Re: [dhcwg] Fwd: New Version Notification for draft-ogud-dhc-udp-time-option-01.txt

[Danny Mayer <[e-mail]>]

On 12/1/2013 5:29 PM, Ted Lemon wrote:
> On Dec 1, 2013, at 5:05 PM, Olafur Gudmundsson <[e-mail]> wrote:
>> The "threat" the document is trying to address, device wants to
DNSSEC or CERT validation but clock is far off thus VALID credentials
fail validation.
> 
> Ah, thanks for explaining. This is what I was missing—you're not
> doing
this to avoid a threat at all, but rather to simply make DNSSEC work in
a possibly non-secure mode until such time as you can bootstrap better
time information.
> 
> This would be worth mentioning in the introduction and/or the
> security
considerations section. You allude to it in the security considerations,
but it's pretty oblique.
> 
> It is worth pointing out that NTP doesn't actually need DNS to
work—DHCP can deliver NTP server addresses as IP addresses. That said,
this option seems to add value, since there is no guarantee that devices
that implement the existing DHCP NTP will not send FQDNs rather than IP
addresses.

I had a long discussion with Bernie over the issue of delivering NTP IP
addresses via DHCP. We understand the issues you raised concerning
DNSSEC and have no disagreement about that. The problem is that for NTP
DNS names are preferred over IP addresses because that allows a server
maintainer to retire an NTP server. With an IP address there is no
chance that your local instance will know about this and continue to
bombard the old address. Moreover the newer pool option cannot be used
to any advantage.

When was the last time you looked at your NTP configuration and verified
that all of the servers listed are still valid? How often will DHCP
servers do this as a matter of course before providing such
provisioning? We have systems that are being bombarded by requests even
though no NTP server is responding to queries. We have plenty of
evidence of this. Even worse we have seen home routers which have
hard-coded IP addresses for NTP servers embedded. How long are those
going to be in operation?

I think we need to figure out how to get around the Catch-22 situation
of DNSSEC requiring relatively good time and NTP wanting to be able to
use DNS to find valid NTP servers.

We need a joint agreement on how to deal with this between DHCP and NTP
Working Groups assuming that is a viable option in the first place.
RFC5908 was not a good indication of this.

Danny