IETF Proposes Network Time Protocol Updates To Improve Privacy

[straycat19]

The Internet Engineering Task Force (IETF) has published a draft document proposing "backward-compatible updates to the Network Time Protocol to strip unnecessary identifying information from client requests and to improve resilience against blind spoofing of unauthenticated server responses."
 

NTP is an often neglected but critical protocol. Just like DNS, a lot of security decisions depend on accurate times. A lot of security decisions can be affected in subtle and hard to detect ways if an attacker has control over time

 

Historically "backwards compatibility" has been the enemy of good security. That is why periodically Apple has started with a clean slate. One hopes that an RFC can be drafted that improves the reliability of NTP and which can be implemented in a non-disruptive manner.
 

IETF Draft

 

Article