Re: [Ntp] AD Evaluation: draft-ietf-ntp-using-nts-for-ntp-21

Hey Christer,

thank you for following up on this issue, this is great confirmation to 
get.

Best regards,
Kristof

"ntp" <ntp-bounces@ietf.org> schrieb am 17.02.2020 11:07:58:

> Von: "Christer Weinigel" <christer@weinigel.se>
> An: "Marcus Dansarie" <marcus@dansarie.se>, Suresh@kaloom.com
> Kopie: draft-ietf-ntp-using-nts-for-ntp.authors@ietf.org, 
> "ntp@ietf.org" <ntp@ietf.org>, "Karen O'Donoghue" <odonoghue@isoc.org>
> Datum: 17.02.2020 11:08
> Betreff: Re: [Ntp] AD Evaluation: draft-ietf-ntp-using-nts-for-ntp-21
> Gesendet von: "ntp" <ntp-bounces@ietf.org>
> 
> On 2/13/20 8:01 PM, Marcus Dansarie wrote:
> 
> >> * Section 4.2. and 5.1.
> >>
> >> These sections seem to be mandating the use of RFC5705 for extracting
> >> key material while also putting in a SHOULD level requirement for TLS
> >> 1.3. In my view these are incompatible.
> >>
> >> As I was reading through the draft that became TLS 1.3 spec (RFC8446)
> >> one of the things it changed was the way key exporters work by 
changing
> >> from PRF to HKDF. It appears to me that this would make the RFC5705 
key
> >> extraction mechanisms incompatible with TLS1.3.
> >>
> >> If you agree that this is an issue, can you put in some 
disambiguating
> >> text in these sections to mention that RFC5705 has to be used with
> >> earlier TLS versions, and Section 7.5 of RFC8446 is to be used with 
TLS
> >> 1.3. If this is not an issue, can you please explain why?
> > 
> > We agree. The draft has been updated accordingly.
> 
> I took a quick look at what some of the existing implementations do.
> 
> nts-poc-python and NTPsec both use OpenSSL and the function 
> SSL_export_keying_material for extracting key material.  This function 
> has two implementations, one for TLS1.3 which uses HKDF and another one 
> for older versions of TLS which use PRF and OpenSSL will use the 
> appropriate one automatically.
> 
> Chrony uses gnutls and the function gnutls_prf_rfc5705 for extracting 
> key material.  Despite the name this function will use HKDF as defined 
> in RFC8446 for TLS1.3 and PRF for older versions of TLS.
> 
> So all those implementations actually did the right thing already since 
> the library they use did the right thing.
> 
> And since both the Netnod Go implementation and Cloudflare's Rust 
> implementation can interoperate with the other implementations I guess 
> they do the right thing too.
> 
> I.e. all implementations seem to do the right thing already.  Updating 
> the documentation to match reality is a good thing to do. :)
> 
>    /Christer
> 
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp