Subject: [Ntp] Comments after implementing draft-ietf-ntp-roughtime-05

From: Stuart Stock <[email-masked]>
Date: Sun, 27 Mar 2022 22:37:33 +0000

Hi there. I've recently implemented the draft-05 protocol in Roughtime (https://github.com/int08h/roughenough) with two caveats. I updated the server `roughtime.int08h.com:2002` to run the draft protocol, subject to the caveats below:

1. Currently the server and client send/expect protocol version 1 (VER tag is 0x00000001) instead of the draft's suggested `0x80000000 + version`. There's no deep reason here other than to simplify the implementation. Time permitting I'll implement the draft version functionality.

2. Draft-5 uses a bespoke 32-byte SHA-512 prefix (in section 6.3 "Merkle Tree" of draft-05). There's no rationale or justification in draft-05 to explain the choice of a custom hashing primitive. In the same section (draft-05 section 6.3) the standard referenced by draft-05 [SHS] defines SHA-512/256 which provides the necessary 32-byte output and has the advantage of being a) standardized (therefore less "surprising" to implementors), b) is widely implemented in cryptographic libraries (less chance to make a mistake), and c) makes implementation trivial (many cryptographic libraries provide a common interface for the SHA2 family of hash functions).

I used SHA-512/256 in Roughenough to compute the Merkle tree. It was a simple drop-in change. Implementing the custom SHA-512 prefix would be more complicated. And honestly, it's an odd choice given that standardized SHA-512/256 exists. I advocate changing future drafts to use SHA-512/256 instead.

[SHS]      National Institute of Standards and Technology, "Secure Hash Standard", DOI 10.6028/NIST.FIPS.180-4, FIPS 180-4, August 2015, <https://doi.org/10.6028/NIST.FIPS.180-4>.