Re: [Ntp] Éric Vyncke's No Objection on draft-ietf-ntp-using-nts-for-ntp-23: (with COMMENT)

[Marcus Dansarie <[e-mail]>]

Hi Éric!

Thank you for your work in reviewing the draft. Ragnar has previously
replied to some of your points. This reply should address the remaining
comments.

Kind regards,
Marcus Dansarie

On 2020-03-10 15:00, Éric Vyncke via Datatracker wrote:
> Éric Vyncke has entered the following ballot position for
> draft-ietf-ntp-using-nts-for-ntp-23: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-ntp-using-nts-for-ntp/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thank you for the work put into this document. It is easy to read (and this is
> important) and it has multiple implementations. Section 9.4 "Initial
> Verification of Server Certificates" is indeed a real chicken and egg issue and
> quite classical. I am also trusting the security AD and SECDIR for the security
> aspects of the protocol.
> 
> Please find below some non-blocking COMMENTs and NITs. An answer will be
> appreciated though ;-)
> 
> I hope that this helps to improve the document,
> 
> Regards,
> 
> -éric
> 
> == COMMENTS ==
> 
> -- Section 1.1 --
> Authentication is of course a desirable property but I would have assumed that
> the time accuracy is even more important. A shift in time -- even minor -- by
> one compromised party would even be more important.

Section 1.1. of the draft has been updated in response to this comment.

> In Figure 1, should there be a comma between "Shared cookie" and "encryption
> parameters" between NTS-KE & NTP servers ?

The text refers to the fact that the NTS-KE server and NTP servers share
the parameters required for cookie encryption and decryption, NOT that
they share a cookie (which they don't).

> -- Section 4.1.7 --
> While I am a little surprised to see IPv4/IPv6 addresses transmitted as ASCII
> strings, please also refer to RFC 5952 for the canonical representation of an
> IPv6 address.

We are concerned that changing this could cause problems for
implementations in embedded devices and other "small" systems.

> The sentence "If a label contains at least one non-ASCII character, ..."
> probably applies to the FQDN but it would be clearer to say so.

Section 4.1.7. has been updated in response to your comment.

> Should the FQDN be terminated by a final dot ?

Section 4.1.7. has been updated in response to your comment.

> == NITS ==
> 
> -- Section 7.6 --
> The table will gain clarity by adding an empty line between entries.

This will likely be resolved when the RFC Editor updates the table with
the correct values.