12b15cb3dSCy Schubert<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 22b15cb3dSCy Schubert<html> 32b15cb3dSCy Schubert <head> 42b15cb3dSCy Schubert <meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> 52b15cb3dSCy Schubert <meta name="generator" content="HTML Tidy, see www.w3.org"> 62b15cb3dSCy Schubert <title>Authentication Support</title> 74e1ef62aSXin LI <!-- Changed by: Harlan Stenn, 24-Jul-2018 --> 82b15cb3dSCy Schubert <link href="scripts/style.css" type="text/css" rel="stylesheet"> 92b15cb3dSCy Schubert <style type="text/css"> 102b15cb3dSCy Schubert <!-- 112b15cb3dSCy Schubert <style1 { 122b15cb3dSCy Schubert color: #FF0000; 132b15cb3dSCy Schubert font-weight: bold; 142b15cb3dSCy Schubert } 152b15cb3dSCy Schubert .style1 {color: #FF0000} 162b15cb3dSCy Schubert --> 172b15cb3dSCy Schubert </style> 182b15cb3dSCy Schubert </head> 192b15cb3dSCy Schubert <body> 202b15cb3dSCy Schubert <h3>Authentication Support</h3> 212b15cb3dSCy Schubert <img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a> 222b15cb3dSCy Schubert <p>Our resident cryptographer; now you see him, now you don't.</p> 232b15cb3dSCy Schubert <p>Last update: 244e1ef62aSXin LI <!-- #BeginDate format:En2m -->24-Jul-2018 09:12<!-- #EndDate --> 252b15cb3dSCy Schubert UTC</p> 262b15cb3dSCy Schubert <br clear="left"> 272b15cb3dSCy Schubert <h4>Related Links</h4> 282b15cb3dSCy Schubert <script type="text/javascript" language="javascript" src="scripts/hand.txt"></script> 292b15cb3dSCy Schubert <script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script> 302b15cb3dSCy Schubert <h4>Table of Contents</h4> 312b15cb3dSCy Schubert <ul> 322b15cb3dSCy Schubert <li class="inline"><a href="#auth">Introduction</a></li> 332b15cb3dSCy Schubert <li class="inline"><a href="#symm">Symmetric Key Cryptography</a></li> 342b15cb3dSCy Schubert <li class="inline"><a href="#windows">Microsoft Windows Authentication</a></li> 352b15cb3dSCy Schubert <li class="inline"><a href="#pub">Public Key Cryptography</a></li> 362b15cb3dSCy Schubert </ul> 372b15cb3dSCy Schubert <hr> 382b15cb3dSCy Schubert <h4 id="auth">Introduction</h4> 394e1ef62aSXin LI <p>This page describes the various cryptographic authentication 404e1ef62aSXin LI provisions in NTPv4. Authentication support allows the NTP client to 414e1ef62aSXin LI verify that servers are in fact known and trusted and not intruders 424e1ef62aSXin LI intending accidentally or intentionally to masquerade as a legitimate 434e1ef62aSXin LI server. A detailed discussion of the NTP multi-layer security model 444e1ef62aSXin LI and vulnerability analysis is in the white 454e1ef62aSXin LI paper <a href="http://www.eecis.udel.edu/~mills/security.html">NTP 464e1ef62aSXin LI Security Analysis</a>.</p> 474e1ef62aSXin LI <p>The NTPv3 specification (RFC-1305) defined an authentication scheme 484e1ef62aSXin LI properly described as <em>symmetric key cryptography</em>. It used 494e1ef62aSXin LI the Data Encryption Standard (DES) algorithm operating in cipher-block 504e1ef62aSXin LI chaining (CBC) mode. Subsequently, this algorithm was replaced by the 514e1ef62aSXin LI RSA Message Digest 5 (MD5) algorithm commonly called keyed-MD5. 524e1ef62aSXin LI Either algorithm computes a message digest or one-way hash which can 534e1ef62aSXin LI be used to verify the client has the same message digest as the 544e1ef62aSXin LI server. The MD5 message digest algorithm is included in the 554e1ef62aSXin LI distribution, so without further cryptographic support, the 564e1ef62aSXin LI distribution can be freely exported.</p> 574e1ef62aSXin LI <p>If the OpenSSL cryptographic library is installed prior to building 584e1ef62aSXin LI the distribution, all message digest algorithms included in the 594e1ef62aSXin LI library may be used, including SHA and SHA1. However, if conformance 604e1ef62aSXin LI to FIPS 140-2 is required, only a limited subset of these algorithms 614e1ef62aSXin LI can be used. This library is available 624e1ef62aSXin LI from <a href="http://www.openssl.org">http://www.openssl.org</a> and 634e1ef62aSXin LI can be installed using the procedures outlined in 644e1ef62aSXin LI the <a href="build.html">Building and Installing the Distribution</a> 654e1ef62aSXin LI page. Once installed, the configure and build process automatically 664e1ef62aSXin LI detects the library and links the library routines required.</p> 674e1ef62aSXin LI <p>In addition to the symmetric key algorithms, this distribution 684e1ef62aSXin LI includes support for the Autokey public key algorithms and protocol 694e1ef62aSXin LI specified in RFC-5906 "Network Time Protocol Version 4: Autokey 704e1ef62aSXin LI Specification". This support is available only if the OpenSSL 714e1ef62aSXin LI library has been installed and the <tt>--enable-autokey</tt> option is 724e1ef62aSXin LI used when the distribution is built.</p> 734e1ef62aSXin LI <p> Public key cryptography is generally considered more secure than 744e1ef62aSXin LI symmetric key cryptography, since the security is based on private and 754e1ef62aSXin LI public values which are generated by each participant and where the 764e1ef62aSXin LI private value is never revealed. Autokey uses X.509 public 774e1ef62aSXin LI certificates, which can be produced by commercial services, the 784e1ef62aSXin LI OpenSSL application program, or 794e1ef62aSXin LI the <a href="keygen.html"><tt>ntp-keygen</tt></a> utility program in 804e1ef62aSXin LI the NTP software distribution.</p> 814e1ef62aSXin LI <p>Note that according to US law, NTP binaries including OpenSSL library 824e1ef62aSXin LI components, including the OpenSSL library itself, cannot be exported 834e1ef62aSXin LI outside the US without license from the US Department of Commerce. 844e1ef62aSXin LI Builders outside the US are advised to obtain the OpenSSL library 854e1ef62aSXin LI directly from OpenSSL, which is outside the US, and build outside the 864e1ef62aSXin LI US.</p> 874e1ef62aSXin LI <p>Authentication is configured separately for each association using 884e1ef62aSXin LI the <tt>key</tt> or <tt>autokey</tt> option of the <tt>server</tt> 894e1ef62aSXin LI configuration command, as described in 904e1ef62aSXin LI the <a href="confopt.html">Server Options</a> page. 914e1ef62aSXin LI The <a href="keygen.html">ntp-keygen</a> page describes the files 924e1ef62aSXin LI required for the various authentication schemes. Further details are 934e1ef62aSXin LI in the briefings, papers and reports at the NTP project page linked 944e1ef62aSXin LI from <a href="http://www.ntp.org">www.ntp.org</a>.</p> 954e1ef62aSXin LI <p>By default, the client sends non-authenticated packets and the server 964e1ef62aSXin LI responds with non-authenticated packets. If the client sends 974e1ef62aSXin LI authenticated packets, the server responds with authenticated packets 984e1ef62aSXin LI if correct, or a crypto-NAK packet if not. In the case of unsolicited 994e1ef62aSXin LI packets which might consume significant resources, such as broadcast 1004e1ef62aSXin LI or symmetric mode packets, authentication is required, unless 1014e1ef62aSXin LI overridden by a <tt>disable auth</tt> command. In the current climate 1024e1ef62aSXin LI of targeted broadcast or "letterbomb" attacks, defeating 1034e1ef62aSXin LI this requirement would be decidedly dangerous. In any case, 1044e1ef62aSXin LI the <tt>notrust </tt>flag, described on 1054e1ef62aSXin LI the <a href="authopt.html">Access Control Options</a> page, can be 1064e1ef62aSXin LI used to disable access to all but correctly authenticated clients.</p> 1072b15cb3dSCy Schubert <h4 id="symm">Symmetric Key Cryptography</h4> 1084e1ef62aSXin LI <p>The original NTPv3 specification (RFC-1305), as well as the current 1094e1ef62aSXin LI NTPv4 specification (RFC-5905), allows any one of possibly 65,535 1104e1ef62aSXin LI message digest keys (excluding zero), each distinguished by a 32-bit 1114e1ef62aSXin LI key ID, to authenticate an association. The servers and clients 1124e1ef62aSXin LI involved must agree on the key ID, key type and key to authenticate 1134e1ef62aSXin LI NTP packets.</p> 1144e1ef62aSXin LI <p>The message digest is a cryptographic hash computed by an algorithm 1154e1ef62aSXin LI such as MD5, SHA, or AES-128 CMAC. When authentication is specified, 1164e1ef62aSXin LI a message authentication code (MAC) is appended to the NTP packet 1174e1ef62aSXin LI header. The MAC consists of a 32-bit key identifier (key ID) followed 1184e1ef62aSXin LI by a 128- or 160-bit message digest. The algorithm computes the 1194e1ef62aSXin LI digest as the hash of a 128- or 160- bit message digest key 1204e1ef62aSXin LI concatenated with the NTP packet header fields with the exception of 1214e1ef62aSXin LI the MAC. On transmit, the message digest is computed and inserted in 1224e1ef62aSXin LI the MAC. On receive, the message digest is computed and compared with 1234e1ef62aSXin LI the MAC. The packet is accepted only if the two MACs are identical. 1244e1ef62aSXin LI If a discrepancy is found by the client, the client ignores the 1254e1ef62aSXin LI packet, but raises an alarm. If this happens at the server, the 1264e1ef62aSXin LI server returns a special message called a <em>crypto-NAK</em>. Since 1274e1ef62aSXin LI the crypto-NAK is protected by the loopback test, an intruder cannot 1284e1ef62aSXin LI disrupt the protocol by sending a bogus crypto-NAK.</p> 1294e1ef62aSXin LI <p>Keys and related information are specified in a keys file, which must 1304e1ef62aSXin LI be distributed and stored using secure means beyond the scope of the 1314e1ef62aSXin LI NTP protocol itself. Besides the keys used for ordinary NTP 1324e1ef62aSXin LI associations, additional keys can be used as passwords for 1334e1ef62aSXin LI the <tt><a href="ntpq.html">ntpq</a></tt> 1344e1ef62aSXin LI and <tt><a href="ntpdc.html">ntpdc</a></tt> utility programs. 1354e1ef62aSXin LI Ordinarily, the <tt>ntp.keys</tt> file is generated by 1364e1ef62aSXin LI the <tt><a href="keygen.html">ntp-keygen</a></tt> program, but it can 1374e1ef62aSXin LI be constructed and edited using an ordinary text editor.</p> 138*a466cc55SCy Schubert <p> Each line of the keys file consists of three or four fields: a 139*a466cc55SCy Schubert key ID in the range 1 to 65,535, inclusive, a key type, a 140*a466cc55SCy Schubert message digest key consisting of a printable ASCII string up to 141*a466cc55SCy Schubert 20 characters or a hex digit string with more than 20 142*a466cc55SCy Schubert characters, and an optional comma-separated list of IPs that are 143*a466cc55SCy Schubert allowed to serve time. If the OpenSSL library is installed, the 144*a466cc55SCy Schubert key type can be any message digest algorithm supported by the 145*a466cc55SCy Schubert library. If the OpenSSL library is not installed, the only 1464e1ef62aSXin LI permitted key type is MD5.</p> 14709100258SXin LI <table> 14809100258SXin LI <caption style="caption-side: bottom;"> 14909100258SXin LI Figure 1. Typical Symmetric Key File 15009100258SXin LI </caption> 15109100258SXin LI <tr><td style="border: 1px solid black; border-spacing: 0;"> 15209100258SXin LI <pre style="color:grey;"> 15309100258SXin LI # ntpkey_MD5key_bk.ntp.org.3595864945 15409100258SXin LI # Thu Dec 12 19:22:25 2013 15509100258SXin LI 15609100258SXin LI 1 MD5 L";Nw<`.I<f4U0)247"i # MD5 key 15709100258SXin LI 2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 15809100258SXin LI 3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 15909100258SXin LI 4 MD5 Yue:tL[+vR)M`n~bY,'? # MD5 key 16009100258SXin LI 5 MD5 B;fxlKgr/&4ZTbL6=RxA # MD5 key 16109100258SXin LI 6 MD5 4eYwa`o}3i@@V@..R9!l # MD5 key 16209100258SXin LI 7 MD5 `A.([h+;wTQ|xfi%Sn_! # MD5 key 16309100258SXin LI 8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 16409100258SXin LI 9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 16509100258SXin LI 10 MD5 2late4Me # MD5 key 16609100258SXin LI 11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 16709100258SXin LI 12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 16809100258SXin LI 13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 16909100258SXin LI 14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 17009100258SXin LI 15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 17109100258SXin LI 16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 17209100258SXin LI 17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 17309100258SXin LI 18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 17409100258SXin LI 19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 17509100258SXin LI 20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 1764e1ef62aSXin LI 21 MD5 sampo 10.1.2.3/24 17709100258SXin LI </pre></td></tr></table> 1784e1ef62aSXin LI <p>Figure 1 shows a typical symmetric keys file used by the reference 1794e1ef62aSXin LI implementation when the OpenSSL library is installed. Each line of 1804e1ef62aSXin LI the file contains three or four fields. The first field is an integer 1814e1ef62aSXin LI between 1 and 65535, inclusive, representing the key identifier. The 1824e1ef62aSXin LI second field is the digest algorithm, which in the absence of the 1834e1ef62aSXin LI OpenSSL library must be <tt>MD5</tt>, which designates the MD5 message 1844e1ef62aSXin LI digest algorithm. The third field is the key. The optional fourth 1854e1ef62aSXin LI field is one or more comma-separated IPs. An IP may end with an 1864e1ef62aSXin LI optional <tt>/subnetbits</tt> suffix, which limits the acceptance of 1874e1ef62aSXin LI the key identifier to packets claiming to be from the described IP 1884e1ef62aSXin LI space. In this example, for the key IDs in the range 1-10 the key is 1894e1ef62aSXin LI interpreted as a printable ASCII string. For the key IDs in the range 1904e1ef62aSXin LI 11-20, the key is a 40-character hex digit string. In either case, 1914e1ef62aSXin LI the key is truncated or zero-filled internally to either 128 or 160 1924e1ef62aSXin LI bits, depending on the key type. The line can be edited later or new 1934e1ef62aSXin LI lines can be added to change any field. The key can be changed to a 1944e1ef62aSXin LI password, such as <tt>2late4Me</tt> for key ID 10. Note that two or 1954e1ef62aSXin LI more keys files can be combined in any order as long as the key IDs 1964e1ef62aSXin LI are distinct.</p> 1974e1ef62aSXin LI <p>When <tt>ntpd</tt> is started, it reads the keys file specified by 1984e1ef62aSXin LI the <tt>keys</tt> command and installs the keys in the key cache. 1994e1ef62aSXin LI However, individual keys must be activated with 2004e1ef62aSXin LI the <tt>trustedkey</tt> configuration command before use. This 2014e1ef62aSXin LI allows, for instance, the installation of possibly several batches of 2024e1ef62aSXin LI keys and then activating a key remotely using <tt>ntpq</tt> 2034e1ef62aSXin LI or <tt>ntpdc</tt>. The <tt>requestkey</tt> command selects the key ID 2044e1ef62aSXin LI used as the password for the <tt>ntpdc</tt> utility, while 2054e1ef62aSXin LI the <tt>controlkey</tt> command selects the key ID used as the 2064e1ef62aSXin LI password for the <tt>ntpq</tt> utility.</p> 2072b15cb3dSCy Schubert <h4 id="windows">Microsoft Windows Authentication</h4> 2084e1ef62aSXin LI <p>In addition to the above means, <tt>ntpd</tt> now supports Microsoft 2094e1ef62aSXin LI Windows MS-SNTP authentication using Active Directory services. This 2104e1ef62aSXin LI support was contributed by the Samba Team and is still in development. 2114e1ef62aSXin LI It is enabled using the <tt>mssntp</tt> flag of the <tt>restrict</tt> 2124e1ef62aSXin LI command described on the <a href="accopt.html#restrict">Access Control 2134e1ef62aSXin LI Options</a> page. <span class="style1">Note: Potential users should 2144e1ef62aSXin LI be aware that these services involve a TCP connection to another 2154e1ef62aSXin LI process that could potentially block, denying services to other users. 2164e1ef62aSXin LI Therefore, this flag should be used only for a dedicated server with 2174e1ef62aSXin LI no clients other than MS-SNTP.</span></p> 2182b15cb3dSCy Schubert <h4 id="pub">Public Key Cryptography</h4> 2194e1ef62aSXin LI <p>See the <a href="autokey.html">Autokey Public-Key Authentication</a> 2204e1ef62aSXin LI page.</p> 2212b15cb3dSCy Schubert <hr> 2222b15cb3dSCy Schubert <script type="text/javascript" language="javascript" src="scripts/footer.txt"></script> 2232b15cb3dSCy Schubert </body> 2242b15cb3dSCy Schubert</html> 225
