Re: [Ntp] NTPv5 draft

Here is another use case where secure NTP might not be needed.  All the traffic in the application, including ntp is protected by IPsec or MACsec.  Yes that add some delays, but for some applications that is okay.

Doug

On 12/1/20, 5:03 AM, "ntp on behalf of Miroslav Lichvar" <ntp-bounces@ietf.org on behalf of mlichvar@redhat.com> wrote:

    On Tue, Dec 01, 2020 at 10:51:22AM +0100, Dieter Sibold wrote:
    > On 1 Dec 2020, at 9:12, Miroslav Lichvar wrote:
    > > You mean to require all NTP packets to be authenticated? I don't like
    > > that idea. The improvements in NTPv5 are orthogonal to authentication.
    > > NTPv5 is not supposed to be more secure. An NTP client that doesn't
    > > want to implement the complexity of NTS shouldn't be restricted to
    > > NTPv4.
    > > 
    > 
    > Yes, I would propose that by default each NTP packet has to be
    > authenticated. Not using security should be an active decision! I don’t
    > think that security and increased time sync performance have to be
    > orthogonal. The 2-step approach could provide better time sync performance
    > and security.

    Ok, so if the draft said something like "NTP clients SHOULD use
    authentication", would that work for you? Ultimately, it would be up
    to the client's default configuration whether authentication is
    enabled or not.

    > > Isn't that the NTP root delay and dispersion? Together they provide an
    > > estimate of the maximum error in the receive and transmit timestamp.
    > 
    > Uncertainty and maximum error are different. The uncertainty interval will
    > always be smaller or equal to the max. error.

    Can you describe an example how would the server determine the
    uncertainty?

    -- 
    Miroslav Lichvar

    _______________________________________________
    ntp mailing list
    ntp@ietf.org
    https://www.ietf.org/mailman/listinfo/ntp