Subject: [Ntp] Draft on using NTS with the pool

From: Watson Ladd <[email-masked]>
Date: Fri, 28 Feb 2020 12:30:26 -0800

Hello,

I've uploaded https://datatracker.ietf.org/doc/draft-ladd-nts-for-ntp-pool/
which contains a putative mechanism for using NTS with the NTP pool.

I'd appreciate comments: there is a lot to think through in this, but
it's important to get NTS adoption. Definitely the draft is in rough
shape, but sooner seemed better than never.

Sincerely,
Watson Ladd

---

From: Marcus Dansarie <[email-masked]>
Date: Sat, 29 Feb 2020 12:25:30 +0100

Thank you for putting this together!

Your draft proposes a more complicated solution than the one I had
envisaged. I imagined something like the following.

1. An NTP client configured with an NTP server address such as
eu.ntp.example.org gets the SRV record for
_ntske._tcp.eu.ntp.example.org. This record points to one of the pool's
NTS-KE servers, e.g. nts.example.org.

2. The client performs an NTS-KE handshake with the pool NTS-KE server.
It sends a NTPv4 Server Negotiation record which either contains the
string eu.ntp.example.org or an IP address to a server belonging to that
pool (i.e. from an A or AAAA record for eu.ntp.example.org).

3. If the client sent a FQDN, the server will pick an NTP server from
that pool and return cookies for that server along with an appropriate
NTP Server Negotiation record. If the client sent an IP address (which
belongs to a server in the pool), the server simply returns cookies and
NTP Server Negotiation record for that address.

4. The client repeats the process as necessary to get NTS cookies for
multiple servers in the pool and then goes on to perform NTS protected
time synchronization with its assigned servers.

This scheme has the advantage that a pool only needs to run one (or a
few) NTS-KE servers with certificates for a single (or a few) domain
names. Each individual server only needs a shared secret with the NTS-KE
server to support NTS. There is no need to obtain and maintain an
individual certificate for each server.

Kind regards,
Marcus

On 2020-02-28 21:30, Watson Ladd wrote:
> _______________________________________________
> ntp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ntp
>