Re: [Ntp] NTP Security (was NTPv5: big picture)

[FUSTE Emmanuel <[e-mail]>]

Le 20/01/2021 à 10:07, Miroslav Lichvar a écrit :
> On Tue, Jan 19, 2021 at 06:48:45PM +0100, Kurt Roeckx wrote:
>> I agree that you can't combine two things that are not validated
>> and end up with something that's validated. But everything really
>> is about probabilities and amount of work needed to break it. The
>> more keys that need to be compromised before you accept something
>> wrong, the more unlikely it is. I think it's really up to the
>> users to decide what is an acceptable risk.
> Ok, as long as it is clear that the proposed mechanism for
> bootstrapping time it is not supposed to be secure (in threat models
> commonly assumed with DNSSEC and TLS), just more difficult to be
> exploited, I have no problem with that.
>
> There are other recommendations that could be made if you cannot
> perform the certificate time check using a trusted time source, which
> might be easier to implement, e.g. require multiple independent NTS
> sources.
>
Which was always been part of the proposed mechanism too.
DNSSEC should be put into the equation because it is a necessity to 
have/use at term.
So you have do to exactly the same: disable DNSSEC validation, acquire 
the time using multiple independent NTS sources, re-enable DNSSEC and 
re-enable DNSSEC/re-validate the server direct/reverse records and be done.
If we do not explicit this scenario, some will object that they do-not 
will-not implement DNSSEC validation because it is incompatible with NTP 
bootstrap/startup.
Using locally configured CA or the proposed DANE refinement for the NTS 
certificate validation is just another possibility/trade-of. Your could 
put the cursor where you want/need.

Emmanuel.