Re:A Memory Safe NTP Implementation
by stefan_ on Tuesday October 11, 2022 @07:07PM
(#33170434)
NTP is insecure, and it fundamentally solves a different problem than the "I need a precise to a second timestamp to validate certificates and update my RTC" need of the majority of devices.
[ Parent
| on HN ]
> NTP is insecure
That's vague. What do you mean specifically? Hostile nodes joining the pools? Any issues with the protocol? Something else?
Re:A Memory Safe NTP Implementation
by bradknowles on Thursday October 13, 2022 @02:19AM
(#33187871)
Yes, the base NTP protocol is unauthenticated UDP. So, that's pretty insecure.
Properly configured, with sufficient upstream time servers, etc... it's still pretty robust against DoS attacks and evil maid attacks, so you'll have to do some work to trick clients into following your fake NTP server. And it will be hard to hide what you're doing while you do it.
It took a while, but I think we've actually solved that security problem with NTS. Now we just have to get the vendors and the community to support and deploy NTS widely.