Outline for June 6, 1997

1. Greetings and Felicitations
2. Example Analysis: NTP v 2
   1. Packet receipt, sending: on receipt, if connections compatible, checks not a duplicate by looking at transmit times, checks the last packet received by peer was the last one sent; on failure, set sanity check but continue. Update association to reflect data in newly-0arrived packet; check peer clock, stratum level, validate 2-way communication. If sanity check set, exit. Else estimate delay, clock offset, dispersion, and update local clock.
   2. Delay compensation: statistical in nature, calculates delay and clock offset relative to peer
   3. Access Control: trusted (can synchronize to), friendly (can synchronize), all others (ignore) -- relies on unauthenticated source information in packet
   4. Authentication: optional, uses pairwise secret keys. Authenticator excluded from integrity checking; no key distribution mechanism. Keys assigned on per-host (not per-path) basis.
3. Analysis of NTP: Masquerade
   1. Send packets with bogus source; peer determined by source and destination.
   2. Effect: if fake host kknown to victim and can synchrinize clock, may be ignored due to sample processing and selection operations.
   3. Can cause offsets, delays to alter gradually; victim's clocks will drift
   4. If unknown to victim and can become clock source, can flood with 8 messages and assuming victim gets no others, can now control what is discarded; or, claim low stratum number. Either way, attacker tends to become source
   5. See request, send response before legitimate response; real one discatded
4. Modification
   1. Alter a message to cause recipient to resynchronize, or to break an association
   2. Look at allgorithm; variables reset before packet alteration acted upon
   3. Can alter packet precision, time of sending, and time of last message reception; all others cause discard before changing time (but may change association parameters)
   4. precision: can increase round-trip delay or decrease it (to make it more likely impersonated host will be new time source)
   5. Other two: used to adjust clock offset and delay, so can affect choice of source and frequency of contact
   6. DoS: version, association mode deny services
   7. stratum alters stratum of peer, making it more likely to be a clock source
   8. poll: how often peer is polled (certain limits)
   9. distance: affects delay that victim percieves from primay, and hence affects clock source selection
5. Replay
   1. To cause recipient to resynchronize, or to disable an association
   2. Alternate 2 recorded packets; either they get tossed (new source) or victim isolated
   3. Can set clock backwards
6. Denial of Service
   1. Clock runs on its own power; can cause large errors
7. Fixes
   1. External
   2. Internal: use authentication and include the key index (authenticator). Change peer variables only after authenticating packets. Disallow clocks being set backwards.