Re: [Ntp] Wildcards in NTS certificate checking

[Paul Gear <[e-mail]>]

On 15/4/22 17:43, Marco Davids (IETF) wrote:
> ...
>
>> The change you want is a one line edit.
>>
>> What I'm missing is a discussion of the risks/benefits associated with
>> left-wildcards and consensus from the NTS community that we should 
>> support
>> them.
>
> Yes, I agree. Well, I already gave my input, so there's little to add 
> there. But to sum them up:
>
> - wildcards are still common practice, and widely deployed and issued,
> - it's not only about security, but also about interoperability,
> - the default should be to accept them, because the RFC8915 doesn't 
> say otherwise,
> - perhaps make a configuration option in the software that disallows them
>
>> Or something similar from a security group saying the increased risk 
>> from
>> left-wildcards is insignificant so they should be widely accecpted.
>
> But they probably already are ;-) Any Chrony-user will confirm that. 
> Probably other NTS-clients support them too (but I haven't verified 
> that).
>
>> I can't tell if I'm being a nut-case for dragging my feet or a hero for
>> starting a long overdue trend to get rid of wildcards.
>
> Your cause is noble without a doubt. But as a guy with an operational 
> background I learned that noble causes don't always lead to desired 
> results. The last thing we need is that we are frustrating the process 
> of broader NTS deployment.

Hi everyone,

As a member of the NTP pool operator community, I plead with you: DO NOT 
ban the use of wildcards in NTS.  By all means, if you think that they 
are less secure (I think that is very debatable, but here is not the 
place for doing so), then provide your clients with the ability to 
discard associations with servers which use them.  But please do not 
make decisions in the standard which should be local policy decisions.  
Wildcards are a widely-expected feature of TLS implementations, and 
there are common scenarios in which they are the only means to achieve a 
desired configuration.

Regards,
Paul