Re: [Ntp] Of Roughtime's algorithm agility, and host attestation

On Fri, Jul 26, 2019 at 6:04 PM Thomas Peterson
<nosretep.samoht@gmail.com> wrote:
>
> In discussions with many folk at IETF 105 (thank you for your time), two
> topics have come up in the design of Roughtime:
>
> 1. How does a Roughtime client attest the certificate presented matches
> the host that was contacted?

You hardcode the key.

> 2. Ed25519 may not be secure forever. How do we ensure more robust
> options are made available?

When and if a post-quantum signature scheme becomes available, we can
cross that bridge.

It's likely the protocol will require significant work (perhaps even
switching to TCP) in that case.

>
> To answer the first point, one suggestion by Erik Klein[0] is to create
> a new DNS RR type that includes the long term certificate of the
> Roughtime server. Should this mismatch the host that is being contacted
> for Roughtime information, clients should consider tampering. It's not
> clear what clients should do if this record was absent. This is perhaps
> a simpler approach that using existing public CA infrastructure that
> supports TLS and S/MIME, but comes with trade-offs.
>
> Q. Do people have thoughts on creating a new DNS RR Type to support
> this, or given the threat and operation model believe we should take a
> different approach?
>
> On the second point regarding algorithm agility, one possible thought
> would be the creation of an IANA registry for Roughtime supported
> schemes. This would more ideal than attempting to piggy-back other
> existing registries (e.g. TLS, which includes legacy such as RSA).
>
> Q. Does the list have a view on this and it's impact to client and
> server negotiation?
>
> Regards
>
> 0:
> https://groups.google.com/a/chromium.org/d/msg/proto-roughtime/RVlx6hGeO1U/Dn3zER5JCQAJ
>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.