On Wed, 11 Sep 2013, Joe Abley wrote:
1. We only need to know the current time to an accuracy of 1 hour.
[RRSIG expiration times are specified with a granularity of a second, right?
I appreciate that most people are generous with signature inception and expiration times
in order to facilitate clock skew on validators, but I think "1 hour" needs
some qualification.]
The 1h came from the shortest RRSIG validity time in the chain to get to
pool.ntp.org, but performing a handful of queries now, I cannot find
that magical RRSIG with the 1h validity period.
Note: I also once ran into bad clocks due to dual boot systems with
Windows and Daylight Savings Time, so I explicitely set inception time
to -2h. One hour is not enough on doubly broken systems.
Paul
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
