Symmetricom Time Server user manual MD5 Authentication and NTP Broadcast Mode, Introduction to MD5

B

MD5 Authentication and NTP Broadcast Mode

B.1 Introduction to MD5

MD5 is a security protocol that can be used to authenticate NTP client-server communications, ensuring that a received NTP time packet is free from tampering. For example, if the server receives an NTP request packet with the wrong MD5 key (i.e., a key that hasn’t been configured by the user in TimeVault), then the server ignores the request. A similar mechanism exists on the client side. If the client makes a request with a specific key, and the response does not have the same key, then the client assumes the packet can not be trusted and discards it.

Symmetricom’s version of MD5 is compatible with all versions of NTP client software furnished by Dr. David Mills at the University of Delaware. MD5 was drafted into a standard by MIT Laboratory for Computer Science and RSA Security, Inc. MD5 authentication means the information within the NTP packet is guaranteed to be unaltered and from a user having privileged access. Unlike other cryptographic ciphers, MD5 does not hide the data within the packet. The MD5 authenticated NTP packet is still readable. This means MD5 is faster to generate than other cryptographic protocols, and as Dr. Mills notes, there is no reason to hide the actual time from anyone. Further, MD5 does not suffer from any export restrictions. You could think of MD5 as a very sophisticated NTP data checksum that is calculated over the data, socket address, and a private key of an NTP time packet. It is extremely difficult to reverse generate.

The MD5 cryptographic key identifier and cryptographic message digest are appended to the end of a normal NTP packet and the two pieces of information are referred to together as an MD5 signature. The key identifier is the first field in the signature, and it is a 32-bit integer in the range from 1 to 4294967295 (0xFFFFFFFF) – do not use zero as a key identifier. This number specifies an index into a table of many possible MD5 keys.

An MD5 key is an ASCII alpha/numeric character string that is from 1 to 32 characters in length. The key is most secure when all 32 characters are filled with numbers and letters chosen at random. The ASCII key string is combined with the NTP packet data and results in a secure message digest.

6000-100AppB.fm Rev. D TimeVault™ User’s Manual B-99