[Ntp] Draft extension NTS for pools

[David Venhoek <[e-mail]>]

Dear All,

As promised during the last interrim, a few colleagues and I have
worked to put into a draft the approach we have taken in our
experiments to get a prototype NTS pool working. The draft is at
https://datatracker.ietf.org/doc/draft-venhoek-nts-pool/00/, if you
want to provide suggestions for edits, the easiest way to do so is
through the documents github:
https://github.com/pendulum-project/nts-pool-draft

To give some background, the main problem inhibiting an NTS pool
currently is that it is hard to provide key exchange services for a
heterogeneous pool of NTP servers supporting NTS. It seems there is a
fundamental choice between 1 of 4 options that needs to be taken to
make a pool. You either need to:
 - Modify clients to handle a second layer of indirection in the DNS
lookup, for example when using srv records to make the pool
 - Share large amounts of master secrets between the pool and all pool
servers, either
    - through sharing TLS certificates for the pool domain so each
pool server can run its own key exchange
    - or by sharing cookie format and secrets with the pool so the
pool can make cookies for each server,
 - or modify the server side to allow the pool to ask for cookies for
arbitrary keys.
We have decided to experiment with the latter as it seemed the most
achievable way that still preserves a decent amount of security. In
particular, we preferred it because it doesn't require modification of
clients to use it. (though our current design does allow clients with
additional support to gain some efficiency)

We have mostly implemented the design suggested in the draft within
the ntpd-rs project, see
https://github.com/pendulum-project/ntpd-rs/tree/main/nts-pool-ke for
instructions on how to experiment with it. There are some differences
between what's implemented and the draft, primarily because the draft
already learned from some of our experiences with the implementation
and we haven't (yet) had the time to implement those lessons.

Thanks all in advance for any feedback.

Kind regards (also on behalf of Folkert de Vries and Marc Schoolderman),
David Venhoek