Re: [Ntp] NTS pool support

[Hal Murray <[e-mail]>]

> Here's my naive suggestion on how to handle NTS pools.

I think you have to be very careful about what you mean by "pool".  In most 
NTP discussions, "the pool" usually means pool.ntp.org, a large collection of 
NTP servers run by volunteers.  Trust and secure don't make sense with that 
type of operation.  There is no point in using NTS.

Actually, I think we should NOT use NTS with "the pool".  It would give a 
false sense of security.

If the pool technology used with other pools?


Is there a term for a collection of NTP servers that are all run by the same organization?  I'll use "cluster".

Do we need pool technology if one organization runs the whole thing?  Why not just use separate names for each server?  How many servers will one organization want to run?  ...

One approach for clusters is for all the NTP servers to use the same certificate.  That means they all need the same secret key.  Cloudflare thinks that is reasonable.  They have lots of servers with the same certificate/key but use something other than pool technology to locate them.


We could avoid the key sharing by having the KE servers return the name on the certificate the server will use along with the IP Address.  That seems like a good idea.

For a more pool like approach, we need an option to return several batches of whatever is returned now - maybe with separate K2S and S2K for each batch.

---------

Or we could invent an alternate protocol.  The first stage just returns a list of names - what would have been in the SRV records.  The second stage does NTSKE with each name.  That's just reinventing SRV records in an environment we know is secure.

If we trust DNS we could use real DNS/SRV records.  I'm not a DNS wizard.  I don't know how to setup DNSSEC.  I'd be happy to use DNS/SRV if we find a DNS wizard who can point to a simple HOWTO type document that tells how to secure DNS.  We may need a separate document for each OS/distro.

What's the general status of DNSSEC these days?  Is it ready for prime time?  Should we be using it to help build critical mass?  Or using something else until more OSes/distros have good support?

Is there a simple/portable API to get SRV records?


-- 
These are my opinions.  I hate spam.