Network Time Protocol

Not to be confused with Daytime Protocol or Time Protocol.

Network Time Protocol (NTP) is a networking protocol for clock synchronization between computer systems over packet-switched, variable-latency data networks. In operation since before 1985, NTP is one of the oldest Internet protocols in current use. NTP was originally designed by David L. Mills of the University of Delaware, who still oversees its development.

NTP is intended to synchronize all participating computers to within a few milliseconds of Coordinated Universal Time (UTC).[1]:3 It uses a modified version of Marzullo's algorithm to select accurate time servers and is designed to mitigate the effects of variable network latency. NTP can usually maintain time to within tens of milliseconds over the public Internet, and can achieve better than one millisecond accuracy in local area networks under ideal conditions. Asymmetric routes and network congestion can cause errors of 100 ms or more.[2][3]

The protocol is usually described in terms of a client-server model, but can as easily be used in peer-to-peer relationships where both peers consider the other to be a potential time source.[1]:20 Implementations send and receive timestamps using the User Datagram Protocol (UDP) on port number 123.[4][5] They can also use broadcasting or multicasting, where clients passively listen to time updates after an initial round-trip calibrating exchange.[3] NTP supplies a warning of any impending leap second adjustment, but no information about local time zones or daylight saving time is transmitted.[2][3]

The current protocol is version 4 (NTPv4), which is a proposed standard as documented in RFC 5905. It is backward compatible with version 3, specified in RFC 1305.

History

NTP was originally designed by David L. Mills who still oversees its development.

In 1979, network time synchronization technology was used in what was possibly the first public demonstration of Internet services running over a trans-Atlantic satellite network, at the National Computer Conference in New York. The technology was later described in the 1981 Internet Engineering Note (IEN) 173 and a public protocol was developed from it that was documented in RFC 778. The technology was first deployed in a local network as part of the Hello routing protocol and implemented in the Fuzzball, an experimental operating system used in network prototyping, where it ran for many years.

Other related network tools were available both then and now. They include the Daytime and Time protocols for recording the time of events, as well as the ICMP Timestamp and IP Timestamp option (RFC 781). More complete synchronization systems, although lacking NTP's data analysis and clock disciplining algorithms, include the Unix daemon timed, which uses an election algorithm to appoint a server for all the clients; and the Digital Time Synchronization Service (DTSS), which uses a hierarchy of servers similar to the NTP stratum model.

In 1985, NTPv0 was implemented in both Fuzzball and Unix, and the NTP packet header and round-trip delay and offset calculations, which have persisted into NTPv4, were documented in RFC 958. Despite the relatively slow computers and networks available at the time, accuracy of better than 100 milliseconds was usually obtained on Atlantic spanning links, with accuracy of tens of milliseconds on Ethernet networks.

In 1988, a much more complete specification of the NTPv1 protocol, with associated algorithms, was published in RFC 1059. It drew on the experimental results and clock filter algorithm documented in RFC 956 and was the first version to describe the client-server and peer-to-peer modes. In 1991, the NTPv1 architecture, protocol and algorithms were brought to the attention of a wider engineering audience with the publication of an article by David L. Mills in the IEEE Transactions on Communications.

In 1989, RFC 1119 was published defining NTPv2 by means of a state machine, with pseudocode to describe its operation. It introduced a management protocol and cryptographic authentication scheme which have both survived into NTPv4. The design of NTP was criticized for lacking formal correctness principles by the DTSS community. Their alternative design included Marzullo's algorithm, a modified version of which was promptly added to NTP. The bulk of the algorithms from this era have also largely survived into NTPv4.

In 1992, RFC 1305 defined NTPv3. The RFC included an analysis of all sources of error, from the reference clock down to the final client, which enabled the calculation of a metric that helps choose the best server where several candidates appear to disagree. Broadcast mode was introduced.

In subsequent years, as new features were added and algorithm improvements were made, it became apparent that a new protocol version was required.[6] In 2010, RFC 5905 was published containing a proposed specification for NTPv4, but the protocol has significantly moved on since then, and as of 2014, an updated RFC has yet to be published.[7] Following the retirement of Mills from the University of Delaware, the reference implementation is currently maintained as an open source project led by Harlan Stenn.[8][9]

Clock strata

The U.S. Naval Observatory Alternate Master Clock at Schriever AFB (Colorado) is a stratum 0 source for NTP
Yellow arrows indicate a direct connection; red arrows indicate a network connection.

NTP uses a hierarchical, semi-layered system of time sources. Each level of this hierarchy is termed a "stratum" and is assigned a number starting with zero at the top. A server synchronized to a stratum n server will be running at stratum n + 1. The number represents the distance from the reference clock and is used to prevent cyclical dependencies in the hierarchy. Stratum is not always an indication of quality or reliability; it is common to find stratum 3 time sources that are higher quality than other stratum 2 time sources. Telecommunication systems use a different definition for clock strata. A brief description of strata 0, 1, 2 and 3 is provided below.

Stratum 0
These are high-precision timekeeping devices such as atomic (cesium, rubidium) clocks, GPS clocks or other radio clocks. They generate a very accurate pulse per second signal that triggers an interrupt and timestamp on a connected computer. Stratum 0 devices are also known as reference clocks.
Stratum 1
These are computers whose system clocks are synchronized to within a few microseconds of their attached stratum 0 devices. Stratum 1 servers may peer with other stratum 1 servers for sanity checking and backup.[10] They are also referred to as primary time servers.[2][3]
Stratum 2
These are computers that are synchronized over a network to stratum 1 servers. Often a stratum 2 computer will query several stratum 1 servers. Stratum 2 computers may also peer with other stratum 2 computers to provide more stable and robust time for all devices in the peer group.
Stratum 3
These are computers that are synchronized to stratum 2 servers. They employ the same algorithms for peering and data sampling as stratum 2, and can themselves act as servers for stratum 4 computers, and so on.

The upper limit for stratum is 15; stratum 16 is used to indicate that a device is unsynchronized. The NTP algorithms on each computer interact to construct a Bellman-Ford shortest-path spanning tree, to minimize the accumulated round-trip delay to the stratum 1 servers for all the clients.[1]:20

Timestamps

The 64-bit timestamps used by NTP consist of a 32-bit part for seconds and a 32-bit part for fractional second, giving a time scale that rolls over every 232 seconds (136 years) and a theoretical resolution of 2−32 seconds (233 picoseconds). NTP uses an epoch of January 1, 1900 so the first roll over will be in 2036.[11]

Future versions of NTP may extend the time representation to 128 bits: 64 bits for the second and 64 bits for the fractional-second. The current NTPv4 format has support for Era Number and Era Offset, that when used properly should aid fixing date rollover issues. According to Mills, "the 64 bit value for the fraction is enough to resolve the amount of time it takes a photon to pass an electron at the speed of light. The 64 bit second value is enough to provide unambiguous time representation until the universe goes dim."[12][note 1]

Clock synchronization algorithm

Round-trip delay time δ

A typical NTP client will regularly poll three or more servers on diverse networks. To synchronize its clock, the client must compute their time offset and round-trip delay. Time offset θ is defined by

\theta = {(t_1 - t_0) + (t_2 - t_3 ) \over 2},

and the round-trip delay δ by

\delta = {(t_3 - t_0 ) - ( t_2- t_1 )},

where

t0 is the client's timestamp of the request packet transmission,
t1 is the server's timestamp of the request packet reception,
t2 is the server's timestamp of the response packet transmission and
t3 is the client's timestamp of the response packet reception.[1]:19

The values for θ and δ are passed through filters and subjected to statistical analysis. Outliers are discarded and an estimate of time offset is derived from the best three remaining candidates. The clock frequency is then adjusted to reduce the offset gradually, creating a feedback loop.[1]:20

The synchronization is correct when both the incoming and outgoing routes between the client and the server have symmetrical nominal delay. If the routes do not have a common nominal delay, there will be a systematic bias of half the difference between the forward and backward travel times.[13]

Software implementations

The NTP management protocol utility ntpq being used to query the state of a stratum 2 server.

Reference implementation

The NTP reference implementation, along with the protocol, has been continuously developed for over 20 years. Backwards compatibility has been maintained as new features have been added. It contains several sensitive algorithms, especially to discipline the clock, that can misbehave when synchronized to servers that use different algorithms. The software has been ported to almost every computing platform, including personal computers.[1]:13 It runs as a daemon called ntpd under Unix or as a service under Windows.[1]:15 Reference clocks are supported and their offsets are filtered and analysed in the same way as remote servers, although they are usually polled more frequently.[1]:19

SNTP

A less complex implementation of NTP, using the same protocol but without requiring the storage of state over extended periods of time,[14] is known as the Simple Network Time Protocol (SNTP). It is used in some embedded devices and in applications where high accuracy timing is not required.[15][16]

Windows Time service

All Microsoft Windows versions since Windows 2000 include the Windows Time service ("W32Time"),[17] which has the ability to synchronize the computer clock to an NTP server.

The W32Time service was originally implemented for the purpose of the Kerberos version 5 authentication protocol, which required time to be within 5 minutes of the correct value to prevent replay attacks. The version in Windows 2000 and Windows XP only implements Simple NTP, and violates several aspects of the NTP version 3 standard.[18] Beginning with Windows Server 2003 and Windows Vista, a compliant implementation of full NTP is included.[19] Microsoft says that the W32Time service cannot reliably maintain sync time to the range of 1 to 2 seconds.[20] If higher accuracy is desired, Microsoft recommends using a different NTP implementation.[21]

Ntimed

A new NTP client, ntimed, was started by Poul-Henning Kamp in 2014.[22] The new implementation is sponsored by the Linux Foundation as a replacement for the reference implementation, as it was determined to be easier to write a new implementation from scratch than to fix the existing issues with the large existing code base. As of June 2015, no official release was done yet, but ntimed can synchronize clocks reliably.[23] ntimed works under Debian GNU/Linux and FreeBSD, but remains to be ported to Windows and Mac OS.[24]

Leap seconds

On the day of a leap second event, ntpd receives notification from either a configuration file, an attached reference clock, or a remote server. Because of the requirement that time must appear to be monotonically increasing, a leap second is inserted with the sequence 23:59:59, 23:59:60, 00:00:00. Although the clock is actually halted during the event, any processes that query the system time cause it to increase by a tiny amount, preserving the order of events. If it should ever become necessary, a leap second would be deleted with the sequence 23:59:58, 00:00:00, skipping 23:59:59.[25]

Security concerns

Several security concerns arose in late 2014. Previously, researchers became aware that NTP servers can be susceptible to man-in-the-middle attacks unless packets are cryptographically signed for authentication.[26] The computational overhead involved can make this impractical on busy servers, particularly during denial of service attacks.[27] NTP message spoofing can be used to move clocks on client computers and allow a number of attacks based on bypassing of cryptographic key expiration.[28] Some of the services impacted by fake NTP messages identified are TLS, DNSSEC, various caching schemes (such as DNS cache), BGP, Bitcoin and a number of persistent login schemes.[29][30]

Only a few other security problems have been identified in the reference implementation of the NTP codebase in its 25+ year history, but the ones that have appeared recently are cause for significant concern.[31][32] The protocol has been undergoing revision and review over its entire history. As of January 2011, there are no security revisions in the NTP specification and no reports at CERT.[33] The current codebase for the reference implementation has been undergoing security audits from several sources for several years now, and there are no known high-risk vulnerabilities in the current released software.[34]

Several NTP server misuse and abuse practices exist which cause damage or degradation to a Network Time Protocol (NTP) server.

NTP has been used in distributed denial of service (DDoS) attacks.[35][36] A small query is sent to an NTP server with the return address spoofed to be the target address. Similar to the DNS amplification attack, the server responds with a much larger reply that allows an attacker to substantially increase the amount of data being sent to the target. To avoid participating in an attack, servers can be configured to ignore external queries, or they can be upgraded to version 4.2.7p26 or later.[37]

A Stack-Based Buffer Overflow exploit was discovered and a patch is available as of December 19, 2014. This includes all NTP Version 4 releases before version 4.2.8.[38] Apple was concerned enough that it used its auto-update capability for the first time,[39] though only for recent versions of OS X. In the case of version 10.6.8 there are manual fixes for the server version, and normal "client" users can just turn off automatic time updating in System Preferences for Date & Time.[40] Researchers believe that the protocol design is excellent and that the flaws are appearing in implementations of the protocol. Some errors are basic, such as a missing return statement in a routine, that can lead to unlimited access to systems that are running some versions of NTP in the root daemon. Systems that do not use the root daemon, such as BSD, are not subject to this flaw.[41]

See also

Notes

  1. ↑ 2−64 seconds is about 54 zeptoseconds (light would travel 16.26 picometers, or approximately 0.31 × Bohr radius), and 264 seconds is about 585 billion years.

References

  1. 1 2 3 4 5 6 7 8 David L. Mills (12 December 2010). Computer Network Time Synchronization: The Network Time Protocol. Taylor & Francis. pp. 12–. ISBN 978-0-8493-5805-0.
  2. 1 2 3 "Executive Summary: Computer Network Time Synchronization". Retrieved 2011-11-21.
  3. 1 2 3 4 "NTP FAQ". The NTP Project. Retrieved 2011-08-27.
  4. ↑ "Port Numbers". The Internet Assigned Numbers Authority (IANA).
  5. ↑ Page 16
  6. ↑ David L. Mills (15 November 2010). Computer Network Time Synchronization: The Network Time Protocol on Earth and in Space, Second Edition. CRC Press. p. 377. ISBN 978-1-4398-1464-2.
  7. ↑ "Network Time Synchronization Research Project". Retrieved 24 December 2014.
  8. ↑ "NTP Needs Money: Is A Foundation The Answer?". InformationWeek. March 23, 2015. Retrieved April 4, 2015.
  9. ↑ "NTP's Fate Hinges On 'Father Time'". InformationWeek. March 11, 2015. Retrieved April 4, 2015.
  10. ↑ "Network Time Protocol: Best Practices White Paper". Retrieved 15 October 2013.
  11. ↑ W. Richard Stevens; Bill Fenner; Andrew M. Rudoff (2004). UNIX Network Programming. Addison-Wesley Professional. pp. 582–. ISBN 978-0-13-141155-5.
  12. ↑ University of Delaware Digital Systems Seminar presentation by David Mills, 2006-04-26
  13. ↑ Gotoh, T.; Imamura, K.; Kaneko, A. (2002). Improvement of NTP time offset under the asymmetric network with double packets method. Conference on Precision Electromagnetic Measurements. pp. 448–449. doi:10.1109/CPEM.2002.1034915. ISBN 0-7803-7242-5.
  14. ↑ "Network Time Protocol Version 4: Protocol and Algorithms Specification". June 2010. p. 54. Retrieved 2012-08-26. Primary servers and clients complying with a subset of NTP, called the Simple Network Time Protocol (SNTPv4) [...], do not need to implement the mitigation algorithms [...] The fully developed NTPv4 implementation is intended for [...] servers with multiple upstream servers and multiple downstream servers [...] Other than these considerations, NTP and SNTP servers and clients are completely interoperable and can be intermixed [...]
  15. ↑ RFC 4330
  16. ↑ RFC 5905
  17. ↑ "Windows Time Service Technical Reference". technet.microsoft.com. 2011-08-17. Retrieved 2011-09-19.
  18. ↑ "Windows Time Service page at NTP.org". Support.ntp.org. 2008-02-25. Retrieved 2011-01-12.
  19. ↑ "How the Windows Time Service Works". technet.microsoft.com. 2010-03-12. Retrieved 2011-09-19.
  20. ↑ "Support boundary to configure the Windows Time service for high accuracy environments". Microsoft Corporation. 2011-10-19.
  21. ↑ Ned Pyle (2007-10-23). "High Accuracy W32time Requirements". Microsoft Corporation. Retrieved 2012-08-26.
  22. ↑ Poul-Henning, Kamp. "20140926 – Playing with time again". PHK's Bikeshed. Retrieved 4 June 2015.
  23. ↑ Poul-Henning, Kamp. "Network time synchronization software, NTPD replacement.". ntimed git repository README file. Github. Retrieved 4 June 2015.
  24. ↑ Poul-Henning, Kamp (2015-01-11). "20150111 – What happened next?". PHK's Bikeshed. Retrieved 4 June 2015.
  25. ↑ David Mills. "The NTP Timescale and Leap Seconds". Retrieved 15 October 2013.
  26. ↑ "Network Time Protocol Version 4: Autokey Specification". IETF. 2010. Retrieved 2014-10-16.
  27. ↑ "NTP Security Analysis". Retrieved 11 October 2013.
  28. ↑ Jose Selvi (2014-10-16). "Bypassing HTTP Strict Transport Security" (PDF). Retrieved 2014-10-16.
  29. ↑ Aanchal Malhotra, Isaac E. Cohen, Erik Brakke, and Sharon Goldberg (20 October 2015). "Attacking the Network Time Protocol" (PDF). NDSS.
  30. ↑ "Attacking the Network Time Protocol". www.cs.bu.edu. Retrieved 2015-10-27.
  31. ↑ "Security Notice". Support.ntp.org. 2009-12-10. Retrieved 2011-01-12.
  32. ↑ results returned by a search on "Network Time Protocol" at
  33. ↑ in RFC 778, RFC 891, RFC 956, RFC 958, RFC 1305, RFC 5905, and the NTPv4 specification
  34. ↑ "Code Audit". Support.ntp.org. 2009-06-13. Retrieved 2011-01-12.
  35. ↑ Goodin, Dan (2014-01-13). "New DoS attacks taking down game sites deliver crippling 100Gbps floods". Ars Technica. Retrieved 2014-01-25.
  36. ↑ Lee, Dave (2014-02-11). "Huge hack 'ugly sign of future' for internet threats". BBC. Retrieved 2014-02-12.
  37. ↑ "DRDoS / Amplification Attack using ntpdc monlist command". support.ntp.org. 2010-04-24. Retrieved 2014-04-13.
  38. ↑ "Network Time Protocol Vulnerabilities (Update C) | ICS-CERT". Ics-cert.us-cert.gov. Retrieved 2015-04-15.
  39. ↑ Cunningham, Andrew (Dec 23, 2014). "Apple automatically patches Macs to fix severe NTP security flaw". arstechnica. Retrieved Apr 29, 2015.
  40. ↑ "NTP vulnerability on versions prior to 4.2.8 -- we OK?". Apple Support Communities.
  41. ↑ Fairhead, Harry (23 December 2014). "NTP The Latest Open Source Security Problem". I Programmer.

Further reading

External links

This article is issued from Wikipedia - version of the Monday, May 02, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.