Re: [Ntp] Shorter NTS packets?

[Miroslav Lichvar <[e-mail]>]

On Thu, Dec 09, 2021 at 10:36:44AM -0500, Daniel Franke wrote:
> If I had to make some changes to NTS to shave a few bytes of packet
> sizes, the changes I'd make would be:
> 
> 1. Use AES-GCM-SIV instead of AES-SIV, which halves key sizes for any
> given security level.
> 2. Shorten the unique identifier from 32 bytes to 16. Our choice of 32
> was *very* conservative and 16 would be basically fine.
> 3. Add an extra KDF step, so that we export a common pre-key from TLS
> and then derive the C2S and S2C from that. Then the pre-key can go
> into the cookie so it only has to carry one key rather than two (I
> think Scott Fluhrer suggested this at some point).

All three sound good to me.
> 
> #1 can be implemented today. The other two are backward incompatible
> so unless they can produce some really night-and-day difference in
> packet deliverability they'd best wait for NTPv5.

We need to save at least 32 octets. With two halved keys in the cookie
that is exactly right?

Thanks,

-- 
Miroslav Lichvar