Re: [dhcwg] [ntpwg] Fwd: New Version Notification for draft-ogud-dhc-udp-time-option-01.txt

[Michael Richardson <[e-mail]>]

    > On 12/1/2013 11:47 PM, Hal Murray wrote:
    >> Does DNS using DNSSEC return a specific error code for time-invalid?
    >> Or just a generic didn't-work?
    >> 
    >> How close does the time have to be for DNSSEC to work?

Sadly, DNSEXT did not (despite repeatedly trying to socialize this idea a
decade ago) give anything other than SERVERR when things fail.  That isn't to
say that it can be done, but there is no standard way to do this.

Time SHOULD be within 1 hour, but in practice, records are signed with
30-day periods, so as long as you aren't in error across that boundary, 
you could be 12 or even 24 hours off.  

Having your time in the past (trying to validate things in the future) is
likely the more common case -- it's also likely the less vulnerable
situation, as if someone is going to replay old data, they are likely going
to replay it from the real past, not, the future :-)

Many suggest to turn off time validation when a CPE router boots up until it
can validate enough DNS to get time records --- if one runs the DNSSEC for
the NTP server well, then the records will validate for years at a time.
If the CPE touches a file after getting valid time after booting, then the
CPE won't be back in 1970, it will know the time is at least as recent as
when it last validated time via DNSSEC-secured NTP.

Danny Mayer <[e-mail]> wrote:
    > That's a question that should be asked in the dnsext WG mailing list
    > (though technically the Working Group is now closed). Olafur and I
    > (apart from Ted who is IETF area director) are probably the only ones
    > on these lists who participate in that mailing list. Olafur was one of
    > the cochairs of the DNS ext working group.

I have done all of the above.

    > The proposal seems to suggest that a timestamp in 64-bit time_t be
    > distributed by DHCP. I'm not sure why not a NTP timestamp instead.

I agree.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [