[Ntp] Antw: [EXT] Re: Getting started using NTS ‑‑ clock accuracy vs certificates

Ulrich Windl <Ulrich.Windl@rz.uni-regensburg.de> Tue, 02 August 2022 06:35 UTC

Return-Path: <Ulrich.Windl@rz.uni-regensburg.de>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost []) by ietfa.amsl.com (Postfix) with ESMTP id B7BEBC14CF16 for <ntp@ietfa.amsl.com>; Mon, 1 Aug 2022 23:35:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.907
X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id H0gORF9yKrwk for <ntp@ietfa.amsl.com>; Mon, 1 Aug 2022 23:35:05 -0700 (PDT)
Received: from mx2.uni-regensburg.de (mx2.uni-regensburg.de []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 782A6C14F692 for <ntp@ietf.org>; Mon, 1 Aug 2022 23:35:03 -0700 (PDT)
Received: from mx2.uni-regensburg.de (localhost []) by localhost (Postfix) with SMTP id 58EBB600005C for <ntp@ietf.org>; Tue, 2 Aug 2022 08:34:59 +0200 (CEST)
Received: from gwsmtp.uni-regensburg.de (gwsmtp1.uni-regensburg.de []) by mx2.uni-regensburg.de (Postfix) with ESMTP id 3EAA26000050 for <ntp@ietf.org>; Tue, 2 Aug 2022 08:34:57 +0200 (CEST)
Received: from uni-regensburg-smtp1-MTA by gwsmtp.uni-regensburg.de with Novell_GroupWise; Tue, 02 Aug 2022 08:34:57 +0200
Message-Id: <62E8C590020000A10004C061@gwsmtp.uni-regensburg.de>
X-Mailer: Novell GroupWise Internet Agent 18.4.0
Date: Tue, 02 Aug 2022 08:34:56 +0200
From: "Ulrich Windl" <Ulrich.Windl@rz.uni-regensburg.de>
To: <mlichvar@redhat.com>,<halmurray@sonic.net>
Cc: "ntp@ietf.org" <ntp@ietf.org>
References: <12E3D38F02000049FDA5B133@gwsmtp.uni-regensburg.de> <102150BE0200001E6A6A8CFC@gwsmtp.uni-regensburg.de> <705F71AB02000017FDA5B133@gwsmtp.uni-regensburg.de>
In-Reply-To: <705F71AB02000017FDA5B133@gwsmtp.uni-regensburg.de>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/7oEOm8J-c83G_efow5zXTYB2iTQ>
Subject: [Ntp] =?utf-8?q?Antw=3A_=5BEXT=5D_Re=3A__Getting_started_using_N?= =?utf-8?q?TS_=E2=80=91=E2=80=91_clock_accuracy_vs_certificates?=
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Network Time Protocol <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Aug 2022 06:35:08 -0000

>>> Hal Murray <halmurray@sonic.net> schrieb am 01.08.2022 um 23:06 in

> mlichvar@redhat.com said:
>> For clients without RTC/battery the server can have a special name using a
>> self‑signed certificate with validity extending to distant past and
>> The name and the certificate can be baked in the OS image and updated by
>> OS‑specific update mechanism as necessary.
> Thanks.
> I'd thought of self signed certificates for what I call the 10 year problem.

> If you have a spare that sits on the shelf for 10 years or more, how do you

> get it started?  Phone companies used to work that way.  I'm not sure what 
> their current spare lifetimes are.
> I was picturing that the phone company would run their own server using a 
> self 
> signed certificate.  They would be in a position both to understand how 
> important it is to protect the private key and to run the server for 10 
> years.
> With your suggestion, I think it's reasonable for a server to have 2 
> certificates and use the right one depending on the host name presented 
> early 
> in the handshake.
> Note that there is a similar problem with DNSSEC.  I think we can solve that

> one by caching the DNS info in /etc/hosts (or similar).
> Using the numerical IP address as the "host name" in the certificate would 
> avoid the DNSSEC tangle.  That seems like a reasonable convention for long 
> lived certificates.

If you know ahead of time which IP address the device will get. I doubt that
for a typical spare part that should work without being configured before.

>> It would be nice if the widely known NTS servers had this.
> Is there a list of public NTS servers?
> We only need a few NTS servers with long lived certificates so non‑RTC 
> systems 
> can get off the ground.  After that, they can switch to closer servers.
> ‑‑ 
> These are my opinions.  I hate spam.
> _______________________________________________
> ntp mailing list
> ntp@ietf.org 
> https://www.ietf.org/mailman/listinfo/ntp