Re: [dhcwg] DNSSEC in names vs. numbers for NTP server information in DHCP

Shane Kerr wrote:
> All,
> 
> I was reading the long, long, long thread(s) about putting NTP information into
> DHCP, and the focus on whether DHCP servers should provide names or IP addresses
> for NTP servers.
> 
> It occurs to me that DNSSEC requires accurate time. So, we have a bit of a
> bootstrapping issue if we ever decide to secure DNS zones that contain NTP
> servers in them and expect clients to use the server names to find them.
> 
> It seems like we have to provide IP addresses for NTP servers for this reason.
> 

I'm not sure which hat to wear on this one. The first question is
1) how accurate? Within 5 minutes like TSIG?
2) I assume that this is both ends relative to each other?

We always had a bootstrapping issue. It's only now becoming obvious. I
had mentioned this in a previous message. One way of avoiding the
accurate time issue is to use a refclock on the system  and have NTP get
its time from there.

There are actually three different parts of this:
1) DNS Servers using DNSSEC for the zone in which they are authorative
These will have static IP addresses and DHCP would presumably not be
involved (though no doubt can provide other data). I would expect that
it would be set up manually to have ntpd to use servers specified by the
sysadmin.

2) Caching DNSSEC-aware servers
These are presumably the servers responsible for supplying the answers
to the ultimate clients. These would also presumably have static IP
addresses and not use DHCP. They too could be manually configured to use
 NTP from their own resources but could conceivably get information from
DHCP servers.

3) The clients themselves using a DNSSEC-enabled resolver. These are
likely to be provisioned with IP addresses, DNS server addresses, etc.
and presumably get their information from DHCP. These clients are the
most vunerable since presumably the NTP server would be provisioned by
DHCP which would need to make sure that they receive authenticated data.
That's the chicken and egg problem since they presumably need an
accurate time before communicating with the DHCP server to get
information about the NTP server addresses to use. If you are concerned
enough to use DNSSEC you presumably are concerned enough to use only
authenticatable NTP servers and that means using autokey protocol (now
in IETF draft). That requires a key and it needs to be distributed OOB.
The key could potentially be distributed by DHCP but you also need to
protect the key from modification in flight which presumably needs DHCP
authenticationc and encryption if that's the distribution method. The
trick here is to figure out which piece to set up first.

Ideas?

Danny

_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg