Re: [Ntp] Post NTS, Is shared key authentication interesting?

Also, NTS is not designed for NTP’s symmetric mode, which will be well 
served by the old approach.

Dieter

On 26 May 2020, at 17:34, Daniel Franke wrote:

> I could go either way on this. What moves me a bit toward Miroslav's 
> point
> of view is that the PSK handshakes in TLS 1.3 unfortunately did not 
> get the
> same care and attention from the TLS WG as the rest of the protocol 
> did,
> and as a result we got things like 
> https://eprint.iacr.org/2019/347.pdf.
> This particular attack doesn't harm us since we distinguish between 
> client
> and server packets at the application level, but it suggests that if 
> we're
> considering relying on TLS-PSK we can't simply assume that the TLS WG 
> has
> given us an adequate foundation to build on; we need to check their 
> work
> and make that assessment ourselves.
>
> On Tue, May 26, 2020 at 11:23 AM Miroslav Lichvar 
> <mlichvar@redhat.com>
> wrote:
>
>> On Tue, May 26, 2020 at 10:55:41AM -0400, Watson Ladd wrote:
>>> On Mon, May 25, 2020 at 9:29 AM Daniel Franke <dfoxfranke@gmail.com>
>> wrote:
>>>> I would like NTPv5's shared key authentication to be a little more
>> closely integrated with NTS. Either accomplish it by doing a PSK TLS
>> handshake for NTS-KE, or skip NTS-KE and have pre-shared S2C/C2S keys 
>> and a
>> shorter cookie giving just a key ID.
>>>
>>> I think PSK TLS is a better idea: all the complexity gets dumped on
>>> the TLS stack, while the NTP specific parts don't change.
>>
>> A different point of view would be to avoid exposing the NTS+TLS 
>> stack
>> to attackers if not necessary. The complexity of the NTP MAC is
>> minimal when compared to that.
>>
>> --
>> Miroslav Lichvar
>>
>>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp