Re: [Ntp] NTP Security (was NTPv5: big picture)

[Kurt Roeckx <[e-mail]>]

On Mon, Jan 18, 2021 at 12:02:04PM +0000, FUSTE Emmanuel wrote:
> Le 18/01/2021 à 12:38, Hal Murray a écrit :
> > [e-mail] said:
> >> And all bootstrapping problems could be solved with CD / DO flags  controls
> >> and validation back checking with the first returned time of day.
> > How is that back checking going to work?  You don't know the time yet.
> >
> > Sure, it will say "OK" if you are talking to an honest server, but if you are talking to a bad guy, it can lie consistently.  Am I missing something?
> DNSSEC and/or DANE validation will fail if it is really a "bad guy" eg 
> it is not really the guy you tried to connect to, even if the given time 
> is "good" for DNS resolutions.
> For long time on the shelf, you will have to update the root DNS key if 
> the device is operating on the Internet, but only that.
> 
> For standard X509 model, you will have to update the certificate 
> authority list/public key anyway.

There aren't really much differences between X509 and DNSSEC.

> And if we talk about security, DNSSEC 
> validation capability is something that should be mandatory for any 
> device that is connected to the Internet today.

See:
https://blog.apnic.net/2020/03/02/dnssec-validation-revisited/
https://stats.labs.apnic.net/dnssec/

We're at about 25% that's currently validating, and 10% that has
both a validating and non-validating resolver.

Software can use a library to do the validation itself rather than
rely on resolver to do it.


Kurt