The IETF (Internet Engineering Task Force), which is responsible for developing internet protocols and architecture, the formation of RFC for the NTS (Network Time Security) protocol and published the related specification under the identifier . The RFC has received the status of 'Proposed Standard', after which work will begin to elevate the RFC to Draft Standard status, effectively meaning the full stabilization of the protocol and consideration of all expressed comments.
The standardization of NTS is an important step toward enhancing the security of precise time synchronization services and protecting users from attacks that mimic the NTP server to which the client connects. Malicious manipulation involving incorrect time settings can be used to compromise the security of other time-sensitive protocols, such as TLS. For example, altering time could lead to incorrect interpretation of data regarding TLS certificate actions. Until now, NTP and symmetric encryption of communication channels did not guarantee that the client interacts with the intended rather than a spoofed NTP server, and key-based authentication has not gained traction due to its complexity in setup.
NTS utilizes elements of public key infrastructure (PKI) and allows the use of TLS and AEAD (Authenticated Encryption with Associated Data) for cryptographic protection of client-server interactions over the NTP (Network Time Protocol). NTS comprises two separate protocols: NTS-KE (NTS Key Establishment for handling initial authentication and key agreement over TLS) and NTS-EF (NTS Extension Fields, responsible for encryption and authentication of the time synchronization session). NTS adds several extended fields to NTP packets and maintains all state information only on the client side, using a cookie transmission mechanism. A network port 4460 has been allocated for handling connections via the NTS protocol.
The first implementations of the standardized NTS were proposed in the recently published releases of and . is an independent implementation of the NTP client and server, used for synchronizing accurate time across various Linux distributions, including Fedora, Ubuntu, SUSE/openSUSE, and RHEL/CentOS. under the guidance of Eric Raymond and is a fork of the reference implementation of the NTPv4 protocol (NTP Classic 4.3.34), focused on refactoring the codebase to improve security (outdated code has been cleaned, attack prevention methods are employed, and secure functions for handling memory and strings have been implemented).
Source: opennet.ru
