Re: [Ntp] NTS Pools

[Watson Ladd <[e-mail]>]

On Wed, Apr 17, 2024 at 11:06 AM Salz, Rich
<rsalz=[e-mail]> wrote:
>
> Luke’s note spurred me to throw in my late feedback as well.
>
>
>
> > My primary goal currently is to work towards a pool or pool-like solution that
>
> > 1) Is drop in for end-users. I.e. if you have a working NTS client,
>
> > the pool can be used without any changes to software.
>
>
>
> Which software?  Can you accept recent additions to the TLS library?  If so, look at RFC 9345, Delegated Credentials. In this situation, the pool “owner” (or team) has a certificate, and they issue periodic short-term signed data to the pool members, which the members use like the TLS key. Adoption isn’t widespread; for example it’s not supported by OpenSSL, but it has some very nice security and admin properties.

The effort involved seems considerably more than the SRV approach.
With SRV we don't need to muck about with issuing any sort of
credential: what you have now works, its just signing up with a domain
not an IP. To integrate with the DC approach means getting the DC
requests signed by volunteers and authenticated and put on the
responding machines.

Sincerely,
Watson Ladd

-- 
Astra mortemque praestare gradatim