Re: [Ntp] NTS pool support

["Patrik Fältström " <[e-mail]>]

On 21 Jul 2019, at 5:18, Ask Bjørn Hansen wrote:

>> On Jul 20, 2019, at 1:37 PM, Christer Weinigel <[e-mail]> wrote:
>>
>> The best thing about DNS SRV records is that the target (host) is a
>> fully qualified domain name, which means that when the NTS client
>> connects to the NTSKE server it will match the name that's present in
>> the TLS certificate for the server.  This means that the administrator
>> of the pool does not have to manage the TLS certificates and private
>> keys, that's up to whoever manages each NTSKE server.
>
>
> In this scenario, for the client to know that the server behind the SRV record are trusted by the pool system, it will have to either do end-to-end DNSSEC (and the pool DNS has to support it),

DNSSEC do not really work that way. But close :-)

You must trust whoever is doing the validation. You extrapolate that to you having to do the validation, but that builds upon you not trusting (for example) the access provider that runs the recursive resolver for you also do the validation.

> or the CA used for the server need to be explicitly tied to the pool configuration. If not then your ISP can easily hi-jack the service in a way that’s not possible with “regular NTS”. Or maybe I am missing something. :-)

I think Christers idea is good(*), as it collapses to "if you trust your DNS, then you can use SRV". This irrespectively of whether DNSSEC is in use or not.

That trust can be built by either just trusting DNS, trust the validating recursive resolver run by a third party, or you run your own validating resolver on ::1.

Saying SRV can not be used because you do not trust DNS is not working, as we have other issues with NTS if we do not trust DNS. NTP Pools rely on us trusting the DNS as the pool is built in DNS as the database.

   Patrik