Subject: [Ntp] TLS for NTS for NTP

From: Hal Murray <[email-masked]>
Date: Fri, 01 Sep 2017 03:12:55 -0700

I'm trying to understand the big picture.

The typical protocol flow for client/server says the client uses TCP to do a 
TLS handshake.  (It's about 1/3 of the way down on page 5 of draft 09.)

How complicated is that?  Remember that we have to do this without knowing 
the time.

I assume most implementations will be using some TLS package.  Can somebody 
give me a quick lesson in TLS?  Is there a solid package that runs on most 
OSes?  Is the API clean?  Can it handle the time-not-known case?  What else 
should I ask? ...

That paragraph says "only one round trip".  Is that after the TLS setup, or 
can it be piggybacked on TLS so that TLS+NTS is only one round trip?

TLS needs certificates.  Do we want to piggyback on the root certificates 
distributed with most OSes, or do we want the admin setting things up to 
provide certificates for the servers they select?

How much would already having the right certificates simplify the TLS code?

Is this going to work OK on IoT devices?

How about spares that have been sitting on the shelf for a long time?

-- 
These are my opinions.  I hate spam.

_______________________________________________
ntp mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ntp