Re: [Ntp] A simpler way to secure PTP

[Miroslav Lichvar <[e-mail]>]

On Sat, May 08, 2021 at 04:53:06PM -0400, Daniel Franke wrote:
> The trick is: run NTS-secured NTP and regular, unauthenticated PTP
> side-by-side. Do not use the NTP responses to set the clock; instead, use
> them only to establish maximum error bounds on the current time, and then
> clamp all PTP messages to within those bounds.

Makes sense to me.

In a more general approach, this is already possible with some
existing PTP and NTP implementations like linuxptp and chrony. PTP can
be specified as an untrusted reference clock, which will be used for
synchronization only if it agrees with trusted NTS-secured NTP
source(s). We recommend combining (multiple) PTP and NTP time sources
for better accuracy, resiliency, and security.

-- 
Miroslav Lichvar