kb:time_sync:ntp:ntp_work_in_progress

NTP Work in Progress

NTS

The IETF NTPWG working group works on Network time Security protocol extension (NTS), a replacement for NTP's autokey, which is less secure than originally expected, and a compatible, extensible format of the extension field for NTP network packets. See this article:

ntimed-client

ntimed-client is a NTP client daemon written by Poul-Henning Kamp which implements some cool new features, including a modified approach to evaluate NTP time stamps, and leap seconds and TAI offset via DNS. Progress of the project as well as other ideas have been described at Poul-Hennings blog at

The source code is available via a git repository:

A Modified Approach to Evaluate NTP Time Stamps

This page illustrates the results of NTP queries to different servers on the local LAN, and on the internet:

And here's a different approach how to evaluate the time stamps from NTP packet exchanges:

A Proposal how to Get Authenticated Time from HTTPS Servers

Poul-Henning Kamp proposed a way to get authenticated time from HTTPS servers. This approach doesn't provide the full accuracy of NTP, but may be a good plausibility check for the time returned via NTP protocol in the absence of other authentication mechanisms.

Leap Seconds and TAI Offset via DNS

Poul-Henning Kamp's Proposal

Poul-Henning Kamp proposed to use DNS to distribute leap second announcements and the current TAI offset. This is much easier than distributing a leap second file and standard runtime library calls can be used to implement this. The idea is to to let a function like getaddrinfo() resolve a specific hostname, but don't interpret the returned number as IPv4 address. Instead decode it in a specific way to extract leap second information and TAI offset from the returned bit pattern.


Tony Finch's Example DNS Server

Tony Finch runs a DNS server installation where you can get a cryptographically signed leap second table in various formats using a DNS lookup of leapsecond.dotat.at (ask for HINFO records to get a terse summary of the formats).

For example: 

host -t HINFO leapsecond.dotat.at
;; Truncated, retrying in TCP mode.
leapsecond.dotat.at host information "A" "The months that end with a leap second encoded per http://phk.freebsd.dk/time/20151122/ plus an illegal record to terminate the list"
leapsecond.dotat.at host information "TXT" "The intervals between leap seconds in months, separated by a + or - for positive or negative leap seconds, and terminated by a ?"
leapsecond.dotat.at host information "AAAA" "The date and time of the last second in months that end with a leap second, plus the last second of the known validity period if that is not a leap second"
leapsecond.dotat.at host information "TYPE65432" "Compressed binary encoding of the TXT record"

Here is a blog post that describes the text format:

and another post that describes the binary format, which is more compact:

Information was published by Tony Finch on the IETF NTP mailing list:

— Martin Burnicki martin.burnicki@meinberg.de 2020-02-18

  • kb/time_sync/ntp/ntp_work_in_progress.txt
  • Last modified: 2021-07-23 13:33
  • by 127.0.0.1