Re: [Ntp] Circular dependencies

[Hal Murray <[e-mail]>]

[e-mail] said:
> This is probably a bigger issue with NTS, as certs with IP addresses are
> harder to get. Roughtime can use its own keys, but does still rely on the DNS
> often, so it won't necessarily be a solution. Any ideas?

I think a document collecting ideas would be great.  We can turn it into an 
RFC if/when things stabilize.


I think there are 3 main cases to consider;

1) Typical PC/Server with a CMOS/TOY battery backed clock.
  During booting, the system reads the time from the clock and uses that to 
set the system time.  After that, everything just works.
  (This degenerates to case 2 if/when that clock is broken/cleared.)

2) Systems like the Raspberry Pi that have a real file system but no battery 
backed clock.  We can store the time in the file system.  This works as long 
as the systems are powered up often enough to keep the time in the file system 
close enough.

3) Systems that sit on the shelf for a long time (years).  In the old days, 
this was common in the telcom industry.  I expect it still is, but I don't 
have any solid data.  The useful lifetime of electronics is getting shorter.  
Even if the hardware doesn't die, the protocols will get updated.

The problem is that the root certificates distributed via typical distros will 
expire.  Vendors can bypass by setting up their own special long-life 
certificate chains.

---------

How close does the clock have to be for DNSSEC?  Certificates?

Are there other time-checks potentially in the chain?

Maybe a 4th case is a system being restored from backup.  Does that put a time 
limit on the useful life of backup tapes if they will be used for a total 
system restore?

--------

We can bypass the DNSSEC issues with a local DNS cache.  That will work with 
certificates that don't work with IP Addresses.  Maybe we should think of it 
as reverse DNS.  The IP Address is used to contact the server.  The name is 
what we use for certificate checking.  That depends on the IP Addresses being 
stable for longer than the system gets updated.

As Tony Finch pointed out, one of the tools we have is to setup systems with 
stable IP Addresses and long lifetime certificates.



-- 
These are my opinions.  I hate spam.