Re: [Ntp] NTS Pools

[Miroslav Lichvar <[e-mail]>]

On Thu, Feb 22, 2024 at 03:39:40PM +0100, martin.langer=[e-mail] wrote:
>    I was talking with Krisof Teichel, Dieter Sibold and Rainer Bermbach about
>    how we should handle NTS secured NTP pools. It's not easy as there are
>    different perspectives on the purpose, use cases and security
>    considerations. In general, I think I can provide support from the PTB
>    side, even though I have very little time for it at the moment.

I'm getting lost in these "NTS support in pools" discussions. I'd
appreciate if someone could clarify what exactly is meant by pool and
what is the intended use case in the different proposals.

For me, a pool is a set of servers available under the same DNS name,
which can be specified in the client's configuration with a pool
directive to use some number of the servers at the same time instead
of a single server. There is the well-known pool pool.ntp.org with
thousands of servers provided by volunteers and there are other
smaller pools run by different companies and organizations.

This DNS-based concept of a pool works with plain NTP and it works
also with NTS. There can be multiple NTS servers available under the
same name. The client can use more than one server at the same time.
The NTS-KE part can be separated from the NTS-NTP part. The client
doesn't care. I've been using my own mini pool of NTS servers without
any issues since NTS became a thing.

There are now three different proposals to solve some issues with NTS
wrt pools. There is the older one from Watson based on DNSSRV records
and two newer ones from David and Martin. Can anyone summarize what
issues do they solve and don't solve?

One idea seems to be to run one NTS-KE server with multiple NTS-NTP
servers and mix different implementations of NTS-KE and NTS-NTP. What
exactly is the use case for that? My understanding is that NTS-KE is
the weakest part of the whole system, most easily overloaded and it
the ratio should actually be inverted, run more NTS-KE servers for one
NTS-NTP server.

If NTS was to be supported in the pool.ntp.org pool, I think NTS-KE
servers would need to be run by the volunteers, not on the
pool's own limited resources. I'd not expect many of them to be
separated from NTS-NTP and even fewer of them mixing different
implementations.

If I have a limited number of computers to provide an NTS service, why
would I want to split them into NTS-KE and NTS-NTP servers, when they
can all provide both functions at the same time and provide a larger
capacity for NTS-KE and NTS-NTP?

-- 
Miroslav Lichvar