Re: [Ntp] NTS IANA request

[Daniel Franke <[e-mail]>]

As a slight tangent, we never concluded the discussion as to what
we're going to do about the fact that so many ISPs are dropping
123/udp traffic with payloads larger than 48 bytes. I think we got as
far as concluding:

1. We're never going to persuade enough ISPs to change their policy,
making 123/udp basically doomed.
2. NTS-KE's port negotiation record gives us all the mechanism we need
in order to run NTP-with-NTS over an alternate port.

But that left an unresolved question: do we allocate a fixed alternate
UDP port, or should servers ask the OS for a dynamic port and then use
NTS-KE to advertise whatever the OS assigns to them? Both choices have
firewall-related drawbacks. If we use a fixed port, we risk landing
ourselves right back in the same situation we're in today with 123. At
minimum, to protect ourselves from this, the NTF would have to commit
to adding some code to ntpd such that it will refuse to ever send mode
6 or 7 responses over the new port no matter what configuration the
user gives it. (Yes, mode 6 too, because mode 6 still amplifies, just
not as severely as mode 7 does). If we use a dynamic port, then it
becomes much harder for ISPs to block us, but it also becomes harder
for corporate firewalls with a default-deny-all policy to let us
through.

On Thu, Jun 6, 2019 at 1:06 PM Salz, Rich <[e-mail]> wrote:
>
> >    I'm strongly opposed to modifying NTS-KE to involve sending a STARTTLS
>     as a first step of the handshake. I don't want to make a breaking
>     change to a protocol that's passed WGLC and has four interoperating
>     implementations in order to accommodate a protocol that has never been
>     implemented and whose specification consists of three vague sentences
>     in an unadopted and expired I-D.
>
> I wasn't strongly advocating either mechanism, just trying to explain how things could share a port if that's what we wanted to do.
>
> For the record, since I see no definition of NTP/TLS, I am in favor of assigning 123/TCP to NTS.
>
>