How to Use Authentication When Synchronising to a NTP Server

Network Time Protocol (NTP) is used to advertise time to network time clients on an IP network. NTP is a UDP based protocol that is used to synchronise system time on network devices. This article describes how to utilise NTP authentication to authenticate a time reference when synchronising network time clients to a NTP server. NTP Server Authentication NTP is used to provide an accurate time reference for time critical processes. Therefore, NTP can pose a security risk if malicious users attempt to modify or replicate a timestamp to create a false time on a network device.

NTP authentication is intended to overcome security risks by ensuring that any response received from an NTP server has actually come from the intended reference. The client sends a request for time to a NTP server. The NTP server responds to the client with a timestamp along with one of a number of agreed encrypted keys. On receipt of the timestamp, the client un-encrypts the key and verifies it against a list of trusted keys. The client can then be sure that the received timestamp was indeed transmitted from the intended NTP server. NTP utilises MD5 encryption (Message Digest Encryption 5), which is a 128-bit cryptographic hash function, which outputs a fingerprint of the key.

MD5 is a highly secure encryption, widely used on forums and by online communities for authentication purposes. NTP Keys NTP keys are codes that are encrypted on both the server and client that are used to identify the NTP server. NTP keys are stored in a file usually called 'ntp.keys'. Each key consists of a key number, an encryption code and the key itself. E.

g. NTP server keys: 1 M secret 5 M SeRvEr 7 M TiMeLy 10 M MYKEY 11 M TroPical 14 M MaGic The key number acts as a reference to the specified key. The encryption code specifies the type of encryption to be utilised, e.g.

'M' for MD5 encryption. The actual keys must be identical on both the client and the NTP server. The client may utilise a sub-set of the keys specified on the NTP Server. The keys are case sensitive.

E.g. client keys: 5 M SeRvEr 7 M TiMeLy 10 M MYKEY 14 M MaGic Trusted Keys Trusted keys are specified in the NTP configuration file, 'ntp.conf'. Trusted keys specify which subset of keys are currently activeand can be used by the NTP server.

This allows a sub-set of trusted keys to be selected from a potentially large keys file. Trusted keys are selected using the 'trusted-keys' configuration command. E.g. trusted-keys 5 7 14 This specifies that keys with the key references of 5, 7 and 14 are currently trusted and can be used by the NTP installation. Summary Essentially, authentication is used by the client to authenticate that the NTP server is who he says he is, and that no rogue server intervenes.

The key is encrypted and sent to the client by the server where it is unencrypted and checked against the client keys to ensure a match.

David Evans develops NTP server time synchronization solutions that ensure accurate time on computers and computer networks. Dave has been heavily involved in the development of dedicated time server systems, NTP synchronized digital clock systems and atomic clock synchronization products. Click here to find out more about NTP Server solutions.


City Planning Made Simpler Perfect City Icons - Whether you are a landscaper or city planner, working or studying architectural design, drawing a city map, or developing construction or engineering software, you need bricks to make a drawing.

A Task Manager for Remote PCs - Remote Process Explorer, a product by LizardSystems, makes it possible to manage remote processes on remote computers without installing anything on them or launching an RDP session.

Unlock iPhone - The logic behind unlocking the iPhone is its cost effectiveness.

Digital Camera Accessories The Top Accessories You Cant Live Without - The anticipation of buying some digital camera accessories is just about as exciting as buying the camera itself.

Why You Will Need a Cell Phone In The Future - Cellular phone companies today offer many different kinds of plans, including several different ones for whole families.