<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
    <meta name="generator" content="HTML Tidy, see www.w3.org">
    <title>Authentication Support</title>
    <!-- Changed by: Harlan Stenn, 24-Jul-2018 -->
    <link href="scripts/style.css" type="text/css" rel="stylesheet">
    <style type="text/css">
      <!--
	  <style1 {
		  color: #FF0000;
		  font-weight: bold;
		  }
		  .style1 {color: #FF0000}
		  -->
    </style>
  </head>
  <body>
    <h3>Authentication Support</h3>
    <img src="pic/alice44.gif" alt="gif" align="left"><a href="http://www.eecis.udel.edu/%7emills/pictures.html">from <i>Alice's Adventures in Wonderland</i>, Lewis Carroll</a>
    <p>Our resident cryptographer; now you see him, now you don't.</p>
    <p>Last update:
      <!-- #BeginDate format:En2m -->24-Jul-2018  09:12<!-- #EndDate -->
      UTC</p>
    <br clear="left">
    <h4>Related Links</h4>
    <script type="text/javascript" language="javascript" src="scripts/hand.txt"></script>
    <script type="text/javascript" language="javascript" src="scripts/authopt.txt"></script>
    <h4>Table of Contents</h4>
    <ul>
      <li class="inline"><a href="#auth">Introduction</a></li>
      <li class="inline"><a href="#symm">Symmetric Key Cryptography</a></li>
      <li class="inline"><a href="#windows">Microsoft Windows Authentication</a></li>
      <li class="inline"><a href="#pub">Public Key Cryptography</a></li>
    </ul>
    <hr>
    <h4 id="auth">Introduction</h4>
    <p>This page describes the various cryptographic authentication
      provisions in NTPv4.  Authentication support allows the NTP client to
      verify that servers are in fact known and trusted and not intruders
      intending accidentally or intentionally to masquerade as a legitimate
      server.  A detailed discussion of the NTP multi-layer security model
      and vulnerability analysis is in the white
      paper <a href="http://www.eecis.udel.edu/~mills/security.html">NTP
      Security Analysis</a>.</p>
    <p>The NTPv3 specification (RFC-1305) defined an authentication scheme
      properly described as <em>symmetric key cryptography</em>.  It used
      the Data Encryption Standard (DES) algorithm operating in cipher-block
      chaining (CBC) mode.  Subsequently, this algorithm was replaced by the
      RSA Message Digest 5 (MD5) algorithm commonly called keyed-MD5.
      Either algorithm computes a message digest or one-way hash which can
      be used to verify the client has the same message digest as the
      server.  The MD5 message digest algorithm is included in the
      distribution, so without further cryptographic support, the
      distribution can be freely exported.</p>
    <p>If the OpenSSL cryptographic library is installed prior to building
      the distribution, all message digest algorithms included in the
      library may be used, including SHA and SHA1.  However, if conformance
      to FIPS 140-2 is required, only a limited subset of these algorithms
      can be used.  This library is available
      from <a href="http://www.openssl.org">http://www.openssl.org</a> and
      can be installed using the procedures outlined in
      the <a href="build.html">Building and Installing the Distribution</a>
      page.  Once installed, the configure and build process automatically
      detects the library and links the library routines required.</p>
    <p>In addition to the symmetric key algorithms, this distribution
      includes support for the Autokey public key algorithms and protocol
      specified in RFC-5906 &quot;Network Time Protocol Version 4: Autokey
      Specification&quot;.  This support is available only if the OpenSSL
      library has been installed and the <tt>--enable-autokey</tt> option is
      used when the distribution is built.</p>
    <p> Public key cryptography is generally considered more secure than
      symmetric key cryptography, since the security is based on private and
      public values which are generated by each participant and where the
      private value is never revealed.  Autokey uses X.509 public
      certificates, which can be produced by commercial services, the
      OpenSSL application program, or
      the <a href="keygen.html"><tt>ntp-keygen</tt></a> utility program in
      the NTP software distribution.</p>
    <p>Note that according to US law, NTP binaries including OpenSSL library
      components, including the OpenSSL library itself, cannot be exported
      outside the US without license from the US Department of Commerce.
      Builders outside the US are advised to obtain the OpenSSL library
      directly from OpenSSL, which is outside the US, and build outside the
      US.</p>
    <p>Authentication is configured separately for each association using
      the <tt>key</tt> or <tt>autokey</tt> option of the <tt>server</tt>
      configuration command, as described in
      the <a href="confopt.html">Server Options</a> page.
      The <a href="keygen.html">ntp-keygen</a> page describes the files
      required for the various authentication schemes.  Further details are
      in the briefings, papers and reports at the NTP project page linked
      from <a href="http://www.ntp.org">www.ntp.org</a>.</p>
    <p>By default, the client sends non-authenticated packets and the server
      responds with non-authenticated packets.  If the client sends
      authenticated packets, the server responds with authenticated packets
      if correct, or a crypto-NAK packet if not.  In the case of unsolicited
      packets which might consume significant resources, such as broadcast
      or symmetric mode packets, authentication is required, unless
      overridden by a <tt>disable auth</tt> command.  In the current climate
      of targeted broadcast or &quot;letterbomb&quot; attacks, defeating
      this requirement would be decidedly dangerous.  In any case,
      the <tt>notrust </tt>flag, described on
      the <a href="authopt.html">Access Control Options</a> page, can be
      used to disable access to all but correctly authenticated clients.</p>
    <h4 id="symm">Symmetric Key Cryptography</h4>
    <p>The original NTPv3 specification (RFC-1305), as well as the current
      NTPv4 specification (RFC-5905), allows any one of possibly 65,535
      message digest keys (excluding zero), each distinguished by a 32-bit
      key ID, to authenticate an association.  The servers and clients
      involved must agree on the key ID, key type and key to authenticate
      NTP packets.</p>
    <p>The message digest is a cryptographic hash computed by an algorithm
      such as MD5, SHA, or AES-128 CMAC.  When authentication is specified,
      a message authentication code (MAC) is appended to the NTP packet
      header.  The MAC consists of a 32-bit key identifier (key ID) followed
      by a 128- or 160-bit message digest.  The algorithm computes the
      digest as the hash of a 128- or 160- bit message digest key
      concatenated with the NTP packet header fields with the exception of
      the MAC.  On transmit, the message digest is computed and inserted in
      the MAC.  On receive, the message digest is computed and compared with
      the MAC.  The packet is accepted only if the two MACs are identical.
      If a discrepancy is found by the client, the client ignores the
      packet, but raises an alarm.  If this happens at the server, the
      server returns a special message called a <em>crypto-NAK</em>.  Since
      the crypto-NAK is protected by the loopback test, an intruder cannot
      disrupt the protocol by sending a bogus crypto-NAK.</p>
    <p>Keys and related information are specified in a keys file, which must
      be distributed and stored using secure means beyond the scope of the
      NTP protocol itself.  Besides the keys used for ordinary NTP
      associations, additional keys can be used as passwords for
      the <tt><a href="ntpq.html">ntpq</a></tt>
      and <tt><a href="ntpdc.html">ntpdc</a></tt> utility programs.
      Ordinarily, the <tt>ntp.keys</tt> file is generated by
      the <tt><a href="keygen.html">ntp-keygen</a></tt> program, but it can
      be constructed and edited using an ordinary text editor.</p>
    <p> Each line of the keys file consists of three or four fields: a
      key ID in the range 1 to 65,535, inclusive, a key type, a
      message digest key consisting of a printable ASCII string up to
      20 characters or a hex digit string with more than 20
      characters, and an optional comma-separated list of IPs that are
      allowed to serve time.  If the OpenSSL library is installed, the
      key type can be any message digest algorithm supported by the
      library.  If the OpenSSL library is not installed, the only
      permitted key type is MD5.</p>
    <table>
      <caption style="caption-side: bottom;">
	Figure 1. Typical Symmetric Key File
      </caption>
      <tr><td style="border: 1px solid black; border-spacing: 0;">
	  <pre style="color:grey;">
	    # ntpkey_MD5key_bk.ntp.org.3595864945
	    # Thu Dec 12 19:22:25 2013

	    1  MD5 L";Nw&lt;`.I&lt;f4U0)247"i  # MD5 key
	    2  MD5 &amp;&gt;l0%XXK9O'51VwV&lt;xq~  # MD5 key
	    3  MD5 lb4zLW~d^!K:]RsD'qb6  # MD5 key
	    4  MD5 Yue:tL[+vR)M`n~bY,'?  # MD5 key
	    5  MD5 B;fxlKgr/&amp;4ZTbL6=RxA  # MD5 key
	    6  MD5 4eYwa`o}3i@@V@..R9!l  # MD5 key
	    7  MD5 `A.([h+;wTQ|xfi%Sn_!  # MD5 key
	    8  MD5 45:V,r4]l6y^JH6"Sh?F  # MD5 key
	    9  MD5 3-5vcn*6l29DS?Xdsg)*  # MD5 key
	    10 MD5 2late4Me              # MD5 key
	    11 SHA1 a27872d3030a9025b8446c751b4551a7629af65c  # SHA1 key
	    12 SHA1 21bc3b4865dbb9e920902abdccb3e04ff97a5e74  # SHA1 key
	    13 SHA1 2b7736fe24fef5ba85ae11594132ab5d6f6daba9  # SHA1 key
	    14 SHA  a5332809c8878dd3a5b918819108a111509aeceb  # SHA  key
	    15 MD2  2fe16c88c760ff2f16d4267e36c1aa6c926e6964  # MD2  key
	    16 MD4  b2691811dc19cfc0e2f9bcacd74213f29812183d  # MD4  key
	    17 MD5  e4d6735b8bdad58ec5ffcb087300a17f7fef1f7c  # MD5  key
	    18 MDC2 a8d5e2315c025bf3a79174c87fbd10477de2eabc  # MDC2 key
	    19 RIPEMD160 77ca332cafb30e3cafb174dcd5b80ded7ba9b3d2  # RIPEMD160 key
	    20 AES128CMAC f92ff73eee86c1e7dc638d6489a04e4e555af878  # AES128CMAC key
	    21 MD5 sampo 10.1.2.3/24
    </pre></td></tr></table>
    <p>Figure 1 shows a typical symmetric keys file used by the reference
      implementation when the OpenSSL library is installed.  Each line of
      the file contains three or four fields.  The first field is an integer
      between 1 and 65535, inclusive, representing the key identifier.  The
      second field is the digest algorithm, which in the absence of the
      OpenSSL library must be <tt>MD5</tt>, which designates the MD5 message
      digest algorithm.  The third field is the key.  The optional fourth
      field is one or more comma-separated IPs.  An IP may end with an
      optional <tt>/subnetbits</tt> suffix, which limits the acceptance of
      the key identifier to packets claiming to be from the described IP
      space.  In this example, for the key IDs in the range 1-10 the key is
      interpreted as a printable ASCII string.  For the key IDs in the range
      11-20, the key is a 40-character hex digit string.  In either case,
      the key is truncated or zero-filled internally to either 128 or 160
      bits, depending on the key type.  The line can be edited later or new
      lines can be added to change any field.  The key can be changed to a
      password, such as <tt>2late4Me</tt> for key ID 10.  Note that two or
      more keys files can be combined in any order as long as the key IDs
      are distinct.</p>
    <p>When <tt>ntpd</tt> is started, it reads the keys file specified by
      the <tt>keys</tt> command and installs the keys in the key cache.
      However, individual keys must be activated with
      the <tt>trustedkey</tt> configuration command before use.  This
      allows, for instance, the installation of possibly several batches of
      keys and then activating a key remotely using <tt>ntpq</tt>
      or <tt>ntpdc</tt>.  The <tt>requestkey</tt> command selects the key ID
      used as the password for the <tt>ntpdc</tt> utility, while
      the <tt>controlkey</tt> command selects the key ID used as the
      password for the <tt>ntpq</tt> utility.</p>
    <h4 id="windows">Microsoft Windows Authentication</h4>
    <p>In addition to the above means, <tt>ntpd</tt> now supports Microsoft
      Windows MS-SNTP authentication using Active Directory services.  This
      support was contributed by the Samba Team and is still in development.
      It is enabled using the <tt>mssntp</tt> flag of the <tt>restrict</tt>
      command described on the <a href="accopt.html#restrict">Access Control
      Options</a> page.  <span class="style1">Note: Potential users should
      be aware that these services involve a TCP connection to another
      process that could potentially block, denying services to other users.
      Therefore, this flag should be used only for a dedicated server with
      no clients other than MS-SNTP.</span></p>
    <h4 id="pub">Public Key Cryptography</h4>
    <p>See the <a href="autokey.html">Autokey Public-Key Authentication</a>
      page.</p>
    <hr>
    <script type="text/javascript" language="javascript" src="scripts/footer.txt"></script>
  </body>
</html>
