Re: [Ntp] Shorter NTS packets?

[Miroslav Lichvar <[e-mail]>]

On Thu, Dec 09, 2021 at 01:57:46PM -0800, Hal Murray wrote:
> How much of the problem will shorter packets solve?

In cases where the network blocks all NTP messages of >=204 bytes,
NTS didn't work at all. With shorter messages it should work well
until a packet is dropped for some other reason and the client
requests two or more cookies. When the client runs out of cookies, it
will restart NTS-KE and work again until a packet is dropped.

In cases where the network blocks all NTP messages between 204 and 452
bytes, NTS worked only once every four requests. With shorter messages
it should work well until a packet is dropped. Then it won't get a
response until it requests four or more cookies. Maybe clients could
implement some heuristic to detect this case and go straight from 1 to
4 cookies.

> NTS-KE includes a port number.  Can each server just pick
> a local port?

Yes, that is possible. The problem is that different servers could be
using different ports and the ports might be blocked in a local
firewall, so users would need to ask their admins to unblock them to
get NTS working.

Ideally, there would be only one port other than 123 and NTS-KE
servers would provide both ports to the clients at the same time, so
clients behind restrictive firewalls can still use the port 123 as
before.

The Port Negotiation NTS-KE record can contain only one port, but
it seems there can be multiple records of this type in a single NTS-KE
message. This should be added to the alternative-port draft if there
is a chance it will move forward.

-- 
Miroslav Lichvar