Re: [Ntp] NTP Security (was NTPv5: big picture)

[Miroslav Lichvar <[e-mail]>]

On Sat, Jan 16, 2021 at 04:43:21PM -0800, Watson Ladd wrote:
> On Sat, Jan 16, 2021 at 3:35 PM Kurt Roeckx <[e-mail]> wrote:
> > On Sat, Jan 16, 2021 at 02:49:33PM -0800, James Browning wrote:
> > > 2) Have the pool run a common NTS-KE server for all NTS servers in the pool.
> >
> > As far as I understand things, that would not be a good idea.
> 
> Agreed. The key management and synchronization in such a system is a pain.

Also, format and content of cookies is implementation-specific, so
that NTS-KE server would need to specifically support all common
implementations.

I suspect a bigger issue would be the resources required for the
NTS-KE service. I don't think it's likely it would be able to run on
the core pool's infrastructure. (One of the main points of the pool is
to share the costs.)

> > > 3) Convince TLS certificate vendors to sell IP based certificates.

IIRC, ZeroSSL (one of the LetsEncrypt alternatives) can issue
certificates for IP addresses. But I'm not sure if availability of
such certificates changes anything. The clients of the pool would
still need to get the addresses in a secured way.

> > Open a TLS connection to ask for servers, get a list of hostnames.
> 
> This has some interesting advantages.

And it shares the scalability issue with the common NTS-KE server. I
think the load needs to be shared among the volunteers' servers.

-- 
Miroslav Lichvar