Telechat Review of draft-ietf-ntp-chronos-17
review-ietf-ntp-chronos-17-intdir-telechat-chown-2023-07-03-00

Hi,

I have reviewed this document as part of the Internet Area directorate's
ongoing effort to review all IETF documents being processed by the IESG.  These
comments were written with the intent of improving the operational aspects of
the IETF drafts. Comments that are not addressed in last call may be included
in AD reviews during the IESG review.  Document editors and WG chairs should
treat these comments just like any other last call comments.

This document describes a tool named Khronos which can be run alongside NTPv4
to mitigate against time-shifting attacks. It achieves this by running less
frequent (than NTP) queries to a small random set of NTP servers (around
~10-15) drawn from a large pool (perhaps ~500), and comparing the resulting
time offsets to those of the system NTP clock.

The document is generally well-written, and for its heavier theoretical detail
refers to a paper published elsewhere by the authors.

I believe the document is close to being ready for publication (Ready with
Nits). I have only a small number of general comments and nits.

General comments:

The term man in the middle (MitM) is used a lot, and includes scenarios where
an attacker owns the NTP server being queried.  Personally, I’d not consider
that a MitM attack as I’d consider the “middle” the elements between the client
and server.  Maybe clarify your meaning.

Is there an assessment of the impact on the existing NTP pool if Khronos is
widely implemented?  It seems that there will be more queries overall, but
perhaps to a more scattered set of servers?

On the security side, does it matter than an observer may be able to detect
when Khronos is being used, by its use of ~500 NTP servers instead of the usual
small fixed number of servers?

Also, how ‘random’ is the selection of servers from the pool?  Might it be
predictable, and if so does that pose risks?

I suppose certain MitM vulnerabilities are more ‘sweeping’ than others, like a
bad actor controlling a major or exclusively used uplink, and thus rather
harder to even impossible to mitigate?  This is the worst case of the second
scenario in 4.3? (Which also seems to say >2/3 controlled, then just below 1/4
controlled?).

Nits:

The word ‘byzantine’ is used several times before it is explained, even with
forward references (except in the start of 4.1) to 4.3, and then in 4.3 I can't
find any use of the word. It would be nice to have it explained on first use.

In a few places the section referencing appears as Section Section.

A couple of Khoronos instances (extra ‘o’).

Best wishes,
Tim