12b15cb3dSCy Schubert<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> 22b15cb3dSCy Schubert<html> 32b15cb3dSCy Schubert <head> 42b15cb3dSCy Schubert <meta http-equiv="content-type" content="text/html;charset=iso-8859-1"> 52b15cb3dSCy Schubert <meta name="generator" content="HTML Tidy, see www.w3.org"> 62b15cb3dSCy Schubert <title>Authentication Support</title> 7*4e1ef62aSXin LI <!-- Changed by: Harlan Stenn, 24-Jul-2018 --> 82b15cb3dSCy Schubert <link href="scripts/style.css" type="text/css" rel="stylesheet"> 92b15cb3dSCy Schubert <style type="text/css"> 102b15cb3dSCy Schubert <!-- 112b15cb3dSCy Schubert <style1 { 122b15cb3dSCy Schubert color: #FF0000; 132b15cb3dSCy Schubert font-weight: bold; 142b15cb3dSCy Schubert } 152b15cb3dSCy Schubert .style1 {color: #FF0000} 162b15cb3dSCy Schubert --> 172b15cb3dSCy Schubert </style> 182b15cb3dSCy Schubert </head> 192b15cb3dSCy Schubert <body> 202b15cb3dSCy Schubert <h3>Authentication Support</h3> 212b15cb3dSCy Schubert <img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a> 222b15cb3dSCy Schubert <p>Our resident cryptographer; now you see him, now you don't.</p> 232b15cb3dSCy Schubert <p>Last update: 24*4e1ef62aSXin LI <!-- #BeginDate format:En2m -->24-Jul-2018 09:12<!-- #EndDate --> 252b15cb3dSCy Schubert UTC</p> 262b15cb3dSCy Schubert <br clear="left"> 272b15cb3dSCy Schubert <h4>Related Links</h4> 282b15cb3dSCy Schubert <script type="text/javascript" language="javascript" src="scripts/hand.txt"></script> 292b15cb3dSCy Schubert <script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script> 302b15cb3dSCy Schubert <h4>Table of Contents</h4> 312b15cb3dSCy Schubert <ul> 322b15cb3dSCy Schubert <li class="inline"><a href="#auth">Introduction</a></li> 332b15cb3dSCy Schubert <li class="inline"><a href="#symm">Symmetric Key Cryptography</a></li> 342b15cb3dSCy Schubert <li class="inline"><a href="#windows">Microsoft Windows Authentication</a></li> 352b15cb3dSCy Schubert <li class="inline"><a href="#pub">Public Key Cryptography</a></li> 362b15cb3dSCy Schubert </ul> 372b15cb3dSCy Schubert <hr> 382b15cb3dSCy Schubert <h4 id="auth">Introduction</h4> 39*4e1ef62aSXin LI <p>This page describes the various cryptographic authentication 40*4e1ef62aSXin LI provisions in NTPv4. Authentication support allows the NTP client to 41*4e1ef62aSXin LI verify that servers are in fact known and trusted and not intruders 42*4e1ef62aSXin LI intending accidentally or intentionally to masquerade as a legitimate 43*4e1ef62aSXin LI server. A detailed discussion of the NTP multi-layer security model 44*4e1ef62aSXin LI and vulnerability analysis is in the white 45*4e1ef62aSXin LI paper <a href="http://www.eecis.udel.edu/~mills/security.html">NTP 46*4e1ef62aSXin LI Security Analysis</a>.</p> 47*4e1ef62aSXin LI <p>The NTPv3 specification (RFC-1305) defined an authentication scheme 48*4e1ef62aSXin LI properly described as <em>symmetric key cryptography</em>. It used 49*4e1ef62aSXin LI the Data Encryption Standard (DES) algorithm operating in cipher-block 50*4e1ef62aSXin LI chaining (CBC) mode. Subsequently, this algorithm was replaced by the 51*4e1ef62aSXin LI RSA Message Digest 5 (MD5) algorithm commonly called keyed-MD5. 52*4e1ef62aSXin LI Either algorithm computes a message digest or one-way hash which can 53*4e1ef62aSXin LI be used to verify the client has the same message digest as the 54*4e1ef62aSXin LI server. The MD5 message digest algorithm is included in the 55*4e1ef62aSXin LI distribution, so without further cryptographic support, the 56*4e1ef62aSXin LI distribution can be freely exported.</p> 57*4e1ef62aSXin LI <p>If the OpenSSL cryptographic library is installed prior to building 58*4e1ef62aSXin LI the distribution, all message digest algorithms included in the 59*4e1ef62aSXin LI library may be used, including SHA and SHA1. However, if conformance 60*4e1ef62aSXin LI to FIPS 140-2 is required, only a limited subset of these algorithms 61*4e1ef62aSXin LI can be used. This library is available 62*4e1ef62aSXin LI from <a href="http://www.openssl.org">http://www.openssl.org</a> and 63*4e1ef62aSXin LI can be installed using the procedures outlined in 64*4e1ef62aSXin LI the <a href="build.html">Building and Installing the Distribution</a> 65*4e1ef62aSXin LI page. Once installed, the configure and build process automatically 66*4e1ef62aSXin LI detects the library and links the library routines required.</p> 67*4e1ef62aSXin LI <p>In addition to the symmetric key algorithms, this distribution 68*4e1ef62aSXin LI includes support for the Autokey public key algorithms and protocol 69*4e1ef62aSXin LI specified in RFC-5906 "Network Time Protocol Version 4: Autokey 70*4e1ef62aSXin LI Specification". This support is available only if the OpenSSL 71*4e1ef62aSXin LI library has been installed and the <tt>--enable-autokey</tt> option is 72*4e1ef62aSXin LI used when the distribution is built.</p> 73*4e1ef62aSXin LI <p> Public key cryptography is generally considered more secure than 74*4e1ef62aSXin LI symmetric key cryptography, since the security is based on private and 75*4e1ef62aSXin LI public values which are generated by each participant and where the 76*4e1ef62aSXin LI private value is never revealed. Autokey uses X.509 public 77*4e1ef62aSXin LI certificates, which can be produced by commercial services, the 78*4e1ef62aSXin LI OpenSSL application program, or 79*4e1ef62aSXin LI the <a href="keygen.html"><tt>ntp-keygen</tt></a> utility program in 80*4e1ef62aSXin LI the NTP software distribution.</p> 81*4e1ef62aSXin LI <p>Note that according to US law, NTP binaries including OpenSSL library 82*4e1ef62aSXin LI components, including the OpenSSL library itself, cannot be exported 83*4e1ef62aSXin LI outside the US without license from the US Department of Commerce. 84*4e1ef62aSXin LI Builders outside the US are advised to obtain the OpenSSL library 85*4e1ef62aSXin LI directly from OpenSSL, which is outside the US, and build outside the 86*4e1ef62aSXin LI US.</p> 87*4e1ef62aSXin LI <p>Authentication is configured separately for each association using 88*4e1ef62aSXin LI the <tt>key</tt> or <tt>autokey</tt> option of the <tt>server</tt> 89*4e1ef62aSXin LI configuration command, as described in 90*4e1ef62aSXin LI the <a href="confopt.html">Server Options</a> page. 91*4e1ef62aSXin LI The <a href="keygen.html">ntp-keygen</a> page describes the files 92*4e1ef62aSXin LI required for the various authentication schemes. Further details are 93*4e1ef62aSXin LI in the briefings, papers and reports at the NTP project page linked 94*4e1ef62aSXin LI from <a href="http://www.ntp.org">www.ntp.org</a>.</p> 95*4e1ef62aSXin LI <p>By default, the client sends non-authenticated packets and the server 96*4e1ef62aSXin LI responds with non-authenticated packets. If the client sends 97*4e1ef62aSXin LI authenticated packets, the server responds with authenticated packets 98*4e1ef62aSXin LI if correct, or a crypto-NAK packet if not. In the case of unsolicited 99*4e1ef62aSXin LI packets which might consume significant resources, such as broadcast 100*4e1ef62aSXin LI or symmetric mode packets, authentication is required, unless 101*4e1ef62aSXin LI overridden by a <tt>disable auth</tt> command. In the current climate 102*4e1ef62aSXin LI of targeted broadcast or "letterbomb" attacks, defeating 103*4e1ef62aSXin LI this requirement would be decidedly dangerous. In any case, 104*4e1ef62aSXin LI the <tt>notrust </tt>flag, described on 105*4e1ef62aSXin LI the <a href="authopt.html">Access Control Options</a> page, can be 106*4e1ef62aSXin LI used to disable access to all but correctly authenticated clients.</p> 1072b15cb3dSCy Schubert <h4 id="symm">Symmetric Key Cryptography</h4> 108*4e1ef62aSXin LI <p>The original NTPv3 specification (RFC-1305), as well as the current 109*4e1ef62aSXin LI NTPv4 specification (RFC-5905), allows any one of possibly 65,535 110*4e1ef62aSXin LI message digest keys (excluding zero), each distinguished by a 32-bit 111*4e1ef62aSXin LI key ID, to authenticate an association. The servers and clients 112*4e1ef62aSXin LI involved must agree on the key ID, key type and key to authenticate 113*4e1ef62aSXin LI NTP packets.</p> 114*4e1ef62aSXin LI <p>The message digest is a cryptographic hash computed by an algorithm 115*4e1ef62aSXin LI such as MD5, SHA, or AES-128 CMAC. When authentication is specified, 116*4e1ef62aSXin LI a message authentication code (MAC) is appended to the NTP packet 117*4e1ef62aSXin LI header. The MAC consists of a 32-bit key identifier (key ID) followed 118*4e1ef62aSXin LI by a 128- or 160-bit message digest. The algorithm computes the 119*4e1ef62aSXin LI digest as the hash of a 128- or 160- bit message digest key 120*4e1ef62aSXin LI concatenated with the NTP packet header fields with the exception of 121*4e1ef62aSXin LI the MAC. On transmit, the message digest is computed and inserted in 122*4e1ef62aSXin LI the MAC. On receive, the message digest is computed and compared with 123*4e1ef62aSXin LI the MAC. The packet is accepted only if the two MACs are identical. 124*4e1ef62aSXin LI If a discrepancy is found by the client, the client ignores the 125*4e1ef62aSXin LI packet, but raises an alarm. If this happens at the server, the 126*4e1ef62aSXin LI server returns a special message called a <em>crypto-NAK</em>. Since 127*4e1ef62aSXin LI the crypto-NAK is protected by the loopback test, an intruder cannot 128*4e1ef62aSXin LI disrupt the protocol by sending a bogus crypto-NAK.</p> 129*4e1ef62aSXin LI <p>Keys and related information are specified in a keys file, which must 130*4e1ef62aSXin LI be distributed and stored using secure means beyond the scope of the 131*4e1ef62aSXin LI NTP protocol itself. Besides the keys used for ordinary NTP 132*4e1ef62aSXin LI associations, additional keys can be used as passwords for 133*4e1ef62aSXin LI the <tt><a href="ntpq.html">ntpq</a></tt> 134*4e1ef62aSXin LI and <tt><a href="ntpdc.html">ntpdc</a></tt> utility programs. 135*4e1ef62aSXin LI Ordinarily, the <tt>ntp.keys</tt> file is generated by 136*4e1ef62aSXin LI the <tt><a href="keygen.html">ntp-keygen</a></tt> program, but it can 137*4e1ef62aSXin LI be constructed and edited using an ordinary text editor.</p> 138*4e1ef62aSXin LI <p> Each line of the keys file consists of three or four fields: a key 139*4e1ef62aSXin LI ID in the range 1 to 65,535, inclusive, a key type, a message digest 140*4e1ef62aSXin LI key consisting of a printable ASCII string less than 40 characters or 141*4e1ef62aSXin LI a 40-character hex digit string, and an optional comma-separated list 142*4e1ef62aSXin LI of IPs that are allowed to serve time. If the OpenSSL library is 143*4e1ef62aSXin LI installed, the key type can be any message digest algorithm supported 144*4e1ef62aSXin LI by the library. If the OpenSSL library is not installed, the only 145*4e1ef62aSXin LI permitted key type is MD5.</p> 14609100258SXin LI <table> 14709100258SXin LI <caption style="caption-side: bottom;"> 14809100258SXin LI Figure 1. Typical Symmetric Key File 14909100258SXin LI </caption> 15009100258SXin LI <tr><td style="border: 1px solid black; border-spacing: 0;"> 15109100258SXin LI <pre style="color:grey;"> 15209100258SXin LI # ntpkey_MD5key_bk.ntp.org.3595864945 15309100258SXin LI # Thu Dec 12 19:22:25 2013 15409100258SXin LI 15509100258SXin LI 1 MD5 L";Nw<`.I<f4U0)247"i # MD5 key 15609100258SXin LI 2 MD5 &>l0%XXK9O'51VwV<xq~ # MD5 key 15709100258SXin LI 3 MD5 lb4zLW~d^!K:]RsD'qb6 # MD5 key 15809100258SXin LI 4 MD5 Yue:tL[+vR)M`n~bY,'? # MD5 key 15909100258SXin LI 5 MD5 B;fxlKgr/&4ZTbL6=RxA # MD5 key 16009100258SXin LI 6 MD5 4eYwa`o}3i@@V@..R9!l # MD5 key 16109100258SXin LI 7 MD5 `A.([h+;wTQ|xfi%Sn_! # MD5 key 16209100258SXin LI 8 MD5 45:V,r4]l6y^JH6"Sh?F # MD5 key 16309100258SXin LI 9 MD5 3-5vcn*6l29DS?Xdsg)* # MD5 key 16409100258SXin LI 10 MD5 2late4Me # MD5 key 16509100258SXin LI 11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c # SHA1 key 16609100258SXin LI 12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74 # SHA1 key 16709100258SXin LI 13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9 # SHA1 key 16809100258SXin LI 14 SHA a5332809c8878dd3a5b918819108a111509aeceb # SHA key 16909100258SXin LI 15 MD2 2fe16c88c760ff2f16d4267e36c1aa6c926e6964 # MD2 key 17009100258SXin LI 16 MD4 b2691811dc19cfc0e2f9bcacd74213f29812183d # MD4 key 17109100258SXin LI 17 MD5 e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c # MD5 key 17209100258SXin LI 18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc # MDC2 key 17309100258SXin LI 19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2 # RIPEMD160 key 17409100258SXin LI 20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878 # AES128CMAC key 175*4e1ef62aSXin LI 21 MD5 sampo 10.1.2.3/24 17609100258SXin LI </pre></td></tr></table> 177*4e1ef62aSXin LI <p>Figure 1 shows a typical symmetric keys file used by the reference 178*4e1ef62aSXin LI implementation when the OpenSSL library is installed. Each line of 179*4e1ef62aSXin LI the file contains three or four fields. The first field is an integer 180*4e1ef62aSXin LI between 1 and 65535, inclusive, representing the key identifier. The 181*4e1ef62aSXin LI second field is the digest algorithm, which in the absence of the 182*4e1ef62aSXin LI OpenSSL library must be <tt>MD5</tt>, which designates the MD5 message 183*4e1ef62aSXin LI digest algorithm. The third field is the key. The optional fourth 184*4e1ef62aSXin LI field is one or more comma-separated IPs. An IP may end with an 185*4e1ef62aSXin LI optional <tt>/subnetbits</tt> suffix, which limits the acceptance of 186*4e1ef62aSXin LI the key identifier to packets claiming to be from the described IP 187*4e1ef62aSXin LI space. In this example, for the key IDs in the range 1-10 the key is 188*4e1ef62aSXin LI interpreted as a printable ASCII string. For the key IDs in the range 189*4e1ef62aSXin LI 11-20, the key is a 40-character hex digit string. In either case, 190*4e1ef62aSXin LI the key is truncated or zero-filled internally to either 128 or 160 191*4e1ef62aSXin LI bits, depending on the key type. The line can be edited later or new 192*4e1ef62aSXin LI lines can be added to change any field. The key can be changed to a 193*4e1ef62aSXin LI password, such as <tt>2late4Me</tt> for key ID 10. Note that two or 194*4e1ef62aSXin LI more keys files can be combined in any order as long as the key IDs 195*4e1ef62aSXin LI are distinct.</p> 196*4e1ef62aSXin LI <p>When <tt>ntpd</tt> is started, it reads the keys file specified by 197*4e1ef62aSXin LI the <tt>keys</tt> command and installs the keys in the key cache. 198*4e1ef62aSXin LI However, individual keys must be activated with 199*4e1ef62aSXin LI the <tt>trustedkey</tt> configuration command before use. This 200*4e1ef62aSXin LI allows, for instance, the installation of possibly several batches of 201*4e1ef62aSXin LI keys and then activating a key remotely using <tt>ntpq</tt> 202*4e1ef62aSXin LI or <tt>ntpdc</tt>. The <tt>requestkey</tt> command selects the key ID 203*4e1ef62aSXin LI used as the password for the <tt>ntpdc</tt> utility, while 204*4e1ef62aSXin LI the <tt>controlkey</tt> command selects the key ID used as the 205*4e1ef62aSXin LI password for the <tt>ntpq</tt> utility.</p> 2062b15cb3dSCy Schubert <h4 id="windows">Microsoft Windows Authentication</h4> 207*4e1ef62aSXin LI <p>In addition to the above means, <tt>ntpd</tt> now supports Microsoft 208*4e1ef62aSXin LI Windows MS-SNTP authentication using Active Directory services. This 209*4e1ef62aSXin LI support was contributed by the Samba Team and is still in development. 210*4e1ef62aSXin LI It is enabled using the <tt>mssntp</tt> flag of the <tt>restrict</tt> 211*4e1ef62aSXin LI command described on the <a href="accopt.html#restrict">Access Control 212*4e1ef62aSXin LI Options</a> page. <span class="style1">Note: Potential users should 213*4e1ef62aSXin LI be aware that these services involve a TCP connection to another 214*4e1ef62aSXin LI process that could potentially block, denying services to other users. 215*4e1ef62aSXin LI Therefore, this flag should be used only for a dedicated server with 216*4e1ef62aSXin LI no clients other than MS-SNTP.</span></p> 2172b15cb3dSCy Schubert <h4 id="pub">Public Key Cryptography</h4> 218*4e1ef62aSXin LI <p>See the <a href="autokey.html">Autokey Public-Key Authentication</a> 219*4e1ef62aSXin LI page.</p> 2202b15cb3dSCy Schubert <hr> 2212b15cb3dSCy Schubert <script type="text/javascript" language="javascript" src="scripts/footer.txt"></script> 2222b15cb3dSCy Schubert </body> 2232b15cb3dSCy Schubert</html> 224
