Re: [Ntp] NTP Security (was NTPv5: big picture)

[Watson Ladd <[e-mail]>]

On Sat, Jan 16, 2021 at 3:35 PM Kurt Roeckx <[e-mail]> wrote:
>
> On Sat, Jan 16, 2021 at 02:49:33PM -0800, James Browning wrote:
> > On Sat, Jan 16, 2021, at 11:02 AM Watson Ladd <[e-mail]> wrote:
> >
> > > I'd like to see some input from people who operate the pool on what
> > > solutions would work for them. Right now we're sort of flying blind.
> > > Perhaps we can discuss at IETF 110?
> > >
> >
> > Only a user of the pool, but I basically see three ways to manage that.
> > 1) Have the pool serve up SRV records and rewrite the pool code, the spec,
> > and clients to compensate.
>
> I think if we want to do it with DNS, it would require DNSSEC, and
> that the client validates DNSSEC.

I neglected to mention my now expired
https://datatracker.ietf.org/doc/draft-ladd-nts-for-ntp-pool/ as an
example of this approach.
>
> > 2) Have the pool run a common NTS-KE server for all NTS servers in the pool.
>
> As far as I understand things, that would not be a good idea.

Agreed. The key management and synchronization in such a system is a pain.

>
> > 3) Convince TLS certificate vendors to sell IP based certificates.

I have some issues with this rather not fleshed out proposal. Please
feel free to tell me I am completely misunderstanding it.

My first concern is that there is no easy analogue of DCV to perform
in the IP based certificate setting. SNI based shared hosting is the
most problematic case, and dooms the obvious techniques. This makes
for a big barrier to adoption. The second issue is that this does
little to secure the delegation from the pool to the server: an
attacker who legitimately controls an IP address can forge the DNS
response. This can be solved through DNSSEC and dynamically signing
the response, but then option 1 is equally easy.  Plus the pool can
generate names for the IPs for ACME to use.

>
> There are CAs that sell this.
>
> > I am not particularly fond of any. Someone should find a fourth way.
>
> Open a TLS connection to ask for servers, get a list of hostnames.

This has some interesting advantages.

>
>
> Kurt
>
> _______________________________________________
> ntp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ntp

--
Astra mortemque praestare gradatim