[Ntp] Antw: [EXT] Re: Pool and DNS

[Ulrich Windl <[e-mail]>]

>>> Hal Murray <[e-mail]> schrieb am 23.10.2022 um 07:34 in
Nachricht
<[e-mail]>:

> 
> [e-mail] said:
>> I think you're basing this on a couple of false assumptions. First, I 
don't
>> know where the cookie lifetime of one day comes from. That's not specified
>> in RFC 8915. In most cases, we would expect the cookie to be valid as long
>> as the cookie encryption parameters shared between NTS‑KE server and NTP
>> server are not changed. This could potentially be a very long time.
> 
> 
> Interesting.  Thanks for bringing up this issue.
> 
> The key for the cookies needs to rotate occasionally.  I'm not enough of a 
> crypto geek to explain it.  There is a limited amount of data you can use 
> with 
> the same key before bad things happen.  How much depends on the algorithm.
> 
> I think there was some discussion on this list, I don't remember the 
> details.  
> One day seemed like a reasonable number.
> 
> RFC 8915, section 6, Suggested Format for NTS Cookies, says:
>     Servers should periodically (e.g., once daily) generate a new
>     pair '(I,K)' and immediately switch to using these values for
>     all newly‑generated cookies.
> 
> So one day is what I used in NTPsec.  (and my thinking)
> 
> The rest of that paragraph discusses keeping old keys, plural, but doesn't 
> say 
> anything about how many to keep.  One seemed like enough to me.  That 
> provides 
> a minimum of 24 hour lifetime and ntpd has a default max polling interval of

> 
> 1024 seconds.  I didn't consider any cases that would stash cookies for a 
> long 
> time.
> 
> You seen to have made the opposite assumption ‑ that a server should support

> cookies for a long tlong ime.
> 
> It's easy to save a few old keys.  We should probably agree on some 
> lifetime.
> 
> I'd be happy with 5 or 10.  365 seems unreasonable.

Given maxpoll 17 (36.4 h) and 8 attempts to get a response at that interval
(before the server is declared unreachable), then 14 days should be enough
(actually it's a little over 12 days).

...
Regards,
Ulrich