<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
<meta name="generator" content="HTML Tidy, see www.w3.org">
<title>Authentication Support</title>
<!-- Changed by: Harlan Stenn, 24-Jul-2018 -->
<link href="scripts/style.css" type="text/css" rel="stylesheet">
<style type="text/css">
<!--
<style1 {
color: #FF0000;
font-weight: bold;
}
.style1 {color: #FF0000}
-->
</style>
</head>
<body>
<h3>Authentication Support</h3>
<img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a>
<p>Our resident cryptographer; now you see him, now you don't.</p>
<p>Last update:
<!-- #BeginDate format:En2m -->24-Jul-2018 09:12<!-- #EndDate -->
UTC</p>
<br clear="left">
<h4>Related Links</h4>
<script type="text/javascript" language="javascript" src="scripts/hand.txt"></script>
<script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script>
<h4>Table of Contents</h4>
<ul>
<li class="inline"><a href="#auth">Introduction</a></li>
<li class="inline"><a href="#symm">Symmetric Key Cryptography</a></li>
<li class="inline"><a href="#windows">Microsoft Windows Authentication</a></li>
<li class="inline"><a href="#pub">Public Key Cryptography</a></li>
</ul>
<hr>
<h4 id="auth">Introduction</h4>
<p>This page describes the various cryptographic authentication
provisions in NTPv4. Authentication support allows the NTP client to
verify that servers are in fact known and trusted and not intruders
intending accidentally or intentionally to masquerade as a legitimate
server. A detailed discussion of the NTP multi-layer security model
and vulnerability analysis is in the white
paper <a href="http://www.eecis.udel.edu/~mills/security.html">NTP
Security Analysis</a>.</p>
<p>The NTPv3 specification (RFC-1305) defined an authentication scheme
properly described as <em>symmetric key cryptography</em>. It used
the Data Encryption Standard (DES) algorithm operating in cipher-block
chaining (CBC) mode. Subsequently, this algorithm was replaced by the
RSA Message Digest 5 (MD5) algorithm commonly called keyed-MD5.
Either algorithm computes a message digest or one-way hash which can
be used to verify the client has the same message digest as the
server. The MD5 message digest algorithm is included in the
distribution, so without further cryptographic support, the
distribution can be freely exported.</p>
<p>If the OpenSSL cryptographic library is installed prior to building
the distribution, all message digest algorithms included in the
library may be used, including SHA and SHA1. However, if conformance
to FIPS 140-2 is required, only a limited subset of these algorithms
can be used. This library is available
from <a href="http://www.openssl.org">http://www.openssl.org</a> and
can be installed using the procedures outlined in
the <a href="build.html">Building and Installing the Distribution</a>
page. Once installed, the configure and build process automatically
detects the library and links the library routines required.</p>
<p>In addition to the symmetric key algorithms, this distribution
includes support for the Autokey public key algorithms and protocol
specified in RFC-5906 "Network Time Protocol Version 4: Autokey
Specification". This support is available only if the OpenSSL
library has been installed and the <tt>--enable-autokey</tt> option is
used when the distribution is built.</p>
<p> Public key cryptography is generally considered more secure than
symmetric key cryptography, since the security is based on private and
public values which are generated by each participant and where the
private value is never revealed. Autokey uses X.509 public
certificates, which can be produced by commercial services, the
OpenSSL application program, or
the <a href="keygen.html"><tt>ntp-keygen</tt></a> utility program in
the NTP software distribution.</p>
<p>Note that according to US law, NTP binaries including OpenSSL library
components, including the OpenSSL library itself, cannot be exported
outside the US without license from the US Department of Commerce.
Builders outside the US are advised to obtain the OpenSSL library
directly from OpenSSL, which is outside the US, and build outside the
US.</p>
<p>Authentication is configured separately for each association using
the <tt>key</tt> or <tt>autokey</tt> option of the <tt>server</tt>
configuration command, as described in
the <a href="confopt.html">Server Options</a> page.
The <a href="keygen.html">ntp-keygen</a> page describes the files
required for the various authentication schemes. Further details are
in the briefings, papers and reports at the NTP project page linked
from <a href="http://www.ntp.org">www.ntp.org</a>.</p>
<p>By default, the client sends non-authenticated packets and the server
responds with non-authenticated packets. If the client sends
authenticated packets, the server responds with authenticated packets
if correct, or a crypto-NAK packet if not. In the case of unsolicited
packets which might consume significant resources, such as broadcast
or symmetric mode packets, authentication is required, unless
overridden by a <tt>disable auth</tt> command. In the current climate
of targeted broadcast or "letterbomb" attacks, defeating
this requirement would be decidedly dangerous. In any case,
the <tt>notrust </tt>flag, described on
the <a href="authopt.html">Access Control Options</a> page, can be
used to disable access to all but correctly authenticated clients.</p>
<h4 id="symm">Symmetric Key Cryptography</h4>
<p>The original NTPv3 specification (RFC-1305), as well as the current
NTPv4 specification (RFC-5905), allows any one of possibly 65,535
message digest keys (excluding zero), each distinguished by a 32-bit
key ID, to authenticate an association. The servers and clients
involved must agree on the key ID, key type and key to authenticate
NTP packets.</p>
<p>The message digest is a cryptographic hash computed by an algorithm
such as MD5, SHA, or AES-128 CMAC. When authentication is specified,
a message authentication code (MAC) is appended to the NTP packet
header. The MAC consists of a 32-bit key identifier (key ID) followed
by a 128- or 160-bit message digest. The algorithm computes the
digest as the hash of a 128- or 160- bit message digest key
concatenated with the NTP packet header fields with the exception of
the MAC. On transmit, the message digest is computed and inserted in
the MAC. On receive, the message digest is computed and compared with
the MAC. The packet is accepted only if the two MACs are identical.
If a discrepancy is found by the client, the client ignores the
packet, but raises an alarm. If this happens at the server, the
server returns a special message called a <em>crypto-NAK</em>. Since
the crypto-NAK is protected by the loopback test, an intruder cannot
disrupt the protocol by sending a bogus crypto-NAK.</p>
<p>Keys and related information are specified in a keys file, which must
be distributed and stored using secure means beyond the scope of the
NTP protocol itself. Besides the keys used for ordinary NTP
associations, additional keys can be used as passwords for
the <tt><a href="ntpq.html">ntpq</a></tt>
and <tt><a href="ntpdc.html">ntpdc</a></tt> utility programs.
Ordinarily, the <tt>ntp.keys</tt> file is generated by
the <tt><a href="keygen.html">ntp-keygen</a></tt> program, but it can
be constructed and edited using an ordinary text editor.</p>
<p> Each line of the keys file consists of three or four fields: a key
ID in the range 1 to 65,535, inclusive, a key type, a message digest
key consisting of a printable ASCII string less than 40 characters or
a 40-character hex digit string, and an optional comma-separated list
of IPs that are allowed to serve time. If the OpenSSL library is
installed, the key type can be any message digest algorithm supported
by the library. If the OpenSSL library is not installed, the only
permitted key type is MD5.</p>
<table>
<caption style="caption-side: bottom;">
Figure 1. Typical Symmetric Key File
</caption>
<tr><td style="border: 1px solid black; border-spacing: 0;">
<pre style="color:grey;">
# ntpkey_MD5key_bk.ntp.org.3595864945
# Thu Dec 12 19:22:25 2013
1 MD5 L";Nw<`.I<f4U0)247"i # MD5 key
2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key
3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key
4 MD5 Yue:tL[+vR)M`n~bY,'? # MD5 key
5 MD5 B;fxlKgr/&4ZTbL6=RxA # MD5 key
6 MD5 4eYwa`o}3i@@V@..R9!l # MD5 key
7 MD5 `A.([h+;wTQ|xfi%Sn_! # MD5 key
8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key
9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key
10 MD5 2late4Me # MD5 key
11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key
12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key
13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key
14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key
15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key
16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key
17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key
18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key
19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key
20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key
21 MD5 sampo 10.1.2.3/24
</pre></td></tr></table>
<p>Figure 1 shows a typical symmetric keys file used by the reference
implementation when the OpenSSL library is installed. Each line of
the file contains three or four fields. The first field is an integer
between 1 and 65535, inclusive, representing the key identifier. The
second field is the digest algorithm, which in the absence of the
OpenSSL library must be <tt>MD5</tt>, which designates the MD5 message
digest algorithm. The third field is the key. The optional fourth
field is one or more comma-separated IPs. An IP may end with an
optional <tt>/subnetbits</tt> suffix, which limits the acceptance of
the key identifier to packets claiming to be from the described IP
space. In this example, for the key IDs in the range 1-10 the key is
interpreted as a printable ASCII string. For the key IDs in the range
11-20, the key is a 40-character hex digit string. In either case,
the key is truncated or zero-filled internally to either 128 or 160
bits, depending on the key type. The line can be edited later or new
lines can be added to change any field. The key can be changed to a
password, such as <tt>2late4Me</tt> for key ID 10. Note that two or
more keys files can be combined in any order as long as the key IDs
are distinct.</p>
<p>When <tt>ntpd</tt> is started, it reads the keys file specified by
the <tt>keys</tt> command and installs the keys in the key cache.
However, individual keys must be activated with
the <tt>trustedkey</tt> configuration command before use. This
allows, for instance, the installation of possibly several batches of
keys and then activating a key remotely using <tt>ntpq</tt>
or <tt>ntpdc</tt>. The <tt>requestkey</tt> command selects the key ID
used as the password for the <tt>ntpdc</tt> utility, while
the <tt>controlkey</tt> command selects the key ID used as the
password for the <tt>ntpq</tt> utility.</p>
<h4 id="windows">Microsoft Windows Authentication</h4>
<p>In addition to the above means, <tt>ntpd</tt> now supports Microsoft
Windows MS-SNTP authentication using Active Directory services. This
support was contributed by the Samba Team and is still in development.
It is enabled using the <tt>mssntp</tt> flag of the <tt>restrict</tt>
command described on the <a href="accopt.html#restrict">Access Control
Options</a> page. <span class="style1">Note: Potential users should
be aware that these services involve a TCP connection to another
process that could potentially block, denying services to other users.
Therefore, this flag should be used only for a dedicated server with
no clients other than MS-SNTP.</span></p>
<h4 id="pub">Public Key Cryptography</h4>
<p>See the <a href="autokey.html">Autokey Public-Key Authentication</a>
page.</p>
<hr>
<script type="text/javascript" language="javascript" src="scripts/footer.txt"></script>
</body>
</html>