Implementing NTP Time Server Authentication

Read More About Computers

The Network Time Protocol (NTP) is an Internet protocol designed to propagate accurate time around a computer network. NTP utilises UDP over TCP/IP to synchronise network time clients to an accurate time reference. This article describes the security aspects of the NTP protocol and specifically using MD5 keys to authenticate a time server.

The Network Time Protocol may be used to synchronise many time critical processes on distributed computers across a network. The NTP protocol is therefore a potential security risk. Hackers or malicious users could attempt to disrupt system synchronisation by attempting to modify or replicate NTP time stamps.

Luckily, NTP has an integral security feature to thwart attempts to tamper with system time synchronisation. NTP can use MD5 encrypted keys to authenticate time stamps received from a time server. Network time clients and devices can utilise secure keys to authenticate time stamps and ensure their source of origin.

NTP implements authentication by utilising an agreed set of keys between a server and client that are encrypted in time stamps. A NTP time server passes a timestamp to a client with one of a selection of keys encrypted and appended to the message. When a timestamp is received by the client, the security key is un-encrypted and checked against the list of stored secure keys. In this manner the client can ensure that the received timestamp originated from the expected time source.

The Network Time Protocol utilises MD5 (Message Digest Encryption 5) encrypted keys. MD5 is a widely used secure encryption algorithm that utilises a 128-bit cryptographic hash function. The algorithm outputs a fingerprint of the supplied key, which is appended to the timestamp.

Linux NTP installations store keys in a file 'ntp.keys'. Every line in the file provides a secure key in the format: 'key-number' 'encryption-code' 'key'. The 'key-number' is a reference to the key. The 'encryption code' describes the encryption algorithm in use, usually 'M' for MD5 encryption. The 'key' field is the agreed key that is to be encrypted by the encryption algorithm. A subset of 'trusted keys' may be specified in the NTP configuration file 'ntp.conf'. This allows a reduced subset of keys to be utilised by the server. Allowing compromised keys to be easily excluded from use. Trusted keys are specified using the 'trusted-keys' command followed by a space-delimited list of key references.

Many CISCO routers utilise secure MD5 authentication in the installed implementation of NTP. To enable a Cisco router to perform MD5 authentication you must follow a number of steps. Firstly, NTP authentication needs to be enabled using the 'ntp authenticate' command. Secondly, define an NTP authentication key using the 'ntp authentication-key' command. A unique reference number identifies each NTP key. The key reference number is supplied as the first paramater to the 'ntp authentication-key' command. Thirdly, use the 'ntp trusted-key' command to tell the router which keys are valid. The command's only argument is the reference number of the key defined in the previous step

The Windows 2000\2003\XP operating systems adopt a SNTP (Simple Network Time Protocol) application for time synchronisation. The implementation used by Microsoft does not include authentication keys.

Essentially, secure key authentication is a method used to erradicate the possibility of the interception of timestamps for malicous purposes. Network time clients can be sure that timestamps have indeed emanated from the expected time reference and have not been intercepted for malicious purposes.

Article Source: http://depositarticles.com/

Dave Evans has provided authoring services to a number of leading companies in the field of computer network timing solutions. Dave specialises in the implementation and configuration of NTP systems and network time synchronisation. Click here for more information on time servers. www.timetools.co.uk/ntp-servers/ntp-s5500.htm

Please Rate this Article

Not yet Rated

Click the XML Icon Above to Receive Computers Articles Via RSS!

Additional Articles From - Home | Computers

Our other websites
All about SEO
Beauty Tips Forum

	Print This Article
	Post Comment
	Add To Favorites
	Email to Friends
	Ezine Ready

Submit Articles
Member Login
Link Us
Submission Guidelines
Ezine Notifications
Article RSS Feeds
Sitemap

New Stuff
About Us
Developer
Good shopping portal
Link to Us
Contact Us
Privacy Policy
Terms of Service