Date: Mon, 20 Oct 2014 09:04:57 -0400 From: "Bendler, Ehren" <ebendler@...na.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: RE: attacking hsts through ntp The symmetric schemes do work, but due to data structure sizing only MD5 and SHA-1 hashed PSKs are supported: http://bugs.ntp.org/show_bug.cgi?id=2039 They imply in the comments that it will take a new version of the NTP RFCs to get support for stronger hashing schemes. -----Original Message----- From: Stephen Röttger [mailto:stephen.roettger@...il.com] Sent: Monday, October 20, 2014 5:17 AM To: oss-security@...ts.openwall.com Subject: Re: [oss-security] attacking hsts through ntp >What about RFC 5906 and the current authentication schemes > (http://www.eecis.udel.edu/~mills/ntp/html/authentic.html) ? The protocol from RFC 5906 is completely broken: http://www.eecis.udel.edu/~mills/security.html http://zero-entropy.de/autokey_analysis.pdf The symmetric schemes are probably fine but hard to set up. But it looks like the NIST provides authenticated NTP: http://www.nist.gov/pml/div688/grp40/auth-ntp.cfm
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ