Subject: [ntpwg] Updated draft

From: mills at udel.edu (David L. Mills)
Date: Sat, 10 Feb 2007 04:40:41 +0000

Guys,

An updated draft of the NTP document is linked from the NTP project page 
at www.ntp.org.

1. The manycast server discovery scheme has been added to the skeleton 
and the skeleton recomplied for error check. Several small details were 
changed to match corresponding changes in the reference implementation. 
The updated skeleton has been snipped into the draft.

2. Text has been added in various places to describe the manycast sheme 
and how it works.

3. The SNTP protocol subset now has a separate section. The implementer 
wishing to build SNTP can avoid eye fatigue with the full NTP prose.

4. Again once through the entire text picked up some weeds and 
wastewater, both flushed. Some figure numberring errors were fixed in 
the ToC.

It's still in unformatted format; the long lines are correctly wrapped 
in IE, but for some reason double spaced. Note that there is a generous 
helping of tab characters which hopefully the formatter will respect. 
They certainly were not respected in the orignal draft.

Dave

---

From: mayer at ntp.isc.org (Danny Mayer)
Date: Sun, 11 Feb 2007 16:51:40 -0500

That's exactly what I wanted. Otherwise I would have opposed it going
forward with it obsoleting RFC 4330. I think I'll start reviewing your
edited version instead.

Danny

---

From: Helen.Y.Chen at motorola.com (Chen Helen-A12587)
Date: Mon, 12 Feb 2007 10:45:59 -0500

Danny, David,

The link I tried (draft-ietf-ntp-ntpv4-proto-04) didn't work. I would
like to know if SNTPv4 includes the sutokey algorithm, or if the autokey
can only be implemented in NTPv4.

Thanks,
Helen Chen

-----Original Message-----
From: ntpwg-bounces+helen.y.chen=motorola.com at lists.ntp.isc.org
[mailto:ntpwg-bounces+helen.y.chen=motorola.com at lists.ntp.isc.org] On
Behalf Of Danny Mayer
Sent: Sunday, February 11, 2007 3:52 PM
To: David L. Mills
Cc: ntpwg at ntp.isc.org
Subject: Re: [ntpwg] Updated draft

Danny

David L. Mills wrote:
> 
> 3. The SNTP protocol subset now has a separate section. The 
> implementer wishing to build SNTP can avoid eye fatigue with the full
NTP prose.
_______________________________________________
ntpwg mailing list
ntpwg at lists.ntp.isc.org
https://lists.ntp.isc.org/mailman/listinfo/ntpwg

---

From: mills at udel.edu (David L. Mills)
Date: Tue, 13 Feb 2007 00:26:15 +0000

Chen,

The document is now restored. The Windwoes name was in upper case; the 
Unix link in lower case. Sign.

There is no provision for Autokey in the standards document. In 
prinicple there could be, but it doesn't seem useful to add all that 
baggage and not make a NTP-conformant version. I'm happy to add that 
option to the SNTP text if this seems desirable.

Dave

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ntp.isc.org/pipermail/ntpwg/attachments/20070213/fc484fa4/attachment.html

---

From: mayer at ntp.isc.org (Danny Mayer)
Date: Mon, 12 Feb 2007 22:23:37 -0500

> can only be implemented in NTPv4.

While I'm sure you could add autokey to SNTP, by the time you had done
so and incorporated all of the necessary machinery it might as well be
NTP rather than SNTP. Unlike SNTP, the autokey needs to have the client
exchange a flurry of packets with the server to authenticate the server
initially before it is willing to accept the time from that server. Dave
calls this the autokey dance, I believe. I see no reason why it can't be
done but I know of no such implementation.

I assume you want to supply accurate time to cell phones, but want to
make sure that it comes from an authenticated source? You also have a
key distribution problem to solve.

Danny

---

From: Helen.Y.Chen at motorola.com (Chen Helen-A12587)
Date: Wed, 28 Feb 2007 18:22:26 -0500

Dave,

Thank you. I have a few questions related to the autokey protocol
document:

*	The autokey protocol assumes server is polled 1/minute. Would
the performance become unacceptable if the server is polled more often
than once per minute, e.g. in the order of 300 polls per minute?
*	From what I read off the NTP Project website, it seems that your
team has done performance analysis on NTPv4 and/or the autokey protocol.
Would it be possible to share the outcome of the analysis?
*	Autokey dance at beginning of protocol requires several
exchanges to establish various keys, cookies, identity scheme, etc. Are
ALL 5 exchanges (Parameter, Certificate, Identity, Values and Signature
Exchanges) mandatory for the autokey protocol to work?
*	From what I read, it seems that the autokey authentication is
performed for each request, correct?

Thanks,
Helen

-----Original Message-----
From: David L. Mills [mailto:mills at udel.edu]
Sent: Monday, February 12, 2007 6:26 PM
To: Chen Helen-A12587
Cc: mayer at ntp.isc.org; ntpwg at ntp.isc.org
Subject: Re: [ntpwg] Updated draft

Chen,

Dave

Chen Helen-A12587 wrote:

> like to know if SNTPv4 includes the sutokey algorithm, or if the
> autokey can only be implemented in NTPv4.
>
> Thanks,
> Helen Chen
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ntp.isc.org/pipermail/ntpwg/attachments/20070228/f1493660/attachment.html

---

From: mayer at ntp.isc.org (Danny Mayer)
Date: Wed, 28 Feb 2007 23:47:50 -0500

Chen Helen-A12587 wrote:
> Dave,
> 
> Thank you. I have a few questions related to the autokey protocol document:
> 
>     * The autokey protocol assumes server is polled 1/minute.

I doubt that you will find that to be true. Can you point to any
document that says that? The autokey protocol has no need to make that
assumption. When the client receives the first packet with the autokey,
it immediately sends back a packet to that server asking for further
information (described in the autokey protocol). The server responds
with that information and the client immediately asks additional
information of the server until it has satisfied itself that the server
is authenticated or not. This is known as the autokey dance. After that
it will accept the NTP packets from that specific server as long as the
authentication information is found in the packet and follows the
autokey requirements.

> Would the
>       performance become unacceptable if the server is polled more often

Why would you ever do that? Or are you asking if multiple clients make
requests and the server needs to handle 300 requests/minute? I stress
test servers and it sends much more than that from multiple places and
the load is barely visible and certainly not noticeable.

>     * Autokey dance at beginning of protocol requires several exchanges
>       to establish various keys, cookies, identity scheme, etc. Are ALL
>       5 exchanges (Parameter, Certificate, Identity, Values and
>       Signature Exchanges) mandatory for the autokey protocol to work?

Yes. It stops as soon as it has determined that the server is authentic
(or not).

>       performed for each request, correct?

Yes, in the sense that it checks and validates the authentication part o
the header each time that it receives the packet.

Danny