Encrypted DNS + NTP = Deadlock

Photo by Uzoma Ozurumba, CC BY-SA 4.0, no changesI’m generally a big fan of encrypted DNS for the security it provides with negligible performance impact. But I recently found out the hard way that DNS over TLS/HTTPS can deadlock with Network Time Protocol (NTP) on embedded devices without a battery-backed real-time clock. Many low-cost routers lack a battery for keeping time during power loss. Af

[tmatsuu]

DNS over TLSやDNS over HTTPSではTLSを使うため時刻が正確である必要があるが、時刻同期のためのNTPのアクセス先が pool.ntp.org など名前解決が必要だとデッドロックになる。ohそうだね。

[t_motooka]

せやな。ルータ等の機器側で、証明書署名検証の日付検査を緩めたり、通常のDNSにfallbackしたりしてくれてたら…とも思うけども難しそう。

[ryuichi1208]

たしかに、、