Re: [Ntp] ntpv5 requirements

[Doug Arnold <[e-mail]>]

True, TESLA makes the time/security startup problem much worse.  A client needs to start out within a time ~ second (for TESLA) instead of ~ hour (to accept a digital certificate).

Doug

From: Miroslav Lichvar <[e-mail]>
Date: Tuesday, February 14, 2023 at 3:48 AM
To: Doug Arnold <[e-mail]>
Cc: NTP WG <[e-mail]>
Subject: Re: [Ntp] ntpv5 requirements
On Mon, Feb 13, 2023 at 06:10:44PM +0000, Doug Arnold wrote:
> I think that he sees TESLA as super-efficient. One could generate 1 key per second to be used by all clients that second, never open a TLS channel, never look up keys in an a key index table, never encrypt a cookie.

There would still need to be some asymmetric operation and
certificates in order to authenticate the first key for the client, so
something like NTS-KE/TLS would need to be used anyway.

TESLA requires a reasonably accurate clock to be able to tell when a
key is disclosed. Some clients probably wouldn't want to wait more
than few seconds for the key (e.g. to set the clock on boot), so the
clock would have to be kept accurate to a second.

Some devices have very unstable clocks (e.g. in virtual machines) and
would need to poll the server very frequently to stay within that
limit. Some computers don't have an RTC and lose time while suspended.
There are other reasons for unexpected steps of a clock.

If the clock is not kept accurate, it completely breaks the security,
just to avoid decoding a cookie. I don't think that is acceptable for
NTP.

--
Miroslav Lichvar