// NTS commands - included twice

The following command controls NTS authentication. It overrides
normal TLS protocol negotiation, which is not usually necessary.

[[nts]]
+nts+ [enable|disable] [+mintls+ _version_] [+maxtls+ _version_] [+tlsciphersuites+ _name_] [+port+ _portnum_] [+tlsecdhcurves+ _name_] [tlscipherserverpreference]

The options are as follows:

+cert+ _file_::
  Present the certificate (chain) in _file_ as our certificate.
  +
  Note that there is no checking on the certificate.
  In particular, it may have expired or may not cover the host name
  used to get to this server or may not be signed by a CA that
  is in the clients root-server collection.

+key+ _file_::
  Read the private key to our certificate from _file_.

+ca+ _location_::
  Use the file, or directory, specified by _location_ to
  validate NTS-KE server certificates instead of the system
  default root certificates.  If a directory is specified, it
  must have files named with their hash, as created by
  +openssl rehash+.

+cookie+ _location_::
  Use the file (or directory) specified by _location_ to
  store the keys used to make and decode cookies.  The default
  is _/var/lib/ntp/nts-keys_.

+enable+::
  Enable NTS-KE server.
  When enabled, +cert+ and +key+ are required.

+disable+::
  Disable NTS-KE server.

+mintls+ _string_::
  Set the lowest allowable TLS version to negotiate. Will be useful in
  the wake of a TLS compromise.  Reasonable values are
  _TLS1.3_ if your system supports it.  TLS 1.3 was first supported in
  OpenSSL version 1.1.1.

+maxtls+ _string_::
  Set the highest allowable TLS version to negotiate. By setting
  +mintls+ and +maxtls+ equal, you can force the TLS version for
  testing. Format is as for +mintls+.

+port+ _portnum_:: (same as +extra port+ _portnum_)
  This opens another port.  NTS-KE will tell clients to use this port.
  This might help bypass ISP blocking on port 123.  Be sure that
  your firewall doesn't block traffic arriving on this new port.
  It will also be used as the return port when sending requests.
  Again, that bypasses blocking on port 123.

// https://crypto.stackexchange.com/questions/8964/sending-tls-messages-with-out-encryption-using-openssl-code

+tlsciphersuites+ _string_::
   An OpenSSL ciphersuite list to configure the allowed ciphersuites for
   TLS 1.3.  A single NULL cipher disables encryption and use of certificates.
   This sets the ciphers used by both the client and server sides.
   +
   The server picks the cipher.  The default is client preference.
   Specifying ciphersuites also switches to server preference.

+tlsecdhcurves+ _string_::
   An OpenSSL ecdhcurves list to configure the allowed ecdhcurves for
   TLS 1.3.  A single NULL ecdhcurves disables encryption and use of certificates.

+tlscipherserverpreference+::
   During TLS connection setup, the client and server have to pick a
   ciphersuite to use.  The client gives the server a list of the ones
   it supports.  The server compares that with its list.  The server
   picks one that is on both lists.  Normally, it picks the first one
   on the client's list that it supports.  This option changes that
   to picking the first one on the servers list that the client supports.
   [FIXME: Need good URL for best practices]

+aead+ _string_::
   Specify the crypto algorithm to be used on the wire.  The choices
   come from RFC 5297.  The only options supported are AES_SIV_CMAC_256,
   AES_SIV_CMAC_384, and AES_SIV_CMAC_512.  This slot is dual use.
   It is the server default if the remote client doesn't request a
   valid choice and it is also the preference passed to the
   remote client if the server command doesn't specify a preference.
   The default is AES_SIV_CMAC_256.

The following options of the +server+ command configure NTS (as a client).

+nts+::
  Use Network Time Security (NTS) for authentication.  Normally,
  this is all you have to do to activate the client side of NTS.
  +
  The hostname following the +server+ command is used as the address
  of the NTS key exchange server (NTS-KE) rather than the address
  of a NTP server.  The NTS-KE exchange defaults to using the same
  IP address for the NTP server.
  +
  Note that the +server+ hostname must match the name on the NTS-KE
  server's certificate.

+noval+::
  Do not validate the server certificate.

+ca+ _location_::
  Use the file, or directory, specified by _location_ to validate the
  NTS-KE server certificate, overriding the site default.  Do not use
  any other CA.  If a directory is specified, it must have files named
  with their hash, as created by +openssl rehash+.

+aead+ _string_::
  Specify the preferred crypto algorithm to be used on the wire.
  The only options supported are AES_SIV_CMAC_256, AES_SIV_CMAC_384, and
  AES_SIV_CMAC_512.  The server may ignore the request.  See the +aead+
  option above.
  +
  The same +aead+ algorithms are also used to encrypt cookies.
  The default is AES_SIV_CMAC_256.  There is no config file option to
  change it, but you can change it by editing the saved cookie key
  file, probably _/var/lib/ntp/nts-keys_.  Adjust the _L:_ slot to be
  48 or 64 and adjust the _I:_ slots to have the right number of bytes.
  Then restart the server.  (All old cookies held by clients will be
  rejected so their next 8 NTP requests will be ignored.  They should
  recover by retrying NTS-KE to get fresh cookies.)



// end
