12b15cb3dSCy Schubert<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 22b15cb3dSCy Schubert<html> 32b15cb3dSCy Schubert<head> 42b15cb3dSCy Schubert<meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> 52b15cb3dSCy Schubert<meta name="generator" content="HTML Tidy, see www.w3.org"> 62b15cb3dSCy Schubert<title>Authentication Support</title> 72b15cb3dSCy Schubert<link href="scripts/style.css" type="text/css" rel="stylesheet"> 82b15cb3dSCy Schubert<style type="text/css"> 92b15cb3dSCy Schubert<!-- 102b15cb3dSCy Schubert<style1 { 112b15cb3dSCy Schubertcolor: #FF0000; 122b15cb3dSCy Schubert font-weight: bold; 132b15cb3dSCy Schubert} 142b15cb3dSCy Schubert.style1 {color: #FF0000} 152b15cb3dSCy Schubert--> 162b15cb3dSCy Schubert</style> 172b15cb3dSCy Schubert</head> 182b15cb3dSCy Schubert<body> 192b15cb3dSCy Schubert<h3>Authentication Support</h3> 202b15cb3dSCy Schubert<img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a> 212b15cb3dSCy Schubert<p>Our resident cryptographer; now you see him, now you don't.</p> 222b15cb3dSCy Schubert<p>Last update: 234990d495SXin LI <!-- #BeginDate format:En2m -->5-Feb-2016 09:13<!-- #EndDate --> 242b15cb3dSCy Schubert UTC</p> 252b15cb3dSCy Schubert<br clear="left"> 262b15cb3dSCy Schubert<h4>Related Links</h4> 272b15cb3dSCy Schubert<script type="text/javascript" language="javascript" src="scripts/hand.txt"></script> 282b15cb3dSCy Schubert<script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script> 292b15cb3dSCy Schubert<h4>Table of Contents</h4> 302b15cb3dSCy Schubert<ul> 312b15cb3dSCy Schubert <li class="inline"><a href="#auth">Introduction</a></li> 322b15cb3dSCy Schubert <li class="inline"><a href="#symm">Symmetric Key Cryptography</a></li> 332b15cb3dSCy Schubert <li class="inline"><a href="#windows">Microsoft Windows Authentication</a></li> 342b15cb3dSCy Schubert <li class="inline"><a href="#pub">Public Key Cryptography</a></li> 352b15cb3dSCy Schubert</ul> 362b15cb3dSCy Schubert<hr> 372b15cb3dSCy Schubert<h4 id="auth">Introduction</h4> 382b15cb3dSCy Schubert<p>This page describes the various cryptographic authentication provisions in NTPv4. Authentication support allows the NTP client to verify that servers are in fact known and trusted and not intruders intending accidentally or intentionally to masquerade as a legitimate server. A detailed discussion of the NTP multi-layer security model and vulnerability analysis is in the white paper <a href="http://www.eecis.udel.edu/~mills/security.html">NTP Security Analysis</a>.</p> 392b15cb3dSCy Schubert<p> The NTPv3 specification (RFC-1305) defined an authentication scheme properly described as <em>symmetric key cryptography</em>. It used the Data Encryption Standard (DES) algorithm operating in cipher-block chaining (CBC) mode. Subsequently, this algorithm was replaced by the RSA Message Digest 5 (MD5) algorithm commonly called keyed-MD5. Either algorithm computes a message digest or one-way hash which can be used to verify the client has the same message digest as the server. The MD5 message digest algorithm is included in the distribution, so without further cryptographic support, the distribution can be freely exported.</p> 402b15cb3dSCy Schubert<p>If the OpenSSL cryptographic library is installed prior to building the distribution, all message digest algorithms included in the library may be used, including SHA and SHA1. However, if conformance to FIPS 140-2 is required, only a limited subset of these algorithms can be used. This library is available from <a href="http://www.openssl.org">http://www.openssl.org</a> and can be installed using the procedures outlined in the <a href="build.html">Building and Installing the Distribution</a> page. Once installed, the configure and build process automatically detects the library and links the library routines 412b15cb3dSCy Schubertrequired.</p> 422b15cb3dSCy Schubert<p>In addition to the symmetric key algorithms, this distribution includes support for the Autokey public key algorithms and protocol specified in RFC-5906 "Network Time Protocol Version 4: Autokey Specification". This support is available only if the OpenSSL library has been installed and the <tt>--enable-autokey</tt> option is used when the distribution is built.</p> 432b15cb3dSCy Schubert<p> Public key cryptography is generally considered more secure than symmetric key cryptography, since the security is based on private and public values which are generated by each participant and where the private value is never revealed. Autokey uses X.509 public certificates, which can be produced by commercial services, the OpenSSL application program, or the <a href="keygen.html"><tt>ntp-keygen</tt></a> utility program in the NTP software distribution.</p> 442b15cb3dSCy Schubert<p>Note that according to US law, NTP binaries including OpenSSL library components, including the OpenSSL library itself, cannot be exported outside the US without license from the US Department of Commerce. Builders outside the US are advised to obtain the OpenSSL library directly from OpenSSL, which is outside the US, and build outside the US.</p> 452b15cb3dSCy Schubert<p>Authentication is configured separately for each association using the <tt>key</tt> or <tt>autokey</tt> option of the <tt>server</tt> configuration command, as described in the <a href="confopt.html">Server Options</a> page. The <a href="keygen.html">ntp-keygen</a> page describes the files required for the various authentication schemes. Further details are in the briefings, papers and reports at the NTP project page linked from <a href="http://www.ntp.org">www.ntp.org</a>.</p> 464990d495SXin LI<p>By default, the client sends non-authenticated packets and the server responds with non-authenticated packets. If the client sends authenticated packets, the server responds with authenticated packets if correct, or a crypto-NAK packet if not. In the case of unsolicited packets which might consume significant resources, such as broadcast or symmetric mode packets, authentication is required, unless overridden by a <tt>disable auth</tt> command. In the current climate of targeted broadcast or "letterbomb" attacks, defeating this requirement would be decidedly dangerous. In any case, the <tt>notrust </tt>flag, described on the <a href="authopt.html">Access Control Options</a> page, can be used to disable access to all but correctly authenticated clients.</p> 472b15cb3dSCy Schubert<h4 id="symm">Symmetric Key Cryptography</h4> 482b15cb3dSCy Schubert<p>The original NTPv3 specification (RFC-1305), as well as the current NTPv4 specification (RFC-5905), allows any one of possibly 65,534 message digest keys (excluding zero), each distinguished by a 32-bit key ID, to authenticate an association. The servers and clients involved must agree on the key ID, key type and key to authenticate NTP packets.</p> 49*09100258SXin LI<p>The message digest is a cryptographic hash computed by an algorithm such as MD5, SHA, or AES-128 CMAC. When authentication is specified, a message authentication code (MAC) is appended to the NTP packet header. The MAC consists of a 32-bit key identifier (key ID) followed by a 128- or 160-bit message digest. The algorithm computes the digest as the hash of a 128- or 160- bit message digest key concatenated with the NTP packet header fields with the exception of the MAC. On transmit, the message digest is computed and inserted in the MAC. On receive, the message digest is computed and compared with the MAC. The packet is accepted only if the two MACs are identical. If a discrepancy is found by the client, the client ignores the packet, but raises an alarm. If this happens at the server, the server returns a special message called a <em>crypto-NAK</em>. Since the crypto-NAK is protected by the loopback test, an intruder cannot disrupt the protocol by sending a bogus crypto-NAK.</p> 502b15cb3dSCy Schubert<p>Keys and related information are specified in a keys file, which must be distributed and stored using secure means beyond the scope of the NTP protocol itself. Besides the keys used for ordinary NTP associations, additional keys can be used as passwords for the <tt><a href="ntpq.html">ntpq</a></tt> and <tt><a href="ntpdc.html">ntpdc</a></tt> utility programs. Ordinarily, the <tt>ntp.keys</tt> file is generated by the <tt><a href="keygen.html">ntp-keygen</a></tt> program, but it can be constructed and edited using an ordinary text editor.</p> 514990d495SXin LI<p> Each line of the keys file consists of three or four fields: a key ID in the range 1 to 65,534, inclusive, a key type, a message digest key consisting of a printable ASCII string less than 40 characters or a 40-character hex digit string, and an optional comma-separated list of IPs that are allowed to serve time. If the OpenSSL library is installed, the key type can be any message digest algorithm supported by the library. If the OpenSSL library is not installed, the only permitted key type is MD5.</p> 52*09100258SXin LI<table> 53*09100258SXin LI <caption style="caption-side: bottom;"> 54*09100258SXin LI Figure 1. Typical Symmetric Key File 55*09100258SXin LI </caption> 56*09100258SXin LI <tr><td style="border: 1px solid black; border-spacing: 0;"> 57*09100258SXin LI <pre style="color:grey;"> 58*09100258SXin LI# ntpkey_MD5key_bk.ntp.org.3595864945 59*09100258SXin LI# Thu Dec 12 19:22:25 2013 60*09100258SXin LI 61*09100258SXin LI1 MD5 L";Nw<`.I<f4U0)247"i # MD5 key 62*09100258SXin LI2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 63*09100258SXin LI3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 64*09100258SXin LI4 MD5 Yue:tL[+vR)M`n~bY,'? # MD5 key 65*09100258SXin LI5 MD5 B;fxlKgr/&4ZTbL6=RxA # MD5 key 66*09100258SXin LI6 MD5 4eYwa`o}3i@@V@..R9!l # MD5 key 67*09100258SXin LI7 MD5 `A.([h+;wTQ|xfi%Sn_! # MD5 key 68*09100258SXin LI8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 69*09100258SXin LI9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 70*09100258SXin LI10 MD5 2late4Me # MD5 key 71*09100258SXin LI11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 72*09100258SXin LI12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 73*09100258SXin LI13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 74*09100258SXin LI14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 75*09100258SXin LI15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 76*09100258SXin LI16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 77*09100258SXin LI17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 78*09100258SXin LI18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 79*09100258SXin LI19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 80*09100258SXin LI20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 81*09100258SXin LI </pre></td></tr></table> 82*09100258SXin LI<p>Figure 1 shows a typical keys file used by the reference implementation when the OpenSSL library is installed. In this figure, for key IDs in he range 1-10, the key is interpreted as a printable ASCII string. For key IDs in the range 11-20, the key is a 40-character hex digit string. The key is truncated or zero-filled internally to either 128 or 160 bits, depending on the key type. The line can be edited later or new lines can be added to change any field. The key can be changed to a password, such as <tt>2late4Me</tt> for key ID 10. Note that two or more keys files can be combined in any order as long as the key IDs are distinct.</p> 832b15cb3dSCy Schubert<p>When <tt>ntpd</tt> is started, it reads the keys file specified by the <tt>keys</tt> command and installs the keys in the key cache. However, individual keys must be activated with the <tt>trustedkey</tt> configuration command before use. This allows, for instance, the installation of possibly several batches of keys and then activating a key remotely using <tt>ntpq</tt> or <tt>ntpdc</tt>. The <tt>requestkey</tt> command selects the key ID used as the password for the <tt>ntpdc</tt> utility, while the <tt>controlkey</tt> command selects the key ID used as the password for the <tt>ntpq</tt> utility.</p> 842b15cb3dSCy Schubert<h4 id="windows">Microsoft Windows Authentication</h4> 852b15cb3dSCy Schubert<p>In addition to the above means, <tt>ntpd</tt> now supports Microsoft Windows MS-SNTP authentication using Active Directory services. This support was contributed by the Samba Team and is still in development. It is enabled using the <tt>mssntp</tt> flag of the <tt>restrict</tt> command described on the <a href="accopt.html#restrict">Access Control Options</a> page. <span class="style1">Note: Potential users should be aware that these services involve a TCP connection to another process that could potentially block, denying services to other users. Therefore, this flag should be used only for a dedicated server with no clients other than MS-SNTP.</span></p> 862b15cb3dSCy Schubert<h4 id="pub">Public Key Cryptography</h4> 872b15cb3dSCy Schubert<p>See the <a href="autokey.html">Autokey Public-Key Authentication</a> page.</p> 882b15cb3dSCy Schubert<hr> 892b15cb3dSCy Schubert<script type="text/javascript" language="javascript" src="scripts/footer.txt"></script> 902b15cb3dSCy Schubert</body> 912b15cb3dSCy Schubert</html> 92
