Key Storage Path Configuration and Errors

[xylim98]

Objective:
I'm trying to configure persistent storage for NTS cookies encryption in NTPD-RS and also to allow key rotation. I'm unsure about the correct format for the key-storage-path option in the [keyset] section of the ntp.toml configuration file.

Problem:
I've tried both an empty directory and a file as the key-storage-path, but neither seems to work. No keys are populated in the specified location.

Here are the errors I encounter:

• When using a directory path (e.g., /var/lib/ntpd-rs):
  WARN ntpd::daemon::nts_key_provider: Could not load nts server keys, starting with new set error=Os { code: 21, kind: IsADirectory, message: "Is a directory" }

• When using a file path (e.g., /etc/ntpd-rs/ca-data/keys):
  WARN ntpd::daemon::nts_key_ Grüße ntpd::daemon::nts_key_provider: Could not load nts server keys, starting with new set error=Error { kind: UnexpectedEof, message: "failed to fill whole buffer" }

Question:
What is the expected format for the key-storage-path file used for NTS cookie storage? Is there an existing example I can reference?

What I've Tried:
I've already referred to the following resources:

• ntp.toml.5 documentation: https://docs.ntpd-rs.pendulum-project.org/man/ntp.toml.5/
• Configuring Key Storage: https://github.com/pendulum-project/ntpd-rs

[rnijveld]

I'm not quite sure if you are running a server or a client? ntpd-rs doesn't support storing the cookies received from servers as a client, it will only keep those in memory. It will only store the key material used when running as a server to allow any previously handed out cookies to still work with the server even after a key rotation took place. But I take it you are doing just that? The key-storage-path should be the name of a file, not a directory. But make sure any parent directories already exist, as it will not create those for you. If configured that way and no keys file exists on boot, it should work.

The error it gave in your case makes me think you have some existing file at that location? Did you previously create a file, or was that an error you got after you gave it a second try (in which case the file might have been partially written)?

[xylim98]

Ah thanks so much @rnijveld ! It's my bad on some silly misconfigurations. I can see the key materials now!