cloudflare / roughtime

A secure clock-synchronization protocol for when rough is enough.
https://developers.cloudflare.com/time-services/roughtime/
Apache License 2.0
135 stars 29 forks source link

Client is incompatible with existing servers (was "No reply from any roughtime server") #25

Closed katexochen closed 9 months ago

katexochen commented 3 years ago

I've tried to get started with roughtime, but I couldn't get a response from any of the listed ecosystem servers. I've also tried this from multiple machines/locations. Cloudflarestatus.com states that Cloudflare's Roughtime server is operational. Any idea why this isn't working?

$ go run ./getroughtime/main.go -ping roughtime.cloudflare.com:2002 -pubkey gD63hSj3ScS+wuOeGrubXlq35N1c5Lby/S+T7MNTjxo=
ping error: no reply
exit status 1
$ go run ./recipes/tls.go
skipped Chainpoint-Roughtime: no reply
skipped Cloudflare-Roughtime: no reply
skipped Google-Sandbox-Roughtime: no reply
skipped int08h-Roughtime: no reply
skipped ticktock: no reply
skipped time.0xt.ca: no reply
no valid responses
exit status 1
wbl commented 3 years ago

This code implements a new version of the protocol that most of the servers don't. We should document this better.

katexochen commented 3 years ago

Thanks for your answer, @wbl! That's quite a surprise, I would have at least expected the Cloudflare server to match the protocol version of this implementation. Will Cloudflare update it's service to the newer protocol version anytime soon? Or would you suggest to work with an older version of the protocol that is compatible with the Cloudflare server until Roughtime is an RFC?

MDr164 commented 2 years ago

So is there any roughtime server right now that can actually respond to the current state of the code? Or would we need to downgrade to a certain commit to get back to a working state and if so which one would that be?

katexochen commented 2 years ago

@MDr164 As far as I know, there is no public Roughtime server that is capable of communicating with the current state of the code. The only thing you can do is run your own Roughtime sever with the server code of this repo.

cjpatton commented 2 years ago

HI @katexochen, @MDr164, allow me to apologize on behalf of my team (Cloudflare Research) for our lack of attention to this thread. The latest IETF draft should be implemented and deployed wherever possible. We would like to upgrade our own server, but we have a small number of users using the pre-IETF protocol. At this point we're deciding whether to upgrade this endpoint (causing breaking changes to those users) or to spin up a new endpoint for the IETF protocol.

katexochen commented 2 years ago

Thanks @cjpatton for reaching out! The IETF draft seems to be no longer active.

MDr164 commented 2 years ago

That's good to hear! Right now we're running a recent enough roughtime server internally to test the functionality but decided to use a NTS fallback to allow us to not rely on our internal roughtime server.

cjpatton commented 2 years ago

Thanks @cjpatton for reaching out! The IETF draft seems to be no longer active.

Even if inactive, the draft may not be dead. Are you on the NTP mailing list? https://www.ietf.org/mailman/listinfo/ntp

iFrozenPhoenix commented 2 years ago

HI @katexochen, @MDr164, allow me to apologize on behalf of my team (Cloudflare Research) for our lack of attention to this thread. The latest IETF draft should be implemented and deployed wherever possible. We would like to upgrade our own server, but we have a small number of users using the pre-IETF protocol. At this point we're deciding whether to upgrade this endpoint (causing breaking changes to those users) or to spin up a new endpoint for the IETF protocol.

@cjpatton is there now a endpoint that is working with the current implementation in this repo?

iFrozenPhoenix commented 2 years ago

fyi. According to the current draft at https://datatracker.ietf.org/doc/draft-ietf-ntp-roughtime/ section 9 there is 1 server that seems to work with this client

address: roughtime.se port: 2002 long-term key: S3AzfZJ5CjSdkJ21ZJGbxqdYP/SoE8fXKY0+aicsehI=

cdris commented 2 years ago

Jumping on to this thread as it seems related to the question I was just going to file. I have a potential use case for roughtime and am trying to better understand the current state of existing roughtime repositories. Which draft version is this repository up to date with? Is it safe to assume it matches either version 3 or 4 based on the timing of the last commit?

Thanks!

marek22k commented 11 months ago

According to the current draft at https://datatracker.ietf.org/doc/draft-ietf-ntp-roughtime/ section 9 there is 1 server that seems to work with this client

The server does not seem to work anymore:

$ go run ./getroughtime/main.go -ping roughtime.se:2002 -pubkey "S3AzfZJ5CjSdkJ21ZJGbxqdYP/SoE8fXKY0+aicsehI="
ping error: protocol: incompatible versions
exit status 1
cjpatton commented 11 months ago

Hi all, I apologize but we don't yet have a timeline for updating our roughtime server to match the draft.

cjpatton commented 9 months ago

HI all, as you all know, this code is targeting a draft of IETF-Roughtime that has expired. The latest draft is draft-ietf-ntp-roughtime-08. Support for this draft is added by #33.

This PR also adds back support for Google-Roughtime, which means getroughtime talks to any server that still supports the legacy version:

[cjpatton/versioning][~/github.com/cloudflare/roughtime]$ go run ./cmd/getroughtime/... -config ecosystem.json
skipped Chainpoint-Roughtime: no reply
Cloudflare-Roughtime: 2023-12-13 15:54:40.964 -0800 PST ±1s (in 34ms)
skipped Google-Sandbox-Roughtime: no reply
int08h-Roughtime: 2023-12-13 15:54:44.031569 -0800 PST ±1s (in 87ms)
skipped ticktock: no reply
time.0xt.ca: 2023-12-13 15:54:47.137827 -0800 PST ±1s (in 108ms)
delta: 224ms

Some servers are down, but Cloudflare-Roughtime is still ticking. We will soon be adding support for the latest IETF draft, but will stay backwards compatible with the legacy version for some time.