Re: [Ntp] Draft extension NTS for pools

[Hal Murray <[e-mail]>]

I think the pool as we know it and security are incompatible.  The problem is 
one of trust.  If you have a large collection of volunteers, there is no way 
to know that they are all good guys.  NTS can ensure that you are talking to a 
pool server, but not that the operator of that system is a good guy.

I could imagine a pool run with a restricted membership.

I think a discussion of the operational side of running NTS/NTP servers would 
be a good idea.  I'm primarily thinking of organizations that run multiple 
servers but ideas for single servers or pools would be welcome.

I think your 4 options are a good start.

---------

Your draft is well written.  I think I could implement from it without much help.

I think it needs a big warning about trust and the current pool.

Section 5: Pool authentication
I don't understand
  To discourage misuse, ...
What sort of misuse do you have in mind?  What could a bad guy do if he gets cookies for an arbitrary key?

  ... MUST authenticate clients using the Fixed Key Request
  record using TLS client certificates.

At first glance, that seem overly strong.  Yes, client certificates are a good way to authenticate.  Why isn't filtering by IP Address good enough?  It might be simpler to implement with firewall rules.  But that's not good enough if you are worried about MITM attacks.


Section 6.5. NTP Server Deny

> A client MAY send multiple of these records if desired. The data in the
> record SHOULD match that given through an NTPv4 Server Negotiation received
> in an earlier request from the same NTS Key Exchange server.

I think this area needs work.  I need to be able to avoid servers that I got some other way that also happen to be in the pool.

And you might have multiple servers for load sharing so "the same" gets complicated.






-- 
These are my opinions.  I hate spam.