Re: [Ntp] Antwort: Antw: [EXT] Re: NTPv5 draft

[Christer Weinigel <[e-mail]>]

On 12/14/20 1:31 PM, Miroslav Lichvar wrote:
> NTP is used everywhere. Some hardware doesn't have enough
> memory/storage to support TLS/NTS. Some computers don't have an RTC or
> cannot be assumed to start with correct time to be able to validate
> certificates. Symmetric keys may not be practical. 

Maybe such small devices shouldn't use NTP.  From what I understand
roughtime might be a better choice.  It only uses a few hardcoded
cryptographic primitives so the size of implementation ought to be
fairly small.  Since a roughtime client is expected to have a hardcoded
list of servers and associated public keys it does not have the chicken
and egg problem of needing accurate time to be able to validate the
certificates to be able to verify a NTSKE server to get time.

Of course, public key distribution is a bit of an issue with roughtime,
but if the big players such as RedHat/Fedora, Debian/Ubuntu and
Yocto/OpenEmbedded/Buildroot curates a list with a couple of hundred
roughtime servers, at least some of those servers ought to survive over
the lifetime of a device.  If a client chooses a half a dozen random of
servers to query from the list and all of them agree on time to within a
second, that should give the client fairly good confidence that the time
is received is correct.

  /Christer