Re: [Ntp] NTP Security (was NTPv5: big picture)

[Hal Murray <[e-mail]>]

[e-mail] said:
> I neglected to mention my now expired https://datatracker.ietf.org/doc/
> draft-ladd-nts-for-ntp-pool/ as an example of this approach.

That mentions ACME several times.  I don't know anything about ACME.  A few 
words about what it does might be helpful.

 From page 3:
> Clients MAY periodically resolve the pool associated domain
> names to confirm the server is still trusted by the pool.

That doesn't work.  The DNS servers for the pool reply with several IP 
Addresses out of many in the pool.  If a client asks again later, they will 
probably get a different subset.

This issue comes up even without NTS.  There is no way for a current pool 
client to verify that a server is still in the pool.

I think it should be easy to fix.  The pool DNS servers would have to support 
a new mode, something like an A record for d.c.b.a.pool.ntp.org that returns 
the address if the address is still in the pool.



-- 
These are my opinions.  I hate spam.