Re: [ntpwg] [dhcwg] Fwd: New Version Notification for draft-ogud-dhc-udp-time-option-01.txt

[TSG - personal <[e-mail]>]

On 12/01/2013 04:31 PM, Danny Mayer wrote:

Danny many entities running DNSSEC dont have the option to continue 
operations until such time as they get better time data under the certs. 
This is a policy level thing so its not something that they can 
technically ignore either.

Todd
> On 12/1/2013 5:29 PM, Ted Lemon wrote:
>> On Dec 1, 2013, at 5:05 PM, Olafur Gudmundsson <[e-mail]> wrote:
>>> The "threat" the document is trying to address, device wants to
> DNSSEC or CERT validation but clock is far off thus VALID credentials
> fail validation.
>> Ah, thanks for explaining. This is what I was missing—you're not
>> doing
> this to avoid a threat at all, but rather to simply make DNSSEC work in
> a possibly non-secure mode until such time as you can bootstrap better
> time information.
>> This would be worth mentioning in the introduction and/or the
>> security
> considerations section. You allude to it in the security considerations,
> but it's pretty oblique.
>> It is worth pointing out that NTP doesn't actually need DNS to
> work—DHCP can deliver NTP server addresses as IP addresses. That said,
> this option seems to add value, since there is no guarantee that devices
> that implement the existing DHCP NTP will not send FQDNs rather than IP
> addresses.
>
> I had a long discussion with Bernie over the issue of delivering NTP IP
> addresses via DHCP. We understand the issues you raised concerning
> DNSSEC and have no disagreement about that. The problem is that for NTP
> DNS names are preferred over IP addresses because that allows a server
> maintainer to retire an NTP server. With an IP address there is no
> chance that your local instance will know about this and continue to
> bombard the old address. Moreover the newer pool option cannot be used
> to any advantage.
>
> When was the last time you looked at your NTP configuration and verified
> that all of the servers listed are still valid? How often will DHCP
> servers do this as a matter of course before providing such
> provisioning? We have systems that are being bombarded by requests even
> though no NTP server is responding to queries. We have plenty of
> evidence of this. Even worse we have seen home routers which have
> hard-coded IP addresses for NTP servers embedded. How long are those
> going to be in operation?
>
> I think we need to figure out how to get around the Catch-22 situation
> of DNSSEC requiring relatively good time and NTP wanting to be able to
> use DNS to find valid NTP servers.
>
> We need a joint agreement on how to deal with this between DHCP and NTP
> Working Groups assuming that is a viable option in the first place.
> RFC5908 was not a good indication of this.
>
> Danny
>
> _______________________________________________
> ntpwg mailing list
> [e-mail]
> http://lists.ntp.org/listinfo/ntpwg
>

_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg