Re: [Ntp] Circular dependencies

[Tony Finch <[e-mail]>]

Watson Ladd <[e-mail]> wrote:
>
> I just realized there is a mailing list bug report that's a lot more
> interesting than it seems. They have a DNSSEC validating resolver and
> were using an NTP daemon to set the clock (and the RTC was busted) But
> the time is needed to verify liveness of the signatures for DNSSEC to
> validate, and without the names don't resolve, including the NTP
> server names.

Ugh yes this has been a problem forever :-( but not a big enough problem
in practise for anyone to seriously tackle it. As if no-one cares about
making DNSSEC validation Just Work on a Raspberry Pi...

> This is probably a bigger issue with NTS, as certs with IP addresses
> are harder to get. Roughtime can use its own keys, but does still rely
> on the DNS often, so it won't necessarily be a solution. Any ideas?

I'm eagerly looking forward to RFC 8738 ACME-IP support
https://letsencrypt.org/upcoming-features/

My fantasy solution for this bootstrapping problem is mostly about getting
an up-to-date DNSSEC trust anchor, but also the time, on a device that was
switched off while a rollover happened. When the device boots and finds
nothing works, it contacts a bunch of witnesses for which it has
preconfigured public keys and IP addresses that are expected to be stable
for the long term. It gets the current trust anchors and time from each
witness: no single witness is trusted, a large enough quorum of them have
to agree for the device to be able to recover. We assume the witnesses are
sufficiently independent that a quorum is more trustworthy than a single
trusted third party. We hope that there are enough witnesses that even
after a long time enough witnesses are stll working so an old device can
contact a quorum.

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Fitzroy, Sole, Lundy, Fastnet, Irish Sea: South, veering west at times, 6 to
gale 8, occasionally severe gale 9 at first in Lundy and Irish Sea. Rough or
very rough, occasionally moderate in Irish Sea. Occasional rain. Moderate or
poor.