Subject: [dnsext] sands of time

From: [email-masked]
Date: Tue, 30 Aug 2011 16:11:18 +0000

So DNSSEC introduces a new dependency - the availability of accurate time.
Mnay of the existant tools programatically encode start/stop times for things
like signature validity, packet replay attacks, etc.  To a large degree, at least
in my experience, we tend to use UTC as a baseline.

and now, There is a plan to fundamentally change the calulations of UTC.

Stephan posted this a few days back, I'll note that comments are due by 31aug2011
(thats tomorrow for me)

http://hpiers.obspm.fr/eop-pc/index.php?index=questionnaire

Its worth a look.  

/bill
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Nicholas Weaver <[email-masked]>
Date: Tue, 30 Aug 2011 09:17:37 -0700

> http://hpiers.obspm.fr/eop-pc/index.php?index=questionnaire

This will have pretty much no effect on DNSSEC AFAIK:  Everything is synced by NTP or GPS to UTC (NOT UT1, earth rotational time), and the presence or absence of leap seconds should not come into play one way or the other, since all validators need accurate time syncing anyway.

However, the worry I have is that this makes the UTC -> Local Time calculation screwy: after about what would be 60 leap-seconds, there will be pressure to change the definition of local timezones in bigger leaps.

---

From: Jim Reid <[email-masked]>
Date: Tue, 30 Aug 2011 18:56:01 +0100

On 30 Aug 2011, at 17:17, Nicholas Weaver wrote:

>> There is a plan to fundamentally change the calulations of UTC.

So what? However UTC is calculated, it'll still be UTC. The world will  
still use it for broadcasting timestamps, driving NTP servers, doing  
navigation, etc.

IIUC the ITU-R proposal is to stop adding leap seconds to UTC so that  
it's always within a second of International Atomic Time which pretty  
much only matters to rocket scientists and astronomers who need to  
care about variations in the rotation of the earth. I wonder though  
what motivated this proposed change...

> This will have pretty much no effect on DNSSEC AFAIK:  Everything is  
> synced by NTP or GPS to UTC (NOT UT1, earth rotational time), and  
> the presence or absence of leap seconds should not come into play  
> one way or the other, since all validators need accurate time  
> syncing anyway.

Indeed. Even if a drift between UTC and IAT mattered for DNSSEC, it  
seems unlikely anyone would (need to) use RRSIG validity intervals as  
low as a few seconds.

> However, the worry I have is that this makes the UTC -> Local Time  
> calculation screwy: after about what would be 60 leap-seconds, there  
> will be pressure to change the definition of local timezones in  
> bigger leaps.

Maybe. Or maybe in a few decades leap seconds would come back into  
fashion again. With a leap second typically getting added once every  
18 months or so, it'll be our grandchildren who might have to worry  
about a 60 second drift between UTC and IAT Nicholas. :-)

It's not clear if this ITU-R proposal will be accepted either and if  
it is, it won't be implemented until 2017. So, nothing to see here,  
move along...
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Jim Reid <[email-masked]>
Date: Tue, 30 Aug 2011 19:11:20 +0100

On 30 Aug 2011, at 18:56, Jim Reid wrote:

> it seems unlikely anyone would (need to) use RRSIG validity  
> intervals as low as a few seconds.

Replying to my own posting? Hmmmm....

I smell an April 1st RFC. DNSSEC-quad with picosecond resolution  
RRSIGs. :-)

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 30 Aug 2011 20:17:21 +0200

> http://hpiers.obspm.fr/eop-pc/index.php?index=questionnaire

Well, obviously it is as this proposal never dies. It was brought up a few years ago, and people said clearly "no". Now people ask for this again.

Yes, UTC will be UTC all the time, but why should UTC not be related to earth rotations anymore? In a few years, the sun will not be in the south at noon etc if we drop leap seconds. Sure, the value of "few" is large, but still.

My view: "just say no".

But as Jim said, for DNSSEC, we will still use UTC regardless of whether it is tied to earth rotations or not.

   Patrik

---

From: Tony Finch <[email-masked]>
Date: Tue, 30 Aug 2011 19:39:30 +0100

Nicholas Weaver <[email-masked]> wrote:
> will be pressure to change the definition of local timezones in bigger
> leaps.

No. Local time has a slop on the order of an hour - look at a time zone
map and see how much the land boundaries deviate from 7.5 + n * 15
degrees. The abolition of leap seconds would have no practical effect on
time zones until centuries in the future.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Sole: Easterly 4 or 5, occasionally 6 in south. Moderate. Occasional rain.
Moderate or good.
_______________________________________________
dnsext mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsext

---

From: Tony Finch <[email-masked]>
Date: Tue, 30 Aug 2011 19:55:44 +0100

Patrik Fältström <[email-masked]> wrote:
>
> Well, obviously it is as this proposal never dies. It was brought up a
> few years ago, and people said clearly "no". Now people ask for this
> again.

The proposal has been working its way through the ITU-R processes for over
ten years. There has been no clear consensus either way, so it keeps
getting passed up to the next highest committee meeting. The final
decision will be next year at the world radiocommunication congress, which
is the international treaty agreement meeting of the ITU-R. Being the most
senior decision making body it cannot punt :-)

This is utterly irrelevant to DNSSEC because whatever happens DNSSEC's
idea of time will be civil time, and DNSSEC's accuracy requirements are
very relaxed.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Fair Isle: North or northwest 3 or 4, occasionally 5 at first. Moderate,
occasionally rough at first. Showers. Good.