Re: [Ntp] Pool and DNS

[Miroslav Lichvar <[e-mail]>]

On Sat, Oct 22, 2022 at 10:34:30PM -0700, Hal Murray wrote:
> Second, there is no established protocol between NTS-KE servers and NTP 
> servers.
> 
> NTPsec packages the KE server with ntpd so there is no need for that protocol. 
>  I don't know of any split implementations.  So as a practical matter, it 
> would be hard to put together a pool using that mechanism with available code.
> 
> 
> Miroslav: What does chrony do?

chronyd can be configured to load the NTS server keys from disk
instead of generating its own in order to run multiple NTS-KE servers
for a single NTP server. One instance is generating new keys (once
per week by default) and all other instances are loading it from disk.
The distribution of keys between the hosts is left up to the admin. A
daily cronjob using rsync might be the simplest solution.

The NTS key file includes one "future" key, so the key update doesn't
have to be synchronized with the rotation of the key-generating
instance in order to not break decoding of cookies.

I'm not sure how useful this really is for a pool. If you have/expect
so many clients that you need to add a new NTS-KE server, why not use
it also for NTP and share the NTP load, i.e. run independent
NTS-KE+NTP servers?

-- 
Miroslav Lichvar