NTP security vulnerability because not using authentication by default

Bug #1039420 reported by Alba Nader
This bug affects 10 people
Affects Status Importance Assigned to Milestone
ntp (Ubuntu)

Bug Description

Ubuntu implements so much security one way or another. So much defenses against network level man in the middle or malicious proxies or wifi hotspots. Cryptographic verification generally works well but there is one big drawback: it requires correct date/time.

NTP in Ubuntu does not use any authentication by default, although it is supported by NTP.

I conclude, that almost no one is using authenticated NTP, because there are no instructions in a forum or blog how to enable NTP authentication. Therefore almost everyone uses standard configuration and is at risk.

An adversary can tamper with the unauthenticated NTP replies and put the users time several years back, especially, but not limited, if the bios battery or hardware clock is defect. That issue becomes more relevant with new devices like RP, which do not even have a hardware clock.

Putting the clock several years back allows an adversary to use already revoked, broken, expired certificates; replay old, broken, outdated, known vulnerable updates etc.

Revision history for this message
Alba Nader (sharepass12) wrote :

No need to keep this private. Has been publicly discussed but without proper bug report and the discussion felt into oblivion.


visibility: private → public
Revision history for this message
Tyler Hicks (tyhicks) wrote :

After reading the thread on ubuntu-hardened and doing some research of my own, a lack of instructions does not seem to be the primary problem here. It sounds like an external infrastructure problem since the public NTP pool does not guarantee that their servers support NTP authentication.

I'm marking this bug as confirmed with an importance of wishlist. If anyone has suggestions on working around the lack of NTP authentication support across the entire public NTP pool, please leave a comment. Thanks!

Changed in ntp (Ubuntu):
importance: Undecided → Wishlist
status: New → Confirmed
Revision history for this message
Alba Nader (sharepass12) wrote :

I have some ideas ideas...

There is already ntp.ubuntu.com, can you add authentication?

Ubuntu has importance. Can you officially ask the NTP pool if they could add authentication?

Can you publicly the problem somewhere? A blog post?

I am sure some NTP server volunteers would like to add authentication, if you can provide clear instructions for them.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

NTP authentication only works if the MITM doesn't know the authentication key. Even if we enable authentication on ntp.ubuntu.com, you can still MITM the ntp update since presumably everybody would be using the same authentication key.

The only way to fix this is to configure your own ntp server and use it with a key that only you know.

Revision history for this message
Alba Nader (sharepass12) wrote :

NTP has public and private keys. http://doc.ntp.org/4.1.0/genkeys.htm Just like SSL, gpg, etc.

Of course ntp.ubuntu.com and other server owners keep their private key secure.

Revision history for this message
iGadget (igadget) wrote :

So, any updates on this issue now that it has become clear it can be severely abused?


At least crank up the importance a bit...

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Unfortunately, ntp autokey is broken and insecure, it can't be used to provide any additional security.


The only solution for the moment is for system administrators to set up their own symmetric keys with their own ntp server.

Revision history for this message
Hanno Böck (hanno-hboeck) wrote :

Has Ubuntu considered using tlsdate instead of ntp? I think it's the only working secure solution right now.

Revision history for this message
Sami Farin (safarigo) wrote :

Authenticated Network Time Synchronization
Benjamin Dowling and Douglas Stebila and Greg Zaverucha

Some silly MUSTs, like RSA >= 2048 bits..
And instead of e.g. AES-CBC+HMAC-SHA why not NORX or something simple
or chacha20-poly1305.. and of course
...well Microsoft can use 4096 bit RSA for all I care, but does someone want to start a "Simple ANTP" project?

Revision history for this message
Greg Zaverucha (grxg) wrote :

In response to Sami's comments on ANTP:

The MUST is that if you use RSA, the key length is >= 2048 bits. The protocol supports any public key encryption scheme, and ECDH is listed as an option as well. Similarly, AES-CBC+HMAC-SHA is one possible authenticated encryption scheme. The others you mention would work just fine as well.

Changing the crypto algorithms wouldn't make the protocol much simpler, IMO. If you have suggestions for simplifications (while preserving ANTP's security) I'd like to hear them. Simplicity was one of our design goals, and when compared to the other options referenced in the paper, I think we succeeded.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.