Re: [Ntp] NTPv5 draft

[Miroslav Lichvar <[e-mail]>]

On Fri, Dec 04, 2020 at 05:58:16PM +0100, Dieter Sibold wrote:
> > Ok, so if the draft said something like "NTP clients SHOULD use
> > authentication", would that work for you? Ultimately, it would be up
> > to the client's default configuration whether authentication is
> > enabled or not.
> > 
> 
> No. From my point of view this is not explicit. I would prefer that the
> basic protocol incorporates security. That would allow to use security
> without thinking about which approach needs to be applied to accomplish
> that. For the experts there might be additional option like the pre-shared
> key approach to acknowledge very specific circumstances. But the normal NTP
> user should be able to use a secured NTPv5 like using a https protected
> website.

Ok, I see your point, but I don't think it's a good idea. NTPv5 was
supposed to fix other issues. I don't remember anyone complaining that
NTPv4 can be used without authentication. That's a feature, not a bug.
It's up to the implementations and their default configurations to
enable authentication.

Web browsers still default to HTTP and how long does HTTPS exist?

NTS just become a thing. Forcing people to NTS by removing
unauthenticated NTP from NTPv5 won't work.

-- 
Miroslav Lichvar