Re: [Ntp] The NTP WG has placed draft-roughtime-aanchal in state "Call For Adoption By WG Issued"

[Hal Murray <[e-mail]>]

[e-mail] said:
> Yes, it's becoming apparent that the draft needs to include the motivations
> for the Roughtime protocol. The impression I've got about Roughtime so far,
> and the reason for why I'm a proponent of it, is that it is small, simple,
> and easy to implement. I view it mainly as a way for end user applications
> (browsers etc.) and embedded devices of all sorts to get a "good enough" time
> for bootstrapping, verifying certificates and similar. 

I think there are 3 ideas tangled up here.

1) A way for a server to sign that it has seen some bits.
2) A time stamp for that signing and some info about the server's clock.
3) A way to chain 3 signings to show that the middle time stamp is bogus.

I haven't yet seen an interesting use case for the 3rd part.

The first part may be appropriate for joint work another IETF group.

I'm very interested in a way to get the time.  NTS-KE uses traditional 
certificates and checking those needs a sane time.  Rough, even very rough 
would be great.

But I haven't seen that this draft solves the critical step.  How does the 
client get the server's public key?  The draft says:
            long-term public/private key pair  (page 4)
and
            We assume the long-term server public key is known to the
client through other means.  (page 10)

How much work has been done on those "other means"?




-- 
These are my opinions.  I hate spam.