Re: [Ntp] NTP Security (was NTPv5: big picture)

[James <[e-mail]>]

My aims for NTPv5 would be to remove refid being tightly coupled to IP
addresses, making #3 not necessary as a requirement.

A few other options:
4) NTPv5 pool participants could run their own servers instead of a
common server, with the pool able to describe which are trusted as
they are part of the pool.
5) NTS isn't used, and instead a different approach is used instead. I
have a few very primitive ides on this subject but not enough
knowledge yet to shape them.

- J


- J

On Sat, 16 Jan 2021 at 23:50, James Browning <[e-mail]> wrote:
>
> On Sat, Jan 16, 2021, at 11:02 AM Watson Ladd <[e-mail]> wrote:
>>
>> I'd like to see some input from people who operate the pool on what
>> solutions would work for them. Right now we're sort of flying blind.
>> Perhaps we can discuss at IETF 110?
>
>
> Only a user of the pool, but I basically see three ways to manage that.
> 1) Have the pool serve up SRV records and rewrite the pool code, the spec, and clients to compensate.
> 2) Have the pool run a common NTS-KE server for all NTS servers in the pool.
> 3) Convince TLS certificate vendors to sell IP based certificates.
> I am not particularly fond of any. Someone should find a fourth way.
>
> ----
> Removing all doubt.
> _______________________________________________
> ntp mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ntp