[Ntp] Antw: [EXT] Re: Getting started using NTS ‑‑ clock accuracy vs certificates

>>> Hal Murray <halmurray@sonic.net> schrieb am 01.08.2022 um 23:06 in
Nachricht
<20220801210637.D395628C1CA@107-137-68-211.lightspeed.sntcca.sbcglobal.net>:

> mlichvar@redhat.com said:
>> For clients without RTC/battery the server can have a special name using a
>> self‑signed certificate with validity extending to distant past and
future.
>> The name and the certificate can be baked in the OS image and updated by
the
>> OS‑specific update mechanism as necessary.
> 
> Thanks.
> 
> I'd thought of self signed certificates for what I call the 10 year problem.

>  
> If you have a spare that sits on the shelf for 10 years or more, how do you

> get it started?  Phone companies used to work that way.  I'm not sure what 
> their current spare lifetimes are.
> 
> I was picturing that the phone company would run their own server using a 
> self 
> signed certificate.  They would be in a position both to understand how 
> important it is to protect the private key and to run the server for 10 
> years.
> 
> With your suggestion, I think it's reasonable for a server to have 2 
> certificates and use the right one depending on the host name presented 
> early 
> in the handshake.
> 
> 
> Note that there is a similar problem with DNSSEC.  I think we can solve that

> 
> one by caching the DNS info in /etc/hosts (or similar).
> 
> Using the numerical IP address as the "host name" in the certificate would 
> avoid the DNSSEC tangle.  That seems like a reasonable convention for long 
> lived certificates.

If you know ahead of time which IP address the device will get. I doubt that
for a typical spare part that should work without being configured before.

> 
> 
>> It would be nice if the widely known NTS servers had this.
> 
> Is there a list of public NTS servers?
> 
> We only need a few NTS servers with long lived certificates so non‑RTC 
> systems 
> can get off the ground.  After that, they can switch to closer servers.
> 
> 
> 
> 
> ‑‑ 
> These are my opinions.  I hate spam.
> 
> 
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp 