Re: [Ntp] Circular dependencies

[Mark Andrews <[e-mail]>]

> On 12 Nov 2020, at 04:21, Watson Ladd <[e-mail]> wrote:
> 
> Dear NTP WG,
> 
> I just realized there is a mailing list bug report that's a lot more
> interesting than it seems. They have a DNSSEC validating resolver and
> were using an NTP daemon to set the clock (and the RTC was busted) But
> the time is needed to verify liveness of the signatures for DNSSEC to
> validate, and without the names don't resolve, including the NTP
> server names.

If you have no idea of the current time just verify the signatures
ignoring the time stamps.  That is significantly better than no
verification at all.  The timestamps are there to prevent replay
attacks.  Just ask for the records and signatures (DO=1) and do your
own DNSSEC validation.  There are libraries out there that can do this
for you.

Back when I was using a machine w/o a real time clock and just power
line frequency to maintain time we touched a file in the root directory
every minute so that when the machine rebooted it would not be too far
off current time.

DNSSEC just needs to know the rough time.  Implementations already build
slack into the inception timestamp.  We all know there is clock skew in
the real world.  BIND sets it to a hour in the past by default when
generating signatures.

> This is probably a bigger issue with NTS, as certs with IP addresses
> are harder to get. Roughtime can use its own keys, but does still rely
> on the DNS often, so it won't necessarily be a solution. Any ideas?
> 
> Sincerely,
> Watson Ladd
> 
> _______________________________________________
> ntp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ntp

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: [phone]              INTERNET: [e-mail]