[Ntp] Fwd: Circular dependencies


> Begin forwarded message:
> 
> From: Mark Andrews <marka@isc.org>
> Subject: Re: [Ntp] Circular dependencies
> Date: 12 November 2020 at 10:07:33 AEDT
> To: Daniel Franke <dfoxfranke@gmail.com>
> 
> You just need to set CD=1 to tell the validating resolver to not validate.
> 
> DNSSEC doesn’t have a flag that says “just ignore timestamps” when validating
> but you can do that in the application with CD=1 + DO=1 responses.
> 
>> On 12 Nov 2020, at 09:42, Daniel Franke <dfoxfranke@gmail.com> wrote:
>> 
>> Is there something wrong with "don't do that" as a solution? Nothing
>> in NTS relies on or benefits from DNSSEC, so there's no reason to
>> validate it. If the system resolver validates automatically and
>> there's no way for an application to ask it not to, then the system
>> resolver is (temporarily) broken and will need to be bypassed.
>> 
>> On Wed, Nov 11, 2020 at 1:04 PM Watson Ladd <watsonbladd@gmail.com> wrote:
>>> 
>>> Dear NTP WG,
>>> 
>>> I just realized there is a mailing list bug report that's a lot more
>>> interesting than it seems. They have a DNSSEC validating resolver and
>>> were using an NTP daemon to set the clock (and the RTC was busted) But
>>> the time is needed to verify liveness of the signatures for DNSSEC to
>>> validate, and without the names don't resolve, including the NTP
>>> server names.
>>> 
>>> This is probably a bigger issue with NTS, as certs with IP addresses
>>> are harder to get. Roughtime can use its own keys, but does still rely
>>> on the DNS often, so it won't necessarily be a solution. Any ideas?
>>> 
>>> Sincerely,
>>> Watson Ladd
>>> 
>>> _______________________________________________
>>> ntp mailing list
>>> ntp@ietf.org
>>> https://www.ietf.org/mailman/listinfo/ntp
>> 
>> _______________________________________________
>> ntp mailing list
>> ntp@ietf.org
>> https://www.ietf.org/mailman/listinfo/ntp
> 
> -- 
> Mark Andrews, ISC
> 1 Seymour St., Dundas Valley, NSW 2117, Australia
> PHONE: +61 2 9871 4742              INTERNET: marka@isc.org
> 

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742              INTERNET: marka@isc.org