A Security Analysis of Network Time Protocol Andy Hospodor COEN /03/03 Paper by Matt Bishop, 1991

Sequence NTP Architecture Overview of Security features Types of attacks on NTP Countermeasures Further reading

Where does time come from? Originally from the motion of the earth around the sun Today, NIST operates atomic clocks and masers that generate time More recently, USNO –is responsible for distribution of time in the US –is the standard for time in the US –

NTP Architecture Primary servers are synchronized by radio or atomic clocks Secondary servers exist at multiple strata on fixed route paths Secondary servers measure path delay to n-1 strata periodically Clients sample multiple secondary time servers Clock filters select best from a window of eight time offset samples Combining algorithm computes weighted average of time offsets. top level stratum level 2 stratum level 3 stratum 1212 Primary Servers Secondary Servers 11 hydrogen masers50 HP-5071 cesiums

NTP Packet Format StratPollLIModeVN NTP v3 and v4 Root Delay Root Dispersion Reference Identifier Reference Timestamp (64) Originate Timestamp (64) Receive Timestamp (64) Transmit Timestamp (64) Message Hash (64 or 128) NTP Protocol Header Format (32 bits) LIleap warning indicator VNversion number (4) Stratstratum (0-15) Pollpoll interval (log2) Precprecision (log2) Seconds (32)Fraction (32) NTP Timestamp Format (64 bits) Value is in seconds and fraction since 0 h 1 January 1900 Authenticator uses DES-CBC or MD5 cryptosum of NTP header plus extension fields (NTPv4) Key/Algorithm Identifier Cryptosum Authenticator (Optional) Extension Field 1 (optional) Extension Field 2… (optional) NTP v4 only Prec Extension Field (padded to 32-bit boundary) Field LengthField Type NTPv4 Extension Field Last field padded to 64-bit boundary authentication only

Security Features Sanity checks –Is the packet correct and reasonable? Access Control –Can the host change the clock? Authentication –Is the message from a trusted source? Redundant Time Sources –Is one of the secondary servers getting weird?

Types of attacks on NTP Masquerade Attack –Impersonate a time server Modification Attack –Intercept and modify messages from time server Replay Attack –Resend messages from a time server Denial of Service Attack –Intercept and delete messages from a time server Delay Attack –Delay the time messages, typically by flooding

Countermeasures Masquerade Attack Modification Attack Replay Attack Denial of Service Attack Delay Attack Sanity checks Access Control Authentication Redundant Time Sources

NTP Shortcomings Susceptible to Combined attacks –Deny service except for one source –Delay packets from that source –Allow client clocks to drift 64 bit DES encryption is broken Keys authenticated per host, not per path Does not deal with “wiretapping” Cooperation amongst gov’t agencies?

Further reading Network Time Protocol (NTP) v3 and v4: David L. Mills: FTP server ftp.udel.edu ( pub/ntp directory)ftp.udel.edu Related project descriptions and briefings – US Naval Ovservatory – the US time standard

Time Trivia Sidereal time is the hour angle of the vernal equinox, the ascending node of the ecliptic on the celestial equator. The daily motion of this point provides a measure of the rotation of the Earth with respect to the stars, rather than the Sun. Local mean sidereal time is computed from the current Greenwich Mean Sideral Time plus an input offset in longitude (converted to a sidereal offset by the ratio of the mean solar day to the mean sidereal day.) Applying the equation of equinoxes, or nutation of the mean pole of the Earth from mean to true position, yields local apparent sidereal time. Astronomers use local sidereal time because it corresponds to the coordinate right ascension of a celestial body that is presently on the local meridian. Leap Second is a second added to Coordinated Universal Time (UTC) to make it agree with astronomical time to within 0.9 second. UTC is an atomic time scale, based on the performance of atomic clocks. Astronomical time is based on the rotational rate of the Earth. Since atomic clocks are more stable than the rate at which the Earth rotates, leap seconds are needed to keep the two time scales in agreement.secondCoordinated Universal Time (UTC)atomic time scaleatomic clocks The first leap second was added on June 30, 1972, and so far, leap seconds have occurred at an average rate of about 8 every 10 years. So far, all leap seconds have been added on either June 30th or December 31st. Although it is possible to have a negative leap second (a second removed from UTC), so far, all leap seconds have been positive (a second has been added to UTC). Based on what we know about the Earth's rotation, it is unlikely that we will ever have a negative leap second. For more information and a table of leap seconds, visit the NIST Time Scale Data Archive.NIST Time Scale Data Archive