[cip-dev] The security of NTP

* [cip-dev] The security of NTP
@ 2020-07-27  1:59 Daniel Sangorrin
  2020-07-27 11:32 ` Mohammed Billoo
  0 siblings, 1 reply; 6+ messages in thread
From: Daniel Sangorrin @ 2020-07-27  1:59 UTC (permalink / raw)
  To: cip-dev; +Cc: pavel, cip-security

[-- Attachment #1: Type: text/plain, Size: 2532 bytes --]

Hi Pavel,
*I renamed the subject and added cip-security to Cc

> -----Original Message-----
> From: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> On Behalf Of Pavel Machek
> Sent: Friday, July 24, 2020 5:58 PM
> To: cip-dev@lists.cip-project.org
> Subject: Re: [cip-dev] Resource describing the Deby workflow?
> 
> Hi!
> 
> > I'm almost done getting SSL working between the BBB and hawkbit. The
> > last piece of the puzzle is to get NTP working on the BBB (since I
> > need valid time to ensure that the server certificate is valid).
> > Unfortunately, I'm
> 
> Notice that in this case SSL is not adding as much security as you think it does.
> 
> SSL attempts to protect against active attackers, and those can manipulate NTP easily.

In the past, I read a bit about this topic because NTP seemed to be weak against man-in-the-middle attacks and that could cause problems when updating software:
- the device may not be able to judge correctly whether a certificate is expired or not
- the device may reject updates because it thinks they are older than the current update (when using timestamps)

Both cases would cause the device not being updated (a freeze attack).

[Note] civil infrastructure devices may also use GPS Satellites for time synchronization, or contract private leased lines and set up their own NTP server there. Not perfect but probably there are easier ways to compromise your device.

After some reading, I found out that NTP includes authentication support nowadays (symmetric keys, autokey..) but apparently nobody uses them.
https://tools.ietf.org/html/rfc5906
https://chrony.tuxfamily.org/comparison.html (check NTP authentication)

It seems there is a new standard called Network Time Security (NTS) now.
https://www.rfc-editor.org/rfc/rfc8633.html
https://weberblog.net/network-time-security-strengths-weaknesses/
https://www.infoq.com/news/2019/11/cloudflare-open-source-nts/

Also, during my investigation on software update technology I also found out that TUF (the update framework) and its child UPTANE had a separate Time server to limit the freeze attacks.

There was a nice presentation by Justin Cappos in Japan last year:
https://events19.linuxfoundation.org/wp-content/uploads/2018/07/Uptane-2019-Summer-AGL-event.pdf

Thanks,
Daniel

> 
> Best regards,
> 								Pavel
> --
> DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
> HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: Type: text/plain, Size: 419 bytes --]

-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.

View/Reply Online (#5015): https://lists.cip-project.org/g/cip-dev/message/5015
Mute This Topic: https://lists.cip-project.org/mt/75814887/4520388
Group Owner: cip-dev+owner@lists.cip-project.org
Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129055/727948398/xyzzy  [cip-dev@archiver.kernel.org]
-=-=-=-=-=-=-=-=-=-=-=-

^ permalink raw reply	[flat|nested] 6+ messages in thread