Re: [Ntp] Publication has been requested for draft-ietf-ntp-using-nts-for-ntp-20

[Hal Murray <[e-mail]>]

[e-mail] said:
>    with a list of one or more IP addresses to NTP servers for which the
> cookies

> Is it wrong to interpret a FQDN as a list of addresses? 

Good question.

I vote we add something like "use only one address, but the client gets to 
pick which one".

Our code processes the list in order, using the first one that isn't already 
in use.  Thus
  server foo.example.com nts
  server foo.example.com nts
Will get 2 connnections to the same server in the typical case where the 
server has both an IPv4 address and a IPv6 address.


Suppose we want to use more than one address.

Plan A would be to use all the addresses, starting each address with all 8 
cookies.  That would use the first 8 cookies multiple times and use the same 
C2S and S2C keys on multiple connections.  Hopefully, the crypto we are using 
will survive an attack using that info.  It seems appropriate not to push 
things unless we want to do a serious analysis.

Plan B would be to split the 8 cookies over several addresses.  That still 
leaves reusing C2S and S2C.  I think we have calculations on how much traffic 
a key is good for.  I didn't find anything with a quick scan of the draft.  
Did I miss it?  Should we add it?  Is a factor of 8 interesting?

Should we add a section about C2S and S2C lifetime, even if the result is off 
scale so we know how far off scale it is?


-- 
These are my opinions.  I hate spam.