[ntpwg] NTS: The question of CMS vs. (D)TLS

[[e-mail]]

Hello all of you,

as promised in the WebEx meeting yesterday, here is a short description of 
what we intend to do about the question of CMS vs. DTLS (or other external 
security mechanisms) for the initial exchange of NTS security data.

(1) Main draft (draft-ietf-ntp-network-time-security):
- For this draft, we intend to leave the question completely open. This 
draft will only state which cryptographic data needs to be exchanged for 
bootstrapping NTS (that is to say: association, authentication, and cookie 
exchange), and describe what the security conditions for this exchange are 
(for example: the cookie needs to be exchanged in a way that guarantees 
authenticity and secrecy).
- The message exchanges belonging to the bootstrapping process (i.e: 
association exchange, cookie exchange and probably broadcast parameter 
exchange) will be moved to an informational appendix, This appendix will 
state that implementing these exchanges properly is one possible way of 
securely communicating the data required for bootstrapping.

(2) Draft for utilization of NTS for NTP 
(draft-ietf-ntp-using-nts-for-ntp)
- In this draft, we intend to specify that for bootstrapping, an 
implementation MUST support the use of the CMS-based message exchanges, as 
described in the informational appendix mentioned above.
- We will further specify that an implementation MAY also support other 
methods for bootstrapping, for example exchanging the necessary data via 
DTLS or DANE. Any such method needs to fulfill the requirements given in 
the main draft.


We would welcome written feedback on this approach, especially from 
Richard (because making the support of CMS-based exchanges madatory 
constitutes a considerable work assignment to him) and from Florian 
(because he was the one who advocated techniques different from defining 
our own bootstrapping exchanges).

Best regards,
Kristof and Dieter

_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg