Re: [Ntp] NTPv5 draft

[Philip Prindeville <[e-mail]>]

> On Dec 7, 2020, at 3:45 AM, Miroslav Lichvar <[e-mail]> wrote:
> 
> On Fri, Dec 04, 2020 at 05:58:16PM +0100, Dieter Sibold wrote:
>>> Ok, so if the draft said something like "NTP clients SHOULD use
>>> authentication", would that work for you? Ultimately, it would be up
>>> to the client's default configuration whether authentication is
>>> enabled or not.
>>> 
>> 
>> No. From my point of view this is not explicit. I would prefer that the
>> basic protocol incorporates security. That would allow to use security
>> without thinking about which approach needs to be applied to accomplish
>> that. For the experts there might be additional option like the pre-shared
>> key approach to acknowledge very specific circumstances. But the normal NTP
>> user should be able to use a secured NTPv5 like using a https protected
>> website.
> 
> Ok, I see your point, but I don't think it's a good idea. NTPv5 was
> supposed to fix other issues. I don't remember anyone complaining that
> NTPv4 can be used without authentication. That's a feature, not a bug.
> It's up to the implementations and their default configurations to
> enable authentication.
> 
> Web browsers still default to HTTP and how long does HTTPS exist?
> 
> NTS just become a thing. Forcing people to NTS by removing
> unauthenticated NTP from NTPv5 won't work.
> 

HTTP isn’t by definition used to control infrastructure, and when it is used that way, HTTPS is usually mandated.

V4 goes back to 2010, but as I remember it was in use as protocol for a while before the implementation was written up and standardized.

And there were fewer known exploits then than now.

-Philip