Re: [Ntp] Circular dependencies

[Danny Mayer <[e-mail]>]

On 11/11/20 12:21 PM, Watson Ladd wrote:
> Dear NTP WG,
>
> I just realized there is a mailing list bug report that's a lot more
> interesting than it seems. They have a DNSSEC validating resolver and
> were using an NTP daemon to set the clock (and the RTC was busted) But
> the time is needed to verify liveness of the signatures for DNSSEC to
> validate, and without the names don't resolve, including the NTP
> server names.
>
> This is probably a bigger issue with NTS, as certs with IP addresses
> are harder to get. Roughtime can use its own keys, but does still rely
> on the DNS often, so it won't necessarily be a solution. Any ideas?
>
> Sincerely,
> Watson Ladd

This is not new and has been an issue for years. This is the reason why 
Autokey was developed which avoided the certificate issues with 
timestamps. This is unrelated to the problems with the Autokey protocol. 
The second part of this is if you look up IP addresses in NTP and those 
are DNSSEC protected then DNSSEC assumes that they are using accurate 
time when checking the certificates. There's no easy solution.

Danny