Re: [Ntp] NTP Security (was NTPv5: big picture)

[Philip Prindeville <[e-mail]>]

> On Jan 18, 2021, at 1:17 PM, Magnus Danielson <[e-mail]> wrote:
> 
>> [...]
> You actually do not trust the time you get initially. You validate it.
> If your DNSSEC is invalid because of time, then the DNSSEC does not
> validate. If your DNSSEC is invalid because false data, the DNSSEC does
> not validate. Then, if and only if DNSSEC validate, only then you get
> time but using the data-validated path, and only then you validate if
> the original time and the validated time match up. If they don't, then
> you do not trust either. If you can spoof the DNSSEC to validate, you
> are toast anyway, if you have put your trust there.
> 
> Now, one *could* argue that the validated time from A can be trusted
> even if the non-validated initial time mismatch. This could be used for
> relaxed rules, but should result in warning.
> 
> If someone feeds you DNS-records that is wrong, DNSSEC should not validate.
> 
> If someone feeds you initial non-validated time that is wrong, that is
> caught later. It may be "good enough" for the DNSSEC to be valid, but we
> do not trust that value any further, it's only used in the boot-strap
> procedure to hand-off to the secured form.
> 
> Cheers,
> Magnus


I think I could live with this.  Rich?  Emmanuel?

-Philip