Subject: [ntpwg] [ntp:hackers] Autokey Identity Scheme Selection

From: Helen.Y.Chen at motorola.com (Chen Helen-A12587)
Date: Thu, 26 Apr 2007 15:52:21 -0400

Dave,

Another question to add:
>From what I understand, the group parameters are distributed by the TA
(or stratum 1 server, if this is the TA as well) to both the servers AND
the clients in the group. My impresssion is that the clients are sent
the group parameters EXCLUDING the group key. Is this true? If this is
true, is it possible for an intermediate server to distribute the
non-group key parametrs to the clients? Is it possible for the
intermediate server to separate out the group key from the other
parameters, in order to send the correct parameters to the client?

Thanks,
Helen

-----Original Message-----
From: Chen Helen-A12587 
Sent: Thursday, April 26, 2007 12:49 PM
To: 'David L. Mills'
Cc: Steve Kostecke
Subject: RE: [ntp:hackers] Autokey Identity Scheme Selection

Dave,

Are your statements applicable to the IFF scheme as well? In other
words, can the certificate for the IFF scheme be generated by the NTP
tools on the stratum 1 server (at the top of the certificate trail)?

Is changing the group parameters for the scheme something done outside
of the protocol, where someone would have to re-generate the parameters
again and restart the protocol by restarting the ntpd?

Thanks,
Helen 

-----Original Message-----
From: David L. Mills [mailto:mills at udel.edu]
Sent: Thursday, April 26, 2007 12:27 PM
To: Chen Helen-A12587
Cc: Steve Kostecke
Subject: Re: [ntp:hackers] Autokey Identity Scheme Selection

Helen,

Ordinarily the certificate is generated by the NTP tools. In principle,
the certificate could be generated by some other entity using the
OpenSSL library or another library.

The parameters for generating the public/private key pairs must be the
same for all servers and clients, but could in principle be other than
those assumed by default.

The reference implementation includes a utility supporting all modes
specified in stime.pdf.

Dave

Chen Helen-A12587 wrote:

> Steve, Dave,
> 
> 1) Stime.pdf states that IFF scheme should be used when the 
> certificate is generated by a commercial service. What if the 
> certificate is NOT generated by a commercial service, e.g. if it's 
> generated by the root time server? Would it still be OK to use the IFF

> scheme? Should the GQ scheme be used instead (as suggested in
> stime.pdf) when the parameters are generated by the ntp routines 
> included in the reference implementation?
> 
> 2) Is the changing of the group parameters a matter of local policy? 
> Is this done (1) automatically by the software or (2) manually by 
> executing ntp-keygen again, and restarting the ntpd?
> 
> 3) I assume that the reference implementation provides a different 
> 'ntpkey' routine for each of the identity schemes it supports. Is this

> true?
> 
> Thanks,
> Helen
> 
> -----Original Message-----
> From: Steve Kostecke [mailto:steve at kostecke.net] On Behalf Of Steve 
> Kostecke
> Sent: Friday, September 29, 2006 8:25 AM
> To: Chen Helen-A12587
> Subject: Re: [ntp:hackers] Autokey Identity Scheme Selection
> 
> "Chen Helen-A12587" said:
> 
> 
>>The documentation in ntp.isc.org mentions that the reference 
>>implementation includes 3 identity schemes (IFF, GQ and MV). How does 
>>one configure the client and server to use a particular identity
> 
> scheme?
> 
> You activate Identity Schemes by placing the Identity Scheme 
> "Parameters" in the ntpkeys directories on all members of the NTP 
> Trust Group. This is in addition to the other configuration steps 
> outlined in http://ntp.isc.org/Support/ConfiguringAutokey
> 
> You first set-up autokey on the Trust Group server as outlined in 
> http://ntp.isc.org/bin/view/Support/ConfiguringAutokey#Section_6.6.1.
> 
> When you set-up the Trust Group server you generate the "Parameters" 
> for the Identity Scheme(s) you wish to use in that Trust Group. The 
> server loads all of the Identity Scheme "Parameters" located in the 
> ntpkeys directory and activates those Identity Schemes.
> 
> Then you set-up autokey on the Trust Group Clients as outlined in 
> http://ntp.isc.org/bin/view/Support/ConfiguringAutokey#Section_6.6.2.
> 
> Part of the Trust Group client set-up process involves acquiring the 
> Group/Client Keys for as outlined in 
>
http://ntp.isc.org/bin/view/Support/ConfiguringAutokey#Section_6.6.2.4.
> 
> The Trust Group clients will attempt to use the Identity Scheme 
> "Parameters" found in their ntpkeys directories.
> 
> It is generally recommended that you start with IFF.
> 
> --
> Steve Kostecke <kostecke at ntp.isc.org>
> NTP Public Services Project http://ntp.isc.org/ Public Key at 
> http://ntp.isc.org/Users/SteveKostecke

---

From: mills at udel.edu (David L. Mills)
Date: Fri, 27 Apr 2007 02:40:39 +0000

Helen,

Depends upon the scheme. See 
http://www.eecis.udel.edu/~mills/ident.html. The intent is that the 
servers and clients get their keys from the TA via a secure web page, 
however that is done.

Dave

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ntp.isc.org/pipermail/ntpwg/attachments/20070427/e13a9ca7/attachment.html

---

From: kostecke at ntp.isc.org (Steve Kostecke)
Date: Thu, 26 Apr 2007 22:51:50 -0400

"David L. Mills" said:

>Chen Helen-A12587 wrote:
>
>> Is it possible for the intermediate server to separate out the
>> group key from the other parameters, in order to send the correct
>> parameters to the client?
>

Back in 2004 I wrote an IFF Client Key request page which is located at
https://ntp.isc.org/crypto.php You can use it to retrieve a working IFF
Client Key for the time server at ntp2.isc.org.

-- 
Steve Kostecke <kostecke at ntp.isc.org>
NTP Public Services Project http://ntp.isc.org/
Public Key at http://ntp.isc.org/Users/SteveKostecke