Subject: [Ntp] Alvaro Retana's No Objection on draft-ietf-ntp-mac-05: (with COMMENT)

From: Alvaro Retana <[email-masked]>
Date: Mon, 19 Nov 2018 14:19:21 -0800

Alvaro Retana has entered the following ballot position for
draft-ietf-ntp-mac-05: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ntp-mac/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

>From §3:
   If authentication is implemented, then AES-CMAC as specified in RFC
   4493 [RFC4493] SHOULD be computed over all fields in the NTP header,
   and any extension fields that are present in the NTP packet as
   described in RFC 5905 [RFC5905].

When would AES-CMAC not be computer over all fields, or when would it not be
used?  IOW, why is a MUST not used?  The text already indicates that it is
talking about "if authentication is implemented..."