IETF Logo Mail Archive

Re: [Ntp] Getting started using NTS -- clock accuracy vs certificates

Danny Mayer <mayer@pdmconsulting.net> Tue, 02 August 2022 13:39 UTC

Return-Path: <mayer@pdmconsulting.net>
X-Original-To: ntp@ietfa.amsl.com
Delivered-To: ntp@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52354C15C520 for <ntp@ietfa.amsl.com>; Tue, 2 Aug 2022 06:39:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.098
X-Spam-Level:
X-Spam-Status: No, score=-6.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, NICE_REPLY_A=-0.001, RCVD_IN_DNSWL_HI=-5, RDNS_NONE=0.793, T_SCC_BODY_TEXT_LINE=-0.01, T_SPF_HELO_TEMPERROR=0.01, T_SPF_TEMPERROR=0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xNJVqMl1Ksmy for <ntp@ietfa.amsl.com>; Tue, 2 Aug 2022 06:39:10 -0700 (PDT)
Received: from chessie.everett.org (unknown [IPv6:2001:470:1:205::234]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98E72C13CCDC for <ntp@ietf.org>; Tue, 2 Aug 2022 06:39:08 -0700 (PDT)
Received: from [192.168.1.156] (pool-108-26-202-2.bstnma.fios.verizon.net [108.26.202.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by chessie.everett.org (Postfix) with ESMTPSA id 4Lxx0r1pbvzMP2n; Tue, 2 Aug 2022 13:39:08 +0000 (UTC)
Message-ID: <21466cc0-dbdb-102c-2886-46c7b22d1348@pdmconsulting.net>
Date: Tue, 02 Aug 2022 09:39:07 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Thunderbird/91.11.0
Content-Language: en-US
To: Miroslav Lichvar <mlichvar@redhat.com>, Hal Murray <halmurray@sonic.net>
Cc: ntp@ietf.org
References: <mlichvar@redhat.com> <YueT8bAiTeM+nTZv@localhost> <20220801210637.D395628C1CA@107-137-68-211.lightspeed.sntcca.sbcglobal.net> <YujtTu1YYEvhg2Hv@localhost>
From: Danny Mayer <mayer@pdmconsulting.net>
In-Reply-To: <YujtTu1YYEvhg2Hv@localhost>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Archived-At: <https://mailarchive.ietf.org/arch/msg/ntp/ZQ-EhubFDILKdLcAG9PXd6N61Kc>
Subject: Re: [Ntp] Getting started using NTS -- clock accuracy vs certificates
X-BeenThere: ntp@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Network Time Protocol <ntp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ntp>, <mailto:ntp-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ntp/>
List-Post: <mailto:ntp@ietf.org>
List-Help: <mailto:ntp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ntp>, <mailto:ntp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 02 Aug 2022 13:39:17 -0000

On 8/2/22 5:24 AM, Miroslav Lichvar wrote:
> On Mon, Aug 01, 2022 at 02:06:37PM -0700, Hal Murray wrote:
> Using the numerical IP address as the "host name" in the certificate 
> would
>> avoid the DNSSEC tangle.  That seems like a reasonable convention for long
>> lived certificates.
> Yes, including the IP address as a Subject Alternative Name in the
> certificate could be a very useful feature.
Not really. IP addresses are not a reliable constant. You don't avoid 
the DNSSEC tangle because DNSSEC needs accurate time (relatively 
speaking) to work at all. This is the bootstrap problem.


Danny

v2.23.0 | Report a Bug | By Email