From: Harlan Stenn Our resident cryptographer; now you see him, now you don't. Last update:
- 29-Sep-2009 13:34
+ 16-Oct-2009 15:14
UTC
@@ -59,7 +59,11 @@ UTC
While the algorithms for symmetric key cryptography are included in the NTPv4 software distribution, Autokey cryptography requires the OpenSSL software library to be installed before building the NTP distribution. This library is available from http://www.openssl.org and can be installed using the procedures outlined in the Building and Installing the Distribution page. Once installed, the configure and build process automatically detects the library and links the library routines required.
-Note that according to US law, NTP binaries including OpenSSL library components, nothwithstanding the OpenSSL library itself, cannot be exported outside the US without license from the US Department of Commmerce. Builders outside the US are advised to obtain the OpenSSL library directly from OpenSSL, which is outside the US, and build outside the US.
+Note that according to US law, NTP binaries including OpenSSL library components, + notwithstanding the OpenSSL library itself, cannot be exported outside the + US without license from the US Department of Commerce. Builders outside the + US are advised to obtain the OpenSSL library directly from OpenSSL, which is + outside the US, and build outside the US.
Authentication is configured separately for each association using the key or autokey option of the server configuration command, as described in the Server Options page, and the options described on this page. The ntp-keygen page describes the files required for the various authentication schemes. Further details are in the briefings, papers and reports at the NTP project page linked from www.ntp.org.
@@ -90,7 +94,14 @@ UTCNTP secure groups are used to define cryptographic compartments and security hierarchies. All hosts belonging to a secure group have the same group name but different host names. The string specified in the host option of the crypto command is the name of the host and the name used in the host key, sign key and certificate files. The string specified in the ident option of the crypto comand is the group name of all group hosts and the name used in the identity files. The file naming conventions are described on the ntp-keygen page.
+NTP secure groups are used to define cryptographic compartments and security + hierarchies. All hosts belonging to a secure group have the same group name + but different host names. The string specified in the host option of + the crypto command is the name of the host and the name used in the + host key, sign key and certificate files. The string specified in the ident option + of the crypto command is the group name of all group hosts and the + name used in the identity files. The file naming conventions are described on + the ntp-keygen page.
Each group includes one or more trusted hosts (THs) operating at the root, or lowest stratum in the group. The group name is used in the subject and issuer fields of the TH self-signed trusted certificate for these hosts. The host name is used in the subject and issuer fields of the self-signed certificates for all other hosts.
@@ -102,7 +113,12 @@ UTCAll configurations include a public/private host key pair and matching certificate. Absent an identity scheme, this is a Trusted Certificate (TC) scheme. There are three identity schemes, IFF, GQ and MV described on the Identity Schemes page. With these schemes all servers in the group have encrypted server identity keys, while clients have nonencrypted client identity parameters. The client parameters can be obtained from a trusted agent (TA), usually one of the THs of the lower stratum group. Further information on identity schemes is on the Autokey Identity Schemes page.
-A specific combination of authentication and identity schemes is called a cryptotype, which applies to clients and servers separately. A group can be configured using more than one cryptotype combination, although not all combinations are interoperable. Note however that some cryptotype combinations may successfully interoperate with each other, but may not represent good security practice. The server and client cryptotypes are defined by the the following codes.
+A specific combination of authentication and identity schemes is called a + cryptotype, which applies to clients and servers separately. A group can be + configured using more than one cryptotype combination, although not all combinations + are interoperable. Note however that some cryptotype combinations may successfully + intemperate with each other, but may not represent good security practice. The + server and client cryptotypes are defined by the the following codes.
Autokey has an intimidating number of configuration options, most of which are not necessary in typical scenarios. The simplest scenario consists of a TH where the host name of the TH is also the name of the group. For the simplest identity scheme TC, the TH generates host key and trusted certificate files using the ntp-keygen -T command, while the remaining group hosts use the same command with no options to generate the host key and public certificate files. All hosts use the crypto configuration command with no options. Configuration with passwords is described in the ntp-keygen page. All group hosts are configured as an acyclic tree with root the TH.
-When an identity scheme is included, for example IFF, the TH generates host key, trusted certificate and private server identity ley files using the ntp-keygen -T -I -i group command, where group is the group name. The remaining group hosts use the same command as above. All hosts use the crypto identgroup configuration command.
+When an identity scheme is included, for example IFF, the TH generates host + key, trusted certificate and private server identity key files using the ntp-keygen + -T -I -i group command, where group is the group + name. The remaining group hosts use the same command as above. All hosts + use the crypto ident group configuration command.
-Hosts with no dependent clients can retrieve client parameter files from an archive or web page. The ntp-keygen can export these data using the -e option. Hosts with dependent clients other than the TH must retrieve copies of the server ley files using secure means. The ntp-keygen can export these data using the -q option. In either case the data are installed as a file and then renamed using the name given as the first line in the file, but without the filestamp.
+Hosts with no dependent clients can retrieve client parameter files from an + archive or web page. The ntp-keygen can export these data using the -e option. + Hosts with dependent clients other than the TH must retrieve copies of the server + key files using secure means. The ntp-keygen can export these data + using the -q option. In either case the data are installed as a file + and then renamed using the name given as the first line in the file, but without + the filestamp.
The first two lines serve the same purpose as the preceeding examples. The third line generats a copy of the private GREEN server file for use on another server in the same group, say YELLOWm but encrypted with the zzz pasword.
+The first two lines serve the same purpose as the preceding examples. The + third line generates a copy of the private GREEN server file for use on another + server in the same group, say YELLOW, but encrypted with the zzz password.
A client of GREEN, for example YELLOW, uses the configuration commands
@@ -265,7 +293,12 @@ UTC
from Pogo, Walt Kelly
A typical NTP monitoring packet
Last update: - 15-Oct-2009 1:09 + 16-Oct-2009 19:51 UTC