Re: [Ntp] NTP Security (was NTPv5: big picture)

[FUSTE Emmanuel <[e-mail]>]

Le 16/01/2021 à 23:49, James Browning a écrit :
> On Sat, Jan 16, 2021, at 11:02 AM Watson Ladd <[e-mail] 
> <mailto:[e-mail]>> wrote:
>
>     I'd like to see some input from people who operate the pool on what
>     solutions would work for them. Right now we're sort of flying blind.
>     Perhaps we can discuss at IETF 110?
>
>
> Only a user of the pool, but I basically see three ways to manage that.
> 1) Have the pool serve up SRV records and rewrite the pool code, the 
> spec, and clients to compensate.
> 2) Have the pool run a common NTS-KE server for all NTS servers in the 
> pool.
> 3) Convince TLS certificate vendors to sell IP based certificates.
>
Or start to discuss a DANE usage for NTS.
Basicaly use DANE-EE or TA certificate usage
Ot the pool could use it's own specialized pki for the pool participants 
with DANE-TA.

I think the most simple and flexible would be the EE in the pool 
hierachy. The validity of the certificate is only tied to the validity 
of the DNSSEC signature of the TLSA record.
And all bootstrapping problems could be solved with CD / DO flags 
controls and validation back checking with the first returned time of day.

Even out the pool context, a specified DANE usage for NTS would be very 
valuable.

Emmanuel.