Re: [ntpwg] New Version Notification for draft-ietf-ntp-network-time-security-12.txt and draft-ietf-ntp-using-nts-for-ntp-03.txt

[Harlan Stenn <[e-mail]>]

Danny Mayer writes:
> On 12/23/2015 4:13 PM, Harlan Stenn wrote:
> > Danny Mayer writes:
> >> ... The problem is that a
> >> MAC extension field needs to be specified so that it can replace the
> >> existing MAC field. I'm also considering allowing for multiple MAC
> >> extension fields in a single packet so that one MAC hashing algorithm
> >> can be retired if found to be compromisable without disrupting NTP
> >> infrastructure and existing implementations. It also needs some
> >> discussion on usage by responding packets and which to use.
> > 
> > If this is a V4 thing there will be backward compatability issues.
> 
> No, not really. New code like NTS would use the new Extension Field but
> the MAC will need to be kept for older systems who won't be able to use
> NTS anyway.

You mean "updated versions of ntpd" wil be able to use the new Extension
Field, right?

> > I think I have an idea about how to do this so older systems might still
> > work.  It will require more research though.
> 
> The older systems won't know about the NTS stuff so it doesn't matter.

This is not about NTS.  It's about your statement re using an extension
field for the MAC instead of the old MAC.

Think about the case where a new authenticated association is being spun
up and the initiating system does not know if the target system supports
this new extension field.

> The MAC itself can't go away until v5.

We've done a suboptimal job of supporting older NTP versions.  The good
news is that this hasn't caused problems so nobody has cared about it,
at least not enough to have ever emailed or opened a bug about it.

I don't think we'll have that luxury for v5 servers with v4 (or earlier)
clients.

And while we will need a mechanism in v5 to support v4 or earlier
versions, we can also implement a policy choice to decide what earlier
versions of the protocol the running ntpd will/won't support.
-- 
Harlan Stenn <[e-mail]>
http://networktimefoundation.org - be a member!
_______________________________________________
ntpwg mailing list
[e-mail]
http://lists.ntp.org/listinfo/ntpwg