Re: [Ntp] NTPv5 draft

[Kurt Roeckx <[e-mail]>]

On Tue, Dec 01, 2020 at 09:12:03AM +0100, Miroslav Lichvar wrote:
> > I very much agree with Jame’s proposed draft that a new
> > version of NTP must provide these mechanisms by default.  Sure, you can add
> > NTS to protect the NTPv5 packets. But in this case protection is always an
> > optional add-on whereas it needs to be an inherent part of the basic
> > protocol. To achieve this the NTS approach certainly can be transferred to
> > the basic v5 protocol and packet format.
> 
> You mean to require all NTP packets to be authenticated? I don't like
> that idea. The improvements in NTPv5 are orthogonal to authentication.
> NTPv5 is not supposed to be more secure. An NTP client that doesn't
> want to implement the complexity of NTS shouldn't be restricted to
> NTPv4.

As far as I know, it's currently still not possible to use NTS
with the pool, so we can't always use the authentication.

If devices like switches can be involved in the protocol too, do
we also want their data to be authenticated?


Kurt