Re: [Ntp] ntpv5 requirements

[Miroslav Lichvar <[e-mail]>]

On Mon, Feb 13, 2023 at 06:10:44PM +0000, Doug Arnold wrote:
> I think that he sees TESLA as super-efficient. One could generate 1 key per second to be used by all clients that second, never open a TLS channel, never look up keys in an a key index table, never encrypt a cookie.

There would still need to be some asymmetric operation and
certificates in order to authenticate the first key for the client, so
something like NTS-KE/TLS would need to be used anyway.

TESLA requires a reasonably accurate clock to be able to tell when a
key is disclosed. Some clients probably wouldn't want to wait more
than few seconds for the key (e.g. to set the clock on boot), so the
clock would have to be kept accurate to a second.

Some devices have very unstable clocks (e.g. in virtual machines) and
would need to poll the server very frequently to stay within that
limit. Some computers don't have an RTC and lose time while suspended.
There are other reasons for unexpected steps of a clock.

If the clock is not kept accurate, it completely breaks the security,
just to avoid decoding a cookie. I don't think that is acceptable for
NTP. 

-- 
Miroslav Lichvar