> I've also read a discussion with PHK somewhere that he didn't like OpenNTPD > because it had no auth (sorry, can't find the source again). I guess this >

> I've also read a discussion with PHK somewhere that he didn't like OpenNTPD > because it had no auth (sorry, can't find the source again). I guess this > complaint has been mitigated recently now that TLS auth is supported in > OpenNTPD [3]. That's a completely new invention. It is not compatible with the NTP auth as specified in NTPv4 which uses a public key mechanism to ensure the NTP packets are not being spoofed. Instead, this is just pointing your NTP server at an HTTPS server you trust so it can use the timestamps returned in the TLS packets as another highly trusted time source to make sure spoofed NTP packets can't skew your time. It's clever, that's for sure.