NTP

Summary

The NTP Working Group met at IETF 126. The session included status updates on active working group drafts, reports on experimental implementations for Network Time Security (NTS) server pools, a summary of recent Hackathon activities, an update on IEEE 1588 coordination, and the coordination of a response to a liaison request from ITU-T Study Group 17.

The WG welcomed Tommy Pauly as the new Area Director (AD), succeeding Eric Vyncke.

Key Discussion Points

WG Administration & Document Status

Karen O'Donoghue presented the NTP WG Chair slides.

NTP over PTP: The document is currently in its second edit with the RFC Editor (after ~35 weeks in the queue). It is expected to enter the final review (formerly Auth48) soon.
Roughtime: The document has been in the RFC Editor queue for ~17.5 weeks and is awaiting its first editor assignment.

NTPv5 (draft-ietf-ntp-ntpv5)

Status: Open issues are being actively addressed. The working group aims to initiate a Working Group Last Call (WGLC) before the end of the year.
Interim Work: A small group meeting is planned for August 2024 to resolve outstanding issues.
Upgrade Concerns: During the Hackathon, Sarah Dickinson noted a version mismatch issue during NTPv5 upgrades. Clients sending NTPv4 requests with an indication of NTPv5 support were sometimes ignored by servers, causing communication to continue in NTPv4. There is a need to improve the description of this upgrade process in the document.

NTS Server Pools

NTS Pool Experiment (draft-ietf-ntp-nts-keyexchange-pool)

David Venema provided an update on the ongoing NTS pool experiment running on sectime.org.

The experiment has been updated to use early allocations.
The pool currently contains about 20 servers.
The latest draft update of draft-ietf-ntp-nts-keyexchange-pool adds these early identifiers and includes a new section describing the session flow.
Feedback on the draft is requested, with the goal of progressing the document soon.

DNS SRV-based Pools

Marcus Dansarie presented NTS Server Pools using DNS SRV records.

Traditional A/AAAA records require sharing a single TLS certificate across all pool servers, creating a high security risk if one server is compromised.
Proposal: Use DNS SRV records so each pool server can maintain its own certificate.
Security & Implementation Trade-offs:
- DNSSEC is required to cryptographically sign responses and verify pool membership.
- DNSSEC does not protect against replay attacks. Mitigation strategies (such as low TTLs and larger server response sets) conflict with the performance and caching benefits of a DNS-based pool.
- Local stub resolvers in major operating systems often strip DNSSEC records or do not perform DNSSEC validation, shifting the validation burden to the client.
- Client implementation complexity increases significantly due to DNSSEC requirements, and root key rollovers pose a risk for non-updatable clients.
Status: This experiment is running at srv.sectime.org with experimental support available in patched ntpsec and ntp-rs (v1.8.1+). The experiment will run for at least a year to gather data, but the presenters expressed reservations about recommending this as a standard due to DNSSEC verification issues.

NTS for PTP (draft-ietf-ntp-nts-for-ptp) & IEEE 1588 Coordination

Karen O'Donoghue presented the IEEE 1588 Update.

Much of the development for draft-ietf-ntp-nts-for-ptp depends on work currently taking place in the IEEE 1588 security subcommittee.
PTP Security: Work focuses on addressing vulnerabilities, establishing NTS as a key management mechanism, and adding security datasets. This is expected to finalize in the next 6 to 10 months, after which draft-ietf-ntp-nts-for-ptp will be updated (likely in the fall).
Client-Server PTP (CSPTP): A relatively new IEEE 1588 effort. Security for CSPTP behaves similarly to NTP, allowing NTS to map to it more directly. David Venema has developed an initial proposal for NTS for CSPTP.

Hackathon Report

David Venema presented the Hackathon report.

NTS Pools: Resolved IPv4 handling bugs, added new servers, and successfully demoed the project.
NTPv5: Sarah Dickinson developed an interoperability test harness. Tests revealed upgrade bugs between Chrony and ntp-rs. Work is ongoing to expand the harness and incorporate NTS for NTPv5.
Roughtime: Performed interoperability testing for TCP and UDP. Support for TCP remains low across implementations, and forcing fallback to TCP is difficult. Version mismatches of draft standards remain a barrier. Sarah Dickinson suggested waiting for the RFC publication and version bump before attempting further TCP interoperability work.

ITU-T Liaison Request

The WG received a liaison request from ITU-T Study Group 17 regarding upcoming 2036–2038 epoch rollovers.
The documents have been shared on the NTP mailing list.

Decisions and Action Items

NTPv5 WGLC: The working group plans to resolve open issues on draft-ietf-ntp-ntpv5 to enable a Working Group Last Call before the end of 2024.
ITU-T Liaison Response: Karen O'Donoghue will meet with IAB liaison coordinators to outline and prepare a response to ITU-T SG17. The response draft will be discussed on the mailing list.

Next Steps

August 2024: Small group meeting to address draft-ietf-ntp-ntpv5 open issues.
September 15, 2024: Proposed date for a virtual interim meeting, focusing on NTPv5 draft resolution.
Fall 2024: Expected updates to draft-ietf-ntp-nts-for-ptp following progress in the IEEE 1588 security subcommittee.

Automatic IETF Minutes

NTP