Re: [Ntp] NTPv5 draft

[Miroslav Lichvar <[e-mail]>]

On Tue, Dec 01, 2020 at 10:51:22AM +0100, Dieter Sibold wrote:
> On 1 Dec 2020, at 9:12, Miroslav Lichvar wrote:
> > You mean to require all NTP packets to be authenticated? I don't like
> > that idea. The improvements in NTPv5 are orthogonal to authentication.
> > NTPv5 is not supposed to be more secure. An NTP client that doesn't
> > want to implement the complexity of NTS shouldn't be restricted to
> > NTPv4.
> > 
> 
> Yes, I would propose that by default each NTP packet has to be
> authenticated. Not using security should be an active decision! I don’t
> think that security and increased time sync performance have to be
> orthogonal. The 2-step approach could provide better time sync performance
> and security.

Ok, so if the draft said something like "NTP clients SHOULD use
authentication", would that work for you? Ultimately, it would be up
to the client's default configuration whether authentication is
enabled or not.

> > Isn't that the NTP root delay and dispersion? Together they provide an
> > estimate of the maximum error in the receive and transmit timestamp.
> 
> Uncertainty and maximum error are different. The uncertainty interval will
> always be smaller or equal to the max. error.

Can you describe an example how would the server determine the
uncertainty?

-- 
Miroslav Lichvar