Re: [Ntp] Getting started using NTS -- clock accuracy vs certificates

[Miroslav Lichvar <[e-mail]>]

On Mon, Aug 01, 2022 at 02:06:37PM -0700, Hal Murray wrote:
> With your suggestion, I think it's reasonable for a server to have 2 
> certificates and use the right one depending on the host name presented early 
> in the handshake.

It doesn't have to be only two. A new name and certificate could be
added periodically (e.g. once a year), or whenever a compromise of the
key is suspected. Up-to-date clients use the latest certificate. Only
a client that didn't receive the latest update will need to use an older
certificate in order to synchronize its clock and receive the latest
name+certificate (e.g. over HTTPS).

Very old certificates can be rotated out. This might work better on
OS-specific servers where they would know which versions are no longer
supported.

> Using the numerical IP address as the "host name" in the certificate would 
> avoid the DNSSEC tangle.  That seems like a reasonable convention for long 
> lived certificates.

Yes, including the IP address as a Subject Alternative Name in the
certificate could be a very useful feature.

> Is there a list of public NTS servers?

Here is a nice list:
https://netfuture.ch/2021/12/transparent-trustworthy-time-with-ntp-and-nts/#server-list

> We only need a few NTS servers with long lived certificates so non-RTC systems 
> can get off the ground.  After that, they can switch to closer servers.

This logic would need to be implemented in the clients.

-- 
Miroslav Lichvar