide
timestamps for all received packets, but apparently in some designs
that would have a significant impact on performance, so there is a
filter to limit timestamps to PTP/NTP packets. I think there is at
least one which can be configured to timestamps packets on UDP port
123 or 319, but not other ports.

> apply PTP which already provide these features. 

PTP doesn't have NTS :). Authentication is not the only reason why
people may want to prefer NTP over PTP in local networks.

Anyway, do we know if anyone is actually interested in implementing
this NTP over DTLS symmetric mode?

I'm wondering if it wouldn't be better to leave it out of the draft
and focus on that later if there is interest. It doesn't specify NTS
for broadcast mode either (which of course would be much more
difficult to do).