A Security Analysis of

Network Time Protocol

Andy Hospodor

COEN 317

11/03/03

Paper by Matt Bishop, 1991

Sequence

• NTP Architecture

• Overview of Security features

• Types of attacks on NTP

• Countermeasures

• Further reading

Where does time come from?

• Originally from the motion of the earth around the sun

• Today, NIST operates atomic clocks and masers that generate time

• More recently, USNO – is responsible for distribution of time in the US– is the standard for time in the US– www.time.gov

NTP Architecture

• Primary servers are synchronized by radio or atomic clocks• Secondary servers exist at multiple strata on fixed route paths• Secondary servers measure path delay to n-1 strata periodically • Clients sample multiple secondary time servers• Clock filters select best from a window of eight time offset samples• Combining algorithm computes weighted average of time offsets.

top level stratum

level 2 stratum

level 3 stratum

1 2 1 2

Primary Servers

Secondary

Servers

11 hydrogen masers 50 HP-5071 cesiums

NTP Packet FormatStrat PollLI ModeVN

NTP v3 and v4

Root DelayRoot Dispersion

Reference Identifier

Reference Timestamp (64)

Originate Timestamp (64)

Receive Timestamp (64)

Transmit Timestamp (64)

Message Hash (64 or 128)

NTP Protocol Header Format (32 bits) LI leap warning indicator VN version number (4) Strat stratum (0-15) Poll poll interval (log2) Prec precision (log2)

Seconds (32) Fraction (32)

NTP Timestamp Format (64 bits)

Value is in seconds and fractionsince 0h 1 January 1900

Authenticator uses DES-CBC or MD5 cryptosumof NTP header plus extension fields (NTPv4)

Key/Algorithm Identifier

Cryptosum

Authenticator(Optional)

Extension Field 1 (optional)

Extension Field 2… (optional)

NTP v4 only

Prec

Extension Field(padded to 32-bit boundary)

Field Length Field Type

NTPv4 Extension Field

Last field padded to 64-bit boundary

authentication only

Security Features

• Sanity checks– Is the packet correct and reasonable?

• Access Control– Can the host change the clock?

• Authentication – Is the message from a trusted source?

• Redundant Time Sources– Is one of the secondary servers getting weird?

Types of attacks on NTP

• Masquerade Attack– Impersonate a time server

• Modification Attack– Intercept and modify messages from time server

• Replay Attack– Resend messages from a time server

• Denial of Service Attack– Intercept and delete messages from a time server

• Delay Attack– Delay the time messages, typically by flooding

Countermeasures

Masquerade Attack

Modification Attack

Replay Attack

Denial of Service Attack

Delay Attack

Sanity checks

Access Control

Authentication

RedundantTime Sources

NTP Shortcomings

• Susceptible to Combined attacks– Deny service except for one source– Delay packets from that source– Allow client clocks to drift

• 64 bit DES encryption is broken• Keys authenticated per host, not per path• Does not deal with “wiretapping”• Cooperation amongst gov’t agencies?

Further reading

• Network Time Protocol (NTP) v3 and v4: http://www.ntp.org/

• David L. Mills: http://www.eecis.udel.edu/~mills• FTP server ftp.udel.edu (pub/ntp directory)• Related project descriptions and briefings

– http://www.eecis.udel.edu/~mills/status.htm

• US Naval Ovservatory – the US time standard http://tycho.usno.navy.mil/mc_to.html

Time Trivia

Sidereal time is the hour angle of the vernal equinox, the ascending node of the ecliptic on the celestial equator. The daily motion of this point provides a measure of the rotation of the Earth with respect to the stars, rather than the Sun. Local mean sidereal time is computed from the current Greenwich Mean Sideral Time plus an input offset in longitude (converted to a sidereal offset by the ratio 1.00273790935 of the mean solar day to the mean sidereal day.) Applying the equation of equinoxes, or nutation of the mean pole of the Earth from mean to true position, yields local apparent sidereal time. Astronomers use local sidereal time because it corresponds to the coordinate right ascension of a celestial body that is presently on the local meridian.

Leap Second is a second added to Coordinated Universal Time (UTC) to make it agree with astronomical time to within 0.9 second. UTC is an atomic time scale, based on the performance of atomic clocks. Astronomical time is based on the rotational rate of the Earth. Since atomic clocks are more stable than the rate at which the Earth rotates, leap seconds are needed to keep the two time scales in agreement.

The first leap second was added on June 30, 1972, and so far, leap seconds have occurred at an average rate of about 8 every 10 years. So far, all leap seconds have been added on either June 30th or December 31st. Although it is possible to have a negative leap second (a second removed from UTC), so far, all leap seconds have been positive (a second has been added to UTC). Based on what we know about the Earth's rotation, it is unlikely that we will ever have a negative leap second. For more information and a table of leap seconds, visit the NIST Time Scale Data Archive.