Re: [ntpwg] Antwort: Re: NTS: DTLS and symmetric mode

[Miroslav Lichvar <[e-mail]>]

On Tue, Aug 01, 2017 at 05:04:32PM +0200, [e-mail] wrote:
> > Von: Miroslav Lichvar <[e-mail]>
> > Here is the list of issues I posted previously (with no response) [1]:
> > 
> > - no stateless passive mode
> > - problematic pairing of DTLS sessions
> Daniel considered this question. He provided a discussion in Sec. 4 of the 
> current NTS draft (version -09).

That clarifies some of the issues we discussed before, but it seems to
me it still assumes there can be only one NTS peer per IP address.
That wasn't the case with older authentication mechanisms (symmetric
key, autokey).

> >   - won't work with HW which can timestamp only packets on port 123
> >     (or 319)
> Yes, but the vast majority of NTP servers and clients don't use HW based 
> time stamping. Also note, that HW based time stamping is going to be 
> difficult for mode 3 and 4 packets also. This packets are protected by NTS 
> extension fields and HW time stamping NICs are not able to calculate the 
> NTS AEAD information (at least currently).

HW doesn't need to know about NTS, it can still be a SW implementation
of NTP+NTS. The problem is with receiving packets. Some HW can provide
timestamps for all received packets, but apparently in some designs
that would have a significant impact on performance, so there is a
filter to limit timestamps to PTP/NTP packets. I think there is at
least one which can be configured to timestamps packets on UDP port
123 or 319, but not other ports.

> > - won't work with future NTP extensions for delay corrections in
> >   routers/switches
> That is probably true. But I don't see the use case for this. Typically 
> you apply symmetric mode in a closed environment. If you require the 
> additional accuracy of delay corrections in router/switches you would 
> apply PTP which already provide these features. 

PTP doesn't have NTS :). Authentication is not the only reason why
people may want to prefer NTP over PTP in local networks.

Anyway, do we know if anyone is actually interested in implementing
this NTP over DTLS symmetric mode?

I'm wondering if it wouldn't be better to leave it out of the draft
and focus on that later if there is interest. It doesn't specify NTS
for broadcast mode either (which of course would be much more
difficult to do).

-- 
Miroslav Lichvar
_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg