From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Mon Jun 9 12:23:06 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D28881A02CE for ; Mon, 9 Jun 2014 12:23:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.551 X-Spam-Level: X-Spam-Status: No, score=-2.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TPa6omnJvoIl for ; Mon, 9 Jun 2014 12:23:05 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 60DD71A02D3 for ; Mon, 9 Jun 2014 12:23:05 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 316CB86DAE8 for ; Mon, 9 Jun 2014 19:23:05 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 1AC6686D73C for ; Mon, 9 Jun 2014 19:21:41 +0000 (UTC) Received: from defiant.e-webshops.eu ([82.146.122.140]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1Wu58N-000H7Z-0w for ntpwg@lists.ntp.org; Mon, 09 Jun 2014 19:21:41 +0000 Received: from intrepid.roeckx.be (localhost [127.0.0.1]) by defiant.e-webshops.eu (Postfix) with ESMTP id D953E1C20BA; Mon, 9 Jun 2014 21:21:26 +0200 (CEST) Received: by intrepid.roeckx.be (Postfix, from userid 1000) id 9CAC11FE01B4; Mon, 9 Jun 2014 21:21:26 +0200 (CEST) Date: Mon, 9 Jun 2014 21:21:26 +0200 From: Kurt Roeckx To: dieter.sibold@ptb.de Message-ID: <20140609192126.GA14405@roeckx.be> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) X-SA-Exim-Connect-IP: 82.146.122.140 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: kurt@roeckx.be X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: NTP Working Group , Harlan Stenn , "Steven M. Bellovin" Subject: Re: [ntpwg] WG: I-D Action: draft-ietf-ntp-network-time-security-03.txt X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org On Wed, Mar 19, 2014 at 12:00:40PM +0100, dieter.sibold@ptb.de wrote: > > Hi all, > > today we submitted an update of the NTS draft. Basically, we only changed > the error in the formula of the cookie calculation which we introduced in > the 02 version of the draft. The other suggestions of Steven Bellovin and > other comments are currently still under consideration. So I was wondering about the status of this, and would love to hear an update. I've been reading the draft again, and I have some comments. It's my understanding that the reason for the whole cookie thing is that we want to avoid the number of RSA signatures. That makes me wonder the following things: - Do we have any idea how many clients are real ntp clients and not sntp clients? - I assume we want sntp clients to use this too. Is there any idea at which point this solution actually reduces the load on the server and doesn't increase it? I'm expecting sntp clients not to keep state, but I might be wrong here. - Have you considered keys other than RSA like EC? Maybe if we strongly suggest not to use RSA but something faster like EC and sign the reply we we can make things both simpler and reduce load on the server. I've also been thinking wether we should send stapled OCSP responses together with the server certificate. And if we do, do we want to enforce this stapled response or is this a best effort thing? I'm also still wondering about how to bootstrap a system that doesn't know what the current time is, and so doesn't know wether the certificate is still valid or not. Some of the idea's I had: - Require an OCSP response with nonce. But most CAs do not offer this. - Require multiple servers where the issuer of the certificate is from a different root CA. I would like to point out that we only need to do that in case we have no idea what the time is. I think it should be fine once we know within 24 hours what the time is. Kurt _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Tue Jun 10 09:37:48 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CF191A0068 for ; Tue, 10 Jun 2014 09:37:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.251 X-Spam-Level: X-Spam-Status: No, score=-2.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0yLb_wOZGpNw for ; Tue, 10 Jun 2014 09:37:47 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 0034C1A0024 for ; Tue, 10 Jun 2014 09:37:46 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id C037186DAD9 for ; Tue, 10 Jun 2014 16:37:46 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 1314E86D33C for ; Tue, 10 Jun 2014 16:36:27 +0000 (UTC) Received: from defiant.e-webshops.eu ([82.146.122.140]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WuP1y-0003hP-NI for ntpwg@lists.ntp.org; Tue, 10 Jun 2014 16:36:27 +0000 Received: from intrepid.roeckx.be (localhost [127.0.0.1]) by defiant.e-webshops.eu (Postfix) with ESMTP id 5DD2D1C2121; Tue, 10 Jun 2014 18:36:10 +0200 (CEST) Received: by intrepid.roeckx.be (Postfix, from userid 1000) id 20D7D1FE00FF; Tue, 10 Jun 2014 18:36:10 +0200 (CEST) Date: Tue, 10 Jun 2014 18:36:09 +0200 From: Kurt Roeckx To: =?iso-8859-1?Q?R=F6ttger?= Stephen Message-ID: <20140610163609.GA18448@roeckx.be> References: <20140609192126.GA14405@roeckx.be> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) X-SA-Exim-Connect-IP: 82.146.122.140 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: kurt@roeckx.be X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: NTP Working Group , Harlan Stenn , "Steven M. Bellovin" Subject: Re: [ntpwg] WG: I-D Action: draft-ietf-ntp-network-time-security-03.txt X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org On Tue, Jun 10, 2014 at 01:11:17PM +0200, R=F6ttger Stephen wrote: > Hi Kurt, > = > Thanks a lot for your comments. Answers are inline. > = > >So I was wondering about the status of this, and would love to > >hear an update. > = > The major points that we're working on right now are: > - Kristof Teichel found a serious authentication bypass vulnerability in = the > protocol. The secret cookie is signed and then encrypted, making it possi= ble > for a mitm to reencrypt it and forward it to a different client. If it's encrypted (with the client's key), a MITM shouldn't be able to decrypt it, and this reencrypted? Or did I misunderstand something? > >- Have you considered keys other than RSA like EC? Maybe if we > > strongly suggest not to use RSA but something faster like EC > > and sign the reply we we can make things both simpler and reduce > > load on the server. > = > I think we don't specify which algorithms should be used for the signatur= es > and encryption. We only say that the server uses X.509 certificates to pr= ove > his identity, so any protocol supported by X.509 should be possible for u= s. Which makes me wonder if the client should send which types of key's it's willing to support, and if that's already planned or not. The server might for instance want to use ECDSA. But that's a sign only key that doesn't support encryption. Would this work on the server side? On the client side? Would it require to also do ECDHE in that case? > As per suggestion of Steve Bellovin, we are currently thinking about > replacing the public key sent by the client with a X.509 certificate as > well, which would allow the client to choose the encryption method through > the certificate. We only use assymetric cryptography like RSA? There is no transtion to something like AES? > I tried to find out before how OCSP servers handle revoked but expired > certificates. I couldn't find any specifics about this but I assume that > they can purge their database and remove expired certificates from them a= nd > then reply with 'certificate not revoked'. > Does anyone know more about this? I think the best information for this is the CA/Browser forum baseline requirements. It has those section in it which I think are relevant: | 13.2.4 Deletion of Entries | Revocation entries on a CRL or OCSP Response MUST NOT be removed | until after the Expiry Date of the revoked Certificate. [...] | 13.2.6 Response for non-issued certificates | If the OCSP responder receives a request for status of a | certificate that has not been issued, then the responder SHOULD | NOT respond with a "good" status. The CA SHOULD monitor the | responder for such requests as part of its security response | procedures. I assume that 13.2.6 applies to expired certificates too. > >I'm also still wondering about how to bootstrap a system that > >doesn't know what the current time is, and so doesn't know wether > >the certificate is still valid or not. Some of the idea's I had: > >- Require an OCSP response with nonce. But most CAs do not offer > > this. > >- Require multiple servers where the issuer of the certificate > > is from a different root CA. > = > >I would like to point out that we only need to do that in case we > >have no idea what the time is. I think it should be fine once we > >know within 24 hours what the time is. > > Your're right, this is a difficult problem and I think we will have to pu= t more work into it. My thoughts so far: > = > If we don't know the current time, we can't tell if a certificate is alre= ady > expired and thus I would argue that it's more likely that the private key > has been compromised. The private key for an expired certificate might not > be as well protected anymore since the certificate is expired anyway. > A compromised server certificate won't be that big of a problem because we > usually use multiple servers for time synchronization anyway. > Leaving us with the scenario of a compromised CA certificate. I'm not that > familiar with OCSP, but I assume in this case the attacker could also fake > the OCSP replies. OCSP is signed by the CA. But you need to do OCSP for each certificate in the chain. Kurt _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Tue Jun 10 14:33:41 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8B841A02C6 for ; Tue, 10 Jun 2014 14:33:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.251 X-Spam-Level: X-Spam-Status: No, score=-2.251 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, MIME_8BIT_HEADER=0.3, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E3Y-GnsIgJJ0 for ; Tue, 10 Jun 2014 14:33:40 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 9DBED1A02ED for ; Tue, 10 Jun 2014 14:33:40 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 9900B86D907 for ; Tue, 10 Jun 2014 21:33:40 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 99BBD86D33C for ; Tue, 10 Jun 2014 21:33:21 +0000 (UTC) Received: from defiant.e-webshops.eu ([82.146.122.140]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WuTfI-0005N5-PL for ntpwg@lists.ntp.org; Tue, 10 Jun 2014 21:33:21 +0000 Received: from intrepid.roeckx.be (localhost [127.0.0.1]) by defiant.e-webshops.eu (Postfix) with ESMTP id 2A84F1C2121; Tue, 10 Jun 2014 23:33:05 +0200 (CEST) Received: by intrepid.roeckx.be (Postfix, from userid 1000) id 013D91FE00FF; Tue, 10 Jun 2014 23:33:04 +0200 (CEST) Date: Tue, 10 Jun 2014 23:33:04 +0200 From: Kurt Roeckx To: =?iso-8859-1?Q?R=F6ttger?= Stephen Message-ID: <20140610213304.GA29790@roeckx.be> References: <20140609192126.GA14405@roeckx.be> <20140610163609.GA18448@roeckx.be> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20140610163609.GA18448@roeckx.be> User-Agent: Mutt/1.5.23 (2014-03-12) X-SA-Exim-Connect-IP: 82.146.122.140 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: kurt@roeckx.be X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: NTP Working Group , Harlan Stenn , "Steven M. Bellovin" Subject: Re: [ntpwg] WG: I-D Action: draft-ietf-ntp-network-time-security-03.txt X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org On Tue, Jun 10, 2014 at 06:36:09PM +0200, Kurt Roeckx wrote: > On Tue, Jun 10, 2014 at 01:11:17PM +0200, R=F6ttger Stephen wrote: > > Hi Kurt, > > = > > Thanks a lot for your comments. Answers are inline. > > = > > >So I was wondering about the status of this, and would love to > > >hear an update. > > = > > The major points that we're working on right now are: > > - Kristof Teichel found a serious authentication bypass vulnerability i= n the > > protocol. The secret cookie is signed and then encrypted, making it pos= sible > > for a mitm to reencrypt it and forward it to a different client. > = > If it's encrypted (with the client's key), a MITM shouldn't be > able to decrypt it, and this reencrypted? Or did I misunderstand > something? The MITM could of course have used his own key, so could decrypt it. Kurt _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Fri Jun 20 06:11:23 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 704B81B27E7 for ; Fri, 20 Jun 2014 06:11:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -104.851 X-Spam-Level: X-Spam-Status: No, score=-104.851 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.651, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Mh3nDP1TAUOL for ; Fri, 20 Jun 2014 06:11:14 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id 1D5CB1B27DF for ; Fri, 20 Jun 2014 06:11:11 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id EE13786DAAF for ; Fri, 20 Jun 2014 13:11:10 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 7309086D33C for ; Fri, 20 Jun 2014 13:08:45 +0000 (UTC) Received: from rfc-editor.org ([4.31.198.49]) by mail1.ntp.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WxyYV-0000v1-7w for ntpwg@lists.ntp.org; Fri, 20 Jun 2014 13:08:45 +0000 Received: by rfc-editor.org (Postfix, from userid 30) id 19E5318000E; Fri, 20 Jun 2014 06:07:08 -0700 (PDT) To: kitasuka@cs.kumamoto-u.ac.jp, mills@udel.edu, jrmii@isc.org, jack.burbank@jhuapl.edu, william.kasch@jhuapl.edu X-PHP-Originating-Script: 1005:errata_mail_lib.php From: RFC Errata System Message-Id: <20140620130708.19E5318000E@rfc-editor.org> Date: Fri, 20 Jun 2014 06:07:08 -0700 (PDT) X-SA-Exim-Connect-IP: 4.31.198.49 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: wwwrun@rfc-editor.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: ntpwg@lists.ntp.org, iesg@ietf.org, rfc-editor@rfc-editor.org Subject: [ntpwg] [Errata Verified] RFC5905 (4019) X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org The following errata report has been verified for RFC5905, "Network Time Protocol Version 4: Protocol and Algorithms Specification". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=5905&eid=4019 -------------------------------------- Status: Verified Type: Editorial Reported by: Teruaki Kitasuka Date Reported: 2014-06-20 Verified by: Brian Haberman (IESG) Section: 11.2.1 Original Text ------------- An example of this calculation is shown by the rootdist() routine in Appendix A.5.1.1. Corrected Text -------------- An example of this calculation is shown by the root_dist() routine in Appendix A.5.5.2. Notes ----- No rootdist() routine is in Appendix. root_dist() appears in Appendix A.5.5.2. -------------------------------------- RFC5905 (draft-ietf-ntp-ntpv4-proto-13) -------------------------------------- Title : Network Time Protocol Version 4: Protocol and Algorithms Specification Publication Date : June 2010 Author(s) : D. Mills, J. Martin, Ed., J. Burbank, W. Kasch Category : PROPOSED STANDARD Source : Network Time Protocol Area : Internet Stream : IETF Verifying Party : IESG _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Wed Jun 25 11:58:16 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 482FC1B2E12 for ; Wed, 25 Jun 2014 11:58:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.551 X-Spam-Level: X-Spam-Status: No, score=-102.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UIlReompQFli for ; Wed, 25 Jun 2014 11:58:06 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id CE9DE1B2E0A for ; Wed, 25 Jun 2014 11:58:06 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 89BA086DAAF for ; Wed, 25 Jun 2014 18:58:06 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 4B48586D2C0 for ; Wed, 25 Jun 2014 18:57:43 +0000 (UTC) Received: from rfc-editor.org ([2001:1900:3001:11::31]) by mail1.ntp.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1WzsO0-000DG1-5S for ntpwg@lists.ntp.org; Wed, 25 Jun 2014 18:57:43 +0000 Received: by rfc-editor.org (Postfix, from userid 30) id AA4A6180451; Wed, 25 Jun 2014 11:55:52 -0700 (PDT) To: julien.cretin@trust-in-soft.com, mills@udel.edu, jrmii@isc.org, jack.burbank@jhuapl.edu, william.kasch@jhuapl.edu X-PHP-Originating-Script: 1005:errata_mail_lib.php From: RFC Errata System Message-Id: <20140625185552.AA4A6180451@rfc-editor.org> Date: Wed, 25 Jun 2014 11:55:52 -0700 (PDT) X-SA-Exim-Connect-IP: 2001:1900:3001:11::31 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: wwwrun@rfc-editor.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: ntpwg@lists.ntp.org, iesg@ietf.org, rfc-editor@rfc-editor.org Subject: [ntpwg] [Errata Held for Document Update] RFC5905 (4025) X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org The following errata report has been held for document update for RFC5905, "Network Time Protocol Version 4: Protocol and Algorithms Specification". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=5905&eid=4025 -------------------------------------- Status: Held for Document Update Type: Editorial Reported by: Julien Cretin Date Reported: 2014-06-25 Held by: Brian Haberman (IESG) Section: 6 Original Text ------------- -678,491 Corrected Text -------------- -678,941 Notes ----- In Figure 4, the MJD of 1 Jan 0 has a typo. There are 365 (not 815) days from 1 Jan -1 to 1 Jan 0, and 366 (not -84) from 1 Jan 0 to 1 Jan 1. I took NTP Timestamp Era Offset as a reference for the number of days in these years. -------------------------------------- RFC5905 (draft-ietf-ntp-ntpv4-proto-13) -------------------------------------- Title : Network Time Protocol Version 4: Protocol and Algorithms Specification Publication Date : June 2010 Author(s) : D. Mills, J. Martin, Ed., J. Burbank, W. Kasch Category : PROPOSED STANDARD Source : Network Time Protocol Area : Internet Stream : IETF Verifying Party : IESG _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Wed Jun 25 23:49:53 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 628AF1B2AD2 for ; Wed, 25 Jun 2014 23:49:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.551 X-Spam-Level: X-Spam-Status: No, score=-2.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tAyS1QpXkzth for ; Wed, 25 Jun 2014 23:49:51 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 511661B2F24 for ; Wed, 25 Jun 2014 23:49:51 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 498E486D77E for ; Thu, 26 Jun 2014 06:49:51 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 9447B86D2C0 for ; Thu, 26 Jun 2014 06:49:37 +0000 (UTC) Received: from mail.ietf.org ([4.31.198.44]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1X03Uu-000Giq-7p for ntpwg@lists.ntp.org; Thu, 26 Jun 2014 06:49:37 +0000 Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 198F31B2F29 for ; Wed, 25 Jun 2014 23:49:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DqFmBB-90nhp; Wed, 25 Jun 2014 23:49:20 -0700 (PDT) Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 89A9E1B2E5A; Wed, 25 Jun 2014 23:49:20 -0700 (PDT) MIME-Version: 1.0 From: internet-drafts@ietf.org To: i-d-announce@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 5.5.0.p3 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <20140626064920.31836.75149.idtracker@ietfa.amsl.com> Date: Wed, 25 Jun 2014 23:49:20 -0700 X-SA-Exim-Connect-IP: 4.31.198.44 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: internet-drafts@ietf.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: ntpwg@lists.ntp.org Subject: [ntpwg] I-D Action: draft-ietf-ntp-extension-field-01.txt X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Network Time Protocol Working Group of the IETF. Title : Using NTP Extension Fields without Authentication Authors : Tal Mizrahi Danny Mayer Filename : draft-ietf-ntp-extension-field-01.txt Pages : 9 Date : 2014-06-25 Abstract: The Network Time Protocol Version 4 (NTPv4) defines the optional usage of extension fields. An extension field is an optional field that resides at the end of the NTP header, and can be used to add optional capabilities or additional information that is not conveyed in the standard NTP header. The current definition of extension fields in NTPv4 is somewhat ambiguous regarding the connection between extension fields and the presence of a Message Authentication Code (MAC). This draft clarifies the usage of extension fields in the presence and in the absence of a MAC, while maintaining interoperability with existing implementations. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-ntp-extension-field/ There's also a htmlized version available at: http://tools.ietf.org/html/draft-ietf-ntp-extension-field-01 A diff from the previous version is available at: http://www.ietf.org/rfcdiff?url2=draft-ietf-ntp-extension-field-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Wed Jun 25 23:50:54 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C19201B2AD2 for ; Wed, 25 Jun 2014 23:50:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.85 X-Spam-Level: X-Spam-Status: No, score=-4.85 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-0.651] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f2suCIeCVy42 for ; Wed, 25 Jun 2014 23:50:53 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by ietfa.amsl.com (Postfix) with ESMTP id 767851B2E5A for ; Wed, 25 Jun 2014 23:50:53 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 6BB5186DAF6 for ; Thu, 26 Jun 2014 06:50:53 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id 6A09A86D2C0 for ; Thu, 26 Jun 2014 06:50:49 +0000 (UTC) Received: from mx0b-0016f401.pphosted.com ([67.231.156.173]) by mail1.ntp.org with esmtps (TLSv1:AES256-SHA:256) (Exim 4.77 (FreeBSD)) (envelope-from ) id 1X03W3-000Gl3-5k for ntpwg@lists.ntp.org; Thu, 26 Jun 2014 06:50:49 +0000 Received: from pps.filterd (m0045851.ppops.net [127.0.0.1]) by mx0b-0016f401.pphosted.com (8.14.5/8.14.5) with SMTP id s5Q6oZ7Z010704; Wed, 25 Jun 2014 23:50:35 -0700 Received: from sc-owa03.marvell.com ([199.233.58.149]) by mx0b-0016f401.pphosted.com with ESMTP id 1mr9khh0ms-24 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 25 Jun 2014 23:50:35 -0700 Received: from YK-HUB02.marvell.com (10.4.102.52) by SC-OWA03.marvell.com (10.93.76.24) with Microsoft SMTP Server (TLS) id 8.3.327.1; Wed, 25 Jun 2014 23:50:30 -0700 Received: from IL-MB01.marvell.com ([10.4.102.53]) by YK-HUB02.marvell.com ([10.4.102.52]) with mapi; Thu, 26 Jun 2014 09:50:28 +0300 From: Tal Mizrahi To: "ntpwg@lists.ntp.org" , "Karen ODonoghue (odonoghue@isoc.org)" Date: Thu, 26 Jun 2014 09:50:26 +0300 Thread-Topic: Updated draft-ietf-ntp-extension-field-01 Thread-Index: Ac+RCss1w/Y9q3GJTiahOdW/USgx3Q== Message-ID: <74470498B659FA4687F0B0018C19A89C01E731F02320@IL-MB01.marvell.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.12.52, 1.0.14, 0.0.0000 definitions=2014-06-26_03:2014-06-25, 2014-06-26, 1970-01-01 signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=7.0.1-1402240000 definitions=main-1406260085 X-SA-Exim-Connect-IP: 67.231.156.173 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: talmi@marvell.com X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Subject: [ntpwg] Updated draft-ietf-ntp-extension-field-01 X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============6981245483518322596==" Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org --===============6981245483518322596== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_74470498B659FA4687F0B0018C19A89C01E731F02320ILMB01marve_" --_000_74470498B659FA4687F0B0018C19A89C01E731F02320ILMB01marve_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi, Uploaded a new draft to avoid expiration. http://tools.ietf.org/html/draft-ietf-ntp-extension-field-01 No changes since last draft. Thanks, Tal. --_000_74470498B659FA4687F0B0018C19A89C01E731F02320ILMB01marve_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi,

 

Uploaded a= new draft to avoid expiration.

http://to= ols.ietf.org/html/draft-ietf-ntp-extension-field-01

 

No changes since = last draft.

 

Thanks,

Tal.

<= p class=3DMsoNormal> 

= --_000_74470498B659FA4687F0B0018C19A89C01E731F02320ILMB01marve_-- --===============6981245483518322596== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg --===============6981245483518322596==-- From ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Thu Jun 26 00:00:38 2014 Return-Path: X-Original-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Delivered-To: ietfarch-ntp-archives-ahFae6za@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 318FE1B2AE5 for ; Thu, 26 Jun 2014 00:00:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.551 X-Spam-Level: X-Spam-Status: No, score=-102.551 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.651, USER_IN_WHITELIST=-100] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cwn_2QeWLU_h for ; Thu, 26 Jun 2014 00:00:36 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [IPv6:2001:4f8:fff7:1::7]) by ietfa.amsl.com (Postfix) with ESMTP id 3C7061B2AD0 for ; Thu, 26 Jun 2014 00:00:36 -0700 (PDT) Received: from lists.ntp.org (lists.ntp.org [149.20.68.7]) by lists.ntp.org (Postfix) with ESMTP id 32B6286DAF5 for ; Thu, 26 Jun 2014 07:00:36 +0000 (UTC) X-Original-To: ntpwg@lists.ntp.org Delivered-To: ntpwg@lists.ntp.org Received: from mail1.ntp.org (mail1.ntp.org [IPv6:2001:4f8:fff7:1::5]) by lists.ntp.org (Postfix) with ESMTP id D32FD86D2C0 for ; Thu, 26 Jun 2014 07:00:31 +0000 (UTC) Received: from rfc-editor.org ([4.31.198.49]) by mail1.ntp.org with esmtp (Exim 4.77 (FreeBSD)) (envelope-from ) id 1X03fT-000GsH-6d for ntpwg@lists.ntp.org; Thu, 26 Jun 2014 07:00:31 +0000 Received: by rfc-editor.org (Postfix, from userid 30) id 1A896180202; Wed, 25 Jun 2014 23:58:38 -0700 (PDT) To: brian@innovationslab.net, mills@udel.edu, brian@innovationslab.net, ted.lemon@nominum.com, odonoghue@isoc.org X-PHP-Originating-Script: 6000:errata_mail_lib.php From: RFC Errata System Message-Id: <20140626065838.1A896180202@rfc-editor.org> Date: Wed, 25 Jun 2014 23:58:38 -0700 (PDT) X-SA-Exim-Connect-IP: 4.31.198.49 X-SA-Exim-Rcpt-To: ntpwg@lists.ntp.org X-SA-Exim-Mail-From: wwwrun@rfc-editor.org X-SA-Exim-Version: 4.2 X-SA-Exim-Scanned: Yes (on mail1.ntp.org) Cc: ntpwg@lists.ntp.org, rfc-editor@rfc-editor.org Subject: [ntpwg] [Editorial Errata Reported] RFC5906 (4026) X-BeenThere: ntpwg@lists.ntp.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: IETF Working Group for Network Time Protocol List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org Sender: ntpwg-bounces+ntp-archives-ahfae6za=lists.ietf.org@lists.ntp.org The following errata report has been submitted for RFC5906, "Network Time Protocol Version 4: Autokey Specification". -------------------------------------- You may review the report below and at: http://www.rfc-editor.org/errata_search.php?rfc=5906&eid=4026 -------------------------------------- Type: Editorial Reported by: Tal Mizrahi Section: 10 Original Text ------------- One or more extension fields follow the NTP packet header and the last followed by the MAC. The extension field parser initializes a pointer to the first octet beyond the NTP packet header and calculates the number of octets remaining to the end of the packet. If the remaining length is 20 (128-bit digest plus 4-octet key ID) or 22 (160-bit digest plus 4-octet key ID), the remaining data are the MAC and parsing is complete. If the remaining length is greater than 22, an extension field is present. If the remaining length is less than 8 or not a multiple of 4, a format error has occurred and the packet is discarded; otherwise, the parser increments the pointer by the extension field length and then uses the same rules as above to determine whether a MAC is present or another extension field. Corrected Text -------------- One or more extension fields follow the NTP packet header and the last followed by the MAC. The extension field parser initializes a pointer to the first octet beyond the NTP packet header and calculates the number of octets remaining to the end of the packet. If the remaining length is 20 (128-bit digest plus 4-octet key ID) or 24 (160-bit digest plus 4-octet key ID), the remaining data are the MAC and parsing is complete. If the remaining length is greater than 24, an extension field is present. If the remaining length is less than 8 or not a multiple of 4, a format error has occurred and the packet is discarded; otherwise, the parser increments the pointer by the extension field length and then uses the same rules as above to determine whether a MAC is present or another extension field. Notes ----- The original text stated that a MAC is present if the remaining length is 20 octets or 22 octets. This was a typo; the correct statement is that a MAC is present if the remaining length is 20 octets or *24 octets*. Instructions: ------------- This errata is currently posted as "Reported". If necessary, please use "Reply All" to discuss whether it should be verified or rejected. When a decision is reached, the verifying party (IESG) can log in to change the status and edit the report, if necessary. -------------------------------------- RFC5906 (draft-ietf-ntp-autokey-08) -------------------------------------- Title : Network Time Protocol Version 4: Autokey Specification Publication Date : June 2010 Author(s) : B. Haberman, Ed., D. Mills Category : INFORMATIONAL Source : Network Time Protocol Area : Internet Stream : IETF Verifying Party : IESG _______________________________________________ ntpwg mailing list ntpwg@lists.ntp.org http://lists.ntp.org/listinfo/ntpwg