Subject: [ntpwg] NTS status

From: Richard Welty <[email-masked]>
Date: Wed, 14 Oct 2015 23:24:44 -0400

my apologies for the delay in getting this status report out to the
working group.

i have worked through most of the ASN1 issues and the code for
the client_assoc and server_assoc exchanges is substantially done,
as well as the unit tests. the client_cookie and server_cookie
code is also mostly done and the unit tests are mostly done.

there are some issues that need to be worked through with the
application of CMS in the various exchanges. this involve how
the ntp code will identify and dispatch NTS messages to the
appropriate handler. i would anticipate that this will be worked
through fairly quickly.

the CMS primitives are uploaded to the NTF servers, but some
small changes haven't made it up yet. i'm anticipating a large
push of code when the assoc and cookie messages are done, including
unit tests.

after that is completed, the remaining tasks will be bolting
up the NTS CMS based authentication code into the existing
ntp reference implementation, completing the NTS time exchanges,
and conformance testing.

_______________________________________________
ntpwg mailing list
[email-masked]
http://lists.ntp.org/listinfo/ntpwg

---

From: Richard Welty <[email-masked]>
Date: Wed, 14 Oct 2015 23:57:31 -0400

oops, one more thing.

there is a function in OpenSSL, X509_ALGOR_cmp, which is the
proper way to compare algorithms when matching up client
proposals against server support, and when doing subsequent
sanity checks during the assoc exchanges.

this function only appeared in (i think) OpenSSL 1.0.1k,
where it had a security bug which is now fixed. a lot of
distributions don't include an OpenSSL this new (i'm using
Ubuntu 14.04 for development and it supplies 1.0.1f). i don't
think that requiring an OpenSSL this new is reasonable; fortunately
the code that needs to be copied from OpenSSL is not that large.

to include it, though, i think we need permission from OpenSSL
and some clarity on what licensing statement they require.
getting this straight probably needs to be done before any
public release.

richard