[Ntp] NTPv5 Requirements vs. NTPv5 Spec

[Tal Mizrahi <[e-mail]>]

Hi,

I have been reviewing the NTPv5 requirement spec
(draft-ietf-ntp-ntpv5-requirements-04) in order to map its
requirements to the NTPv5 spec (draft-ietf-ntp-ntpv5-04), followed by
some discussion with Miroslav about the potential gaps with the NTPv5
spec.

The detailed analysis can be found in:
https://github.com/ietf-wg-ntp/draft-ietf-ntp-ntpv5-requirements/issues/44

In short:
- Most of the requirements are met in the NTPv5 spec.
- 5 issues/gaps were found. 3 of them simply require adding some text
to the NTPv5 spec without functional changes. The remaining 2 issues
are requirements not met by the spec - see below.

Issue 1:
ntpv5-requirements: Section 4.1 - An additional identifier mechanism
MAY be considered for the purposes of client allow/deny lists, logging
and monitoring. Such a mechanism when included, SHOULD be independent
of any loop avoidance mechanism, and authenticity requirements SHOULD
be considered.

Discussion: this has not been defined in NTPv5, and might conflict
with data minimization.

Issue 2:
ntpv5-requirements: Section 4.1 - Clients SHOULD periodically
re-establish connections with servers to prevent maintaining prolonged
connectivity to unavailable hosts and give operators the ability to
move traffic away from hosts in a timely manner.

Discussion: this requirement is not necessarily needed in the NTPv5
spec. The word "connection" is not used in the spec. If we put aside
security associations, NTPv5 does not really use a "connection".

Please let us know if there are any comments regarding these two issues.

Thanks,
Tal.