Subject: [Ntp] Ben Campbell's No Objection on draft-ietf-ntp-bcp-10: (with COMMENT)

From: Ben Campbell <[email-masked]>
Date: Wed, 19 Dec 2018 15:39:12 -0800

Ben Campbell has entered the following ballot position for
draft-ietf-ntp-bcp-10: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ntp-bcp/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Hi, thanks for this work. I'm balloting "no objection", but have a few
comments/questions:

*** Substantive Comments ***

General observation: I was surprised to find that that a lot of the
recommendations here don't seem especially specific to NTP. (E.g. keeping
implementations up to date.) But I don't suppose that's really an problem, so I
don't expect action here.

§2.1, last paragraph: "It is RECOMMENDED that
large corporate networks (and ISP’s of any size) implement ingress
and egress filtering."

Is that a new normative requirement, or an existing requirement from BCP38? If
the latter, please consider using description language rather than normative
keywords.

§3.3: This section recommends that operators choose time servers with different
implementations/technology. Are time sources expected to publicize that sort of
information?

§3.4: Am I correct to assume that "control messages" and "mode 6 messages" are
the same thing? Please use consistent terminology.

§3.6:
- First Paragraph: "Users who want to
synchronize their computers SHOULD only synchronize to servers that
they have permission to use."
Why not MUST?

- 2nd paragraph: Is the NTP Pool stabile enough for a plug like this in an RFC?
Remember, RFCs live "forever". (see also §6.2.1)

§3.7: "Note well that NTPv4’s longest polling
interval exceeds one day and thus a leap second announcement may be
missed."
Is that okay? Is there any action recommended due to this?

§3.7.1, last paragraph: How does a client know if the server does leap second
smearing?

§4.1:
- "Therefore, for each association, keys SHOULD be exchanged securely by
external means, and they SHOULD be protected from disclosure." Why not MUST
(both times)?

- "Implementations will soon be available based on AES-128-CMAC
[I-D.ietf-ntp-mac], and users are encouraged to use that when it is available."
Is that worth a normative requirement?

- "Some implementations store the key in clear text"
Wouldn't the better practice to be not to do that?

§5.1:
- 3rd paragrap: "A host that is not supposed to act as an NTP server that
provides timing information to other hosts MAY additionally log and drop
incoming mode 3 timing queries from unexpected sources."

 i don't understand the point. Also, is the upper-case "MAY''intended as
 permission to do that?

- last paragraph: "Note well that proper monitoring of an NTP server instance
includes checking the time of that NTP server instance." Should there be
normative guidance here? (Also, the sentence seems out of place.)

§6.1: "Vendors of embedded devices MUST pay attention"
Can you recommend something more concrete (and verifiable) than "pay attention"?

*** Editorial Comments ***

§2.1: "more susceptible to spoofing attacks then other connection-oriented
protocols": s/then/than Also, it seems like "other" is not descriptive here,
since UDP is not a connection-oriented protocol.

§3.4:
-  first paragraph: The last sentence will not hold up well to the passage of
time. Please consider adding something to the effect of "At the time of this
writing..." - Last paragraph: The last sentence seems redundant to the section
on BCP38.

§5.1, 3rd paragraph: It is recommended that operators SHOULD filter mode 3
queries at the edge "recommended that...SHOULD" is redundant. Please consider
just saying "Operators SHOULD..."

§5.4: Is a KoD packet and a RATE packet the same thing? (Please use consistent
terminology)

§11.2: Is there a reason [BCP38INFO] is here and not in the URL references?