Re: [Ntp] NTP Security (was NTPv5: big picture)

[Magnus Danielson <[e-mail]>]

Philip,

On 2021-01-22 03:34, Philip Prindeville wrote:
>
>> On Jan 19, 2021, at 5:24 AM, Magnus Danielson <[e-mail]> wrote:
>>
>>> I think the point is that you cannot bootstrap secure time out of
>>> nothing.
>> That's a conjecture, yet to be proven.
>
> No, that's basic Information Theory.  Lost or non-existent information can't be recreated from a void.
>
> ...
Which needs to be properly proven to apply, because we end up shutting
this WG down if it truely applies.
>
>>> You either do full validation using some trusted time source
>>> (e.g. RTC), or you don't.
>> RTC is not a trusted time source. 
>
> I think I'm more likely to trust that which I can control or verify for myself, than that which I can't.

Which makes it an operational issue, which turns out to fail eventually,
and when it fails and NTP is your only way to resolve, you do not have
time and hence you are out of service. That is not leading towards a
robust solution.

So, in conclusion, rather than quickly dismiss the notion of being able
to bootstrap, it needs to be revisited. I through out a proposal to get
something to test. People did not like that, so now I let others find a
solution to replace it, and the purpose of my proposal was to provide
something for people to think and analyze, and find flaws and then fix
those flaws. What you ended up doing was dismissing the bare thought.

The lack of interest to solve this means that I see less use and
therefore less interest in NTPv5.

Cheers,
Magnus