[Ntp] Re: draft-ietf-ntp-roughtime-15 ietf last call Genart review

[Harlan Stenn <[e-mail]>]

On 1/8/2026 4:17 PM, Watson Ladd wrote:
> On Thu, Jan 8, 2026 at 4:06 PM Harlan Stenn
> <stenn=[e-mail]> wrote:
>>
>> On 1/8/2026 8:45 AM, Danny Mayer wrote:
>>>
>>> On 1/7/26 11:15 PM, Hal Murray wrote:
>>>> [I'm answering your questions, not commenting on the text in the draft.]
>>>>
>>>>> I think this needs some clarification. Because, AFAIK NTP and NTS does
>>>>> not require the client to have prior knowledge of the time either,
>>>>> right?
>>>> NTP works fine without any prior knowledge of time.  It is not secure.
>>>>
>>>> NTS uses TLS.  TLS uses certificates.  Certificates have not-before and
>>>> not-after times.
>>>
>>> This is wrong. It's actually a Catch-22 situation. You cannot use
>>> certificates if you don't know the time initially so you cannot use TLS
>>> or NTS initially.
>>>
>>> It gets worse because DNSSEC uses certificates which also need to have a
>>> relatively good local time in order to validate the certificates.
>>>
>>> A server that has been sitting on the shelf or doesn't have a TOD will
>>> have no idea of the time initially, so it needs to get time from a NTP
>>> server unauthenticated and unvalidated.
>>
>> Is that so?
>>
>> What is wrong with private-key authenticated time?
> 
> Private keys aren't, particularly across large numbers of IOT devices.

Where are these large numbers of IOT devices sourcing their time from?

It's at worst straightforward for the "local" DHCP server to provide a 
local set of curated, trusted time sources.

> Or they are a pain to manage and rotate.

Manually, sure.  But it's not difficult to automate.

It also depends on the use-case, and risks.

> Again this ignores another huge advantage discussed in the
> introduction: unlike every other existing mechanism for time
> distribution Roughtime enables proving when a server is providing time
> inconsistent with another, and thus taking action. It is certificate
> transparency for time.

I'll read more about this then.  Until then, I remain suspicious.

>> I wonder if Khronos might also provide assistance here.
>>
>>> There's no simple way out of this.
>>>
>>> Danny
>>>
>>>
>>> _______________________________________________
>>> ntp mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>>
>> --
>> Harlan Stenn <[e-mail]>
>> https://www.nwtime.org/ - be a member!
>>
>> _______________________________________________
>> ntp mailing list -- [e-mail]
>> To unsubscribe send an email to [e-mail]
> 
> 
> 

-- 
Harlan Stenn <[e-mail]>
NTP Project Lead.  The NTP Project is part of
https://www.nwtime.org/ - be a member!