Re: [Ntp] Draft on using NTS with the pool

On Sat, Feb 29, 2020 at 3:25 AM Marcus Dansarie <marcus@dansarie.se> wrote:
>
> Thank you for putting this together!
>
> Your draft proposes a more complicated solution than the one I had
> envisaged. I imagined something like the following.

Thank you for explaining your ideas. I don't think your solution is as
simple as it looks due to some missing peices, while my solution
doesn't seem that complex to me, but I'm open to being convinced
otherwise.

>
> 3. If the client sent a FQDN, the server will pick an NTP server from
> that pool and return cookies for that server along with an appropriate
> NTP Server Negotiation record. If the client sent an IP address (which
> belongs to a server in the pool), the server simply returns cookies and
> NTP Server Negotiation record for that address.

This implies that the servers have key material shared with the pool
for the cookies. That's sort of problematic, especially with key
rotation: you have to all support the same ciphersuites, similar
cookie formats, etc. That adds some complexity that isn't apparent
from the description, and it mean another protocol that NTS
implementations need to interoperate with to transmit the ticket
related data to the pool.

It also increases the load on the pool servers. Round-robin DNS is
very cacheable and easy to serve at high speed, even with DNSSEC.  TCP
based protocols are a bit more heavyweight. This may not be a problem:
I'd appreciate pool operators weighing in on this.

>
> This scheme has the advantage that a pool only needs to run one (or a
> few) NTS-KE servers with certificates for a single (or a few) domain
> names. Each individual server only needs a shared secret with the NTS-KE
> server to support NTS. There is no need to obtain and maintain an
> individual certificate for each server.

With ACME this is straightforward to handle in an automated way.

>
> Kind regards,
> Marcus
>
>
> On 2020-02-28 21:30, Watson Ladd wrote:
> > Hello,
> >
> > I've uploaded https://datatracker.ietf.org/doc/draft-ladd-nts-for-ntp-pool/
> > which contains a putative mechanism for using NTS with the NTP pool.
> >
> > I'd appreciate comments: there is a lot to think through in this, but
> > it's important to get NTS adoption. Definitely the draft is in rough
> > shape, but sooner seemed better than never.
> >
> > Sincerely,
> > Watson Ladd
> >
> > _______________________________________________
> > ntp mailing list
> > ntp@ietf.org
> > https://www.ietf.org/mailman/listinfo/ntp
> >
>
> _______________________________________________
> ntp mailing list
> ntp@ietf.org
> https://www.ietf.org/mailman/listinfo/ntp

--
"Man is born free, but everywhere he is in chains".
--Rousseau.