Re: [Ntp] NTPv5 draft

[Hal Murray <[e-mail]>]

[e-mail] said:
> One of the golden objectives of security is “secure by default”: that is,
> things should be secure as installed by default, and it takes willful action
> by the administrator or user to explicitly disable this (aka “let him hang
> himself”).  I don’t see a reason for us to abandon this ideal.

That seems like a fine goal, but it doesn't require that the protocol enforce 
authentication.

> "The complexity ratio between a simple non-authenticated NTP client and a
> client with authentication is enormous.”

> What are you basing that assertion on?

Having written lots of code.

What do you really want to know?  Are we quibbling about my use of "enormous"?

wc says the NTS code in ntpsec is 2666 lines.  (That includes the server side 
but not the header files.)  That drags in the OpenSSL libraries and Daniel 
Frank's libaes_siv.

The old joke is that you can fit anything on a single page if you use a small 
enough font.  If it will help the discussion, I'll write a minimal NTP client. 
 I don't think it will fit on a single page, but it won't be very big.

> And what about the flip-side of that argument?  What is the opportunity cost
> of not having that?  Where else does the mitigation end up instead?
> Firewalling?  Sanity checking clocks against multiple sources?  Inability to
> have boot-time PKI integrity because of not being able to check X.509
> validity intervals (and the obvious ripple-effect of PKI through other
> services)? 

I'm all for NTPv5 supporting authentication, but I don't think it should be 
mandatory.

Should we start a new thread about the infrastructure it will take to support 
universal authenticated time and how we are going to get it?


-- 
These are my opinions.  I hate spam.