Re: [Ntp] Circular dependencies

Is there something wrong with "don't do that" as a solution? Nothing
in NTS relies on or benefits from DNSSEC, so there's no reason to
validate it. If the system resolver validates automatically and
there's no way for an application to ask it not to, then the system
resolver is (temporarily) broken and will need to be bypassed.

On Wed, Nov 11, 2020 at 1:04 PM Watson Ladd <watsonbladd@gmail.com> wrote:
>
> Dear NTP WG,
>
> I just realized there is a mailing list bug report that's a lot more
> interesting than it seems. They have a DNSSEC validating resolver and
> were using an NTP daemon to set the clock (and the RTC was busted) But
> the time is needed to verify liveness of the signatures for DNSSEC to
> validate, and without the names don't resolve, including the NTP
> server names.
>
> This is probably a bigger issue with NTS, as certs with IP addresses
> are harder to get. Roughtime can use its own keys, but does still rely
> on the DNS often, so it won't necessarily be a solution. Any ideas?
>
> Sincerely,
> Watson Ladd
>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp