NTP Security: Authentication and Trusted Time References

NTP (Network Time Protocol) synchronises networks to a single time source using timestamps to represent the current time of the day, this is essential for time sensitive transactions and many system applications such as email.

NTP is therefore vulnerable to security threats, whether from a malicious hacker who wants to alter the timestamp to commit fraud or a DDoS attack (Distributed Denial of Service - normally caused by malicious malware that floods a server with traffic) that blocks server access.

However, being one of the Internet’s oldest protocols and having been developed for over 25 years, NTP is equipped with its own security measures in the form of authentication.

Authentication verifies that each timestamp has come from the intended time reference by analysing a set of agreed encryption keys that are sent along with the time information. NTP, using Message Digest encryption (MD5) to un-encrypt the key, analyses it and confirms whether it has come from the trusted time source by verifying it against a set of trusted keys.

Trusted authentication keys are listed in the NTP server configuration file (ntp.conf) and are normally stored in the ntp.keys file. The key file is normally very large but trusted keys tell the NTP server which set of subset of keys is currently active and which are not. Different subsets can be activated without editing the ntp.keys file using the trusted-keys config command.

Authentication is therefore highly important in protecting a NTP server from malicious attack; however there are many time references were authentication can’t be trusted.

Microsoft, who has installed a version of NTP in their operating systems since Windows 2000, strongly recommends that a hardware source is used as a timing reference as Internet sources can’t be authenticated.

NTP is vital in keeping networks synchronised but equally important is keeping systems secure. Whilst network administrators spend thousands in anti-viral/malware software many fail to spot the vulnerability in their time servers.

Many network administrators still entrust Internet sources for their time reference. Whilst many do provide a good source for UTC time (Coordinated Universal Time - the international standard of time), such as nist.gov, the lack of authentication means the network is open to abuse.

Other sources of UTC time are more secure and can be utilized with relatively low cost equipment. The easiest method is to use a specialist NTP GPS time server that can connect to a GPS antenna and receive an authenticated timestamp by satellite.

GPS time servers can provide accuracy to UTC time to within a few nanoseconds as long as the antenna has a good view of the sky. They are relatively cheap and the signal is authenticated providing a secure time reference.

Alternatively there are several national broadcasts that transmit a time reference. In the UK this is broadcast by the National Physics Laboratory (NPL) in Cumbria. Similar systems operate in Germany, France and the US. Whilst this signal is authenticated, these radio transmissions are vulnerable to interference and have a finite range.

Authentication for NTP has been developed to prevent malicious tampering with system synchronisation just as firewalls have been developed to protect networks from attack but as with any system of security it only works if it is utilised.