Subject: [Ntp] NTS-KE retry interval

From: Miroslav Lichvar <[email-masked]>
Date: Tue, 17 Mar 2020 11:51:12 +0100

I'm wondering if the draft shouldn't have some recommendations on how
often NTS clients should retry NTS-KE in different cases.

I think when NTS is widely used and servers moderately loaded, it will
be common for a client to not be able to connect on the first attempt.
Establishing or rejecting a TCP connections is cheap, but TLS is very
expensive, so I think they should have a different retry interval.
At least some of the existing implementations (including my own) don't
distinguish between these cases.

The connection attempts could be tied to the NTP polling interval
(typically starting at 64 seconds and increasing to 1024 seconds).

NTS-KE should be slower, but by how much? In terms of CPU load with a
SW implementation, NTS-KE seems to be about two orders of magnitude
more expensive than NTS-NTP, so 100*poll? (that's an interval of
1.7 and 28 hours for 64s and 1024s poll respectively).

There is also a question whether a different interval should be used
after running out of cookies, after receiving an NTS-NAK, and a
general NTS-KE error.

Suggestions?

-- 
Miroslav Lichvar