Re: [Ntp] The NTP WG has placed draft-roughtime-aanchal in state "Call For Adoption By WG Issued"

[Marcus Dansarie <[e-mail]>]

On 2019-09-12 04:47, Hal Murray wrote:
> 
> I think there are 3 ideas tangled up here.
> 
> 1) A way for a server to sign that it has seen some bits.
> 2) A time stamp for that signing and some info about the server's clock.
> 3) A way to chain 3 signings to show that the middle time stamp is bogus.
> 
> I haven't yet seen an interesting use case for the 3rd part.

Chaining multiple signings allows for creating proofs of bad behavior.
If a server owner purposely serves bad time to a small subset of users,
there is currently no way of proving that in existing time protocols.
(The server will appear sane to non-targeted users.) With Roughtime, the
target of such an attack can present proof that can be verified by anyone.

> The first part may be appropriate for joint work another IETF group.

Yes, a general timestamping protocol is probably of interest to others.

> 
> I'm very interested in a way to get the time.  NTS-KE uses traditional 
> certificates and checking those needs a sane time.  Rough, even very rough 
> would be great.
> 
> But I haven't seen that this draft solves the critical step.  How does the 
> client get the server's public key?  The draft says:
>             long-term public/private key pair  (page 4)
> and
>             We assume the long-term server public key is known to the
> client through other means.  (page 10)
> 
> How much work has been done on those "other means"?

My view on this is that it will have to be done in the same way as with
TLS root certificates: the operating system/client software will come
with a set of trusted public keys. The policy for inclusion is decided
by the software maintainers.

Kind regards,
Marcus