Re: [Ntp] Draft on using NTS with the pool

[Miroslav Lichvar <[e-mail]>]

On Fri, Feb 28, 2020 at 12:30:26PM -0800, Watson Ladd wrote:
> Hello,
> 
> I've uploaded https://datatracker.ietf.org/doc/draft-ladd-nts-for-ntp-pool/
> which contains a putative mechanism for using NTS with the NTP pool.
> 
> I'd appreciate comments: there is a lot to think through in this, but
> it's important to get NTS adoption. Definitely the draft is in rough
> shape, but sooner seemed better than never.

I think at least on some platforms dependency on SRV and DNSSEC may be
very problematic. I suspect in many cases the NTS client would need to
have its own DNS client in order to get the SRV record and be sure
that the DNS response was validated.

Are there any other protocols that depend on DNSSEC? The few that I'm
familiar with, like SIP or XMPP, don't rely on DNSSEC (certificates
are for the original name, not those from SRV record).

I'm wondering if it would make sense to specify a "redirect" NTS-KE
record, which would tell the NTS-KE client to connect to a different
NTS-KE server without giving any cookies. The client would remember it
for some specified time to decrease the load on the server. This would
be closer to DNS over TLS rather than DNSSEC.

-- 
Miroslav Lichvar