[Ntp] Re: Roughtime update

[Marcus Dansarie <[e-mail]>]

All,

I have now had a closer look at the interoperability issues between 
Roughenough and the other client implementations. The issue was not 
caused by different definitions of private keys, but by two bugs in 
Roughenough. The root cause of one of the bugs appears to be that the 
list of tags in the draft is sorted in the wrong order. I have submitted 
pull requests on Github to fix the issues in both Roughenough and the draft.

In other words, it appears that all implementations are following the 
definition of private keys from RFC 8032. Nevertheless, we should 
probably add language to the draft to require conformance with that RFC.

Kind regards,
Marcus


On 2024-11-06 21:55, Marcus Dansarie wrote:
> # RFC 8032 and Roughtime keys
> 
> During testing with Plummet, there was problems getting interoperability 
> between the Roughenough server and the Cloudflare and Pyroughtime 
> clients. The reason for this was identified as being due to Roughenough 
> treating key seeds/private keys different than other implementations. 
> RFC 8032 specifies EdDSA and specifies how private keys should be 
> generated from a random seed. In particular, certain bits of the private 
> key have to be cleared and one has to be set in order to prevent small- 
> subgroup attacks and timing side-channel leaks. Depending on which 
> Ed25519 libraries the different implementations use and how those 
> libraries are called, this requirement may not be met or treated in the 
> same way by all implementations. I will do some investigation and report 
> when I know more.