On Mon, Jan 21, 2019, 9:20 AM Achim Gratz via devel <devel@ntpsec.org wrote:
> Hal Murray via devel writes: > >> My thought about how to enable NTS for the pool would involve requiring > a SRV > >> record lookup for NTS-KE > > > > That SRV lookup could return multiple names. Each would point to a > separate > > NTS-KE server. > > > > An alternative approach would be to extend the NTS-KE protocol to > support > > multiple answers. > > No, the client needs to ask multiple times. Otherwise each association > for that TLS session would get the same S2C and C2S keys and that's a > no-no. > Not seeing a viable exploit ATM. One would need to get a server in the pool, a ridiculous amount of computer power and/or an exploit against AES and/or ChaCha as well as acesss to the packet stream of a given host which puts it out of the range of almost anyone except *no such agency*. >
_______________________________________________ devel mailing list devel@ntpsec.org http://lists.ntpsec.org/mailman/listinfo/devel
