RFC 5905 — NTPv4

Q: What does the Introduction section cover in RFC 5905 — NTPv4?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5905 — NTPv4. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Architecture section cover in RFC 5905 — NTPv4?

The Architecture section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5905 — NTPv4. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Protocol Operation section cover in RFC 5905 — NTPv4?

The Protocol Operation section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5905 — NTPv4. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Mechanisms section cover in RFC 5905 — NTPv4?

The Security Mechanisms section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5905 — NTPv4. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 5905 — NTPv4?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 5905 — NTPv4. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

RFC 5905 — NTPv4

Network Time Protocol Version 4 — clock synchronization protocol for distributing accurate time across IP networks, critical for log correlation, certificate validation, Kerberos authentication, and forensic timelines.

Standards Track June 2010 ISO 27001

1. Introduction

▶

NTPv4 synchronizes clocks across networks to within milliseconds of UTC. Accurate time is foundational for security operations — log correlation, certificate validity windows, Kerberos ticket lifetimes, and forensic timeline reconstruction all depend on synchronized clocks.

ISO 27001 Relevance: A.8.17 (Clock Synchronization) — directly mandates clock synchronization for all information processing facilities. A.8.15 (Logging) — accurate timestamps for audit logs. A.5.28 (Collection of Evidence) — precise timestamps for forensic analysis.

2. Architecture

▶

  Stratum 0: Atomic Clocks / GPS / Radio
       │
  Stratum 1: Primary NTP Servers
       │ (e.g., time.nist.gov)
       │
  Stratum 2: Secondary Servers
       │ (e.g., organization NTP pool)
       │
  Stratum 3: Client Devices
       │ (servers, network equipment, endpoints)
       │
  Stratum 4+: Further downstream clients

Each stratum adds a small amount of error. Stratum 15 is the maximum; stratum 16 indicates unsynchronized.

3. Protocol Operation

▶

NTP uses a symmetric exchange of timestamps to calculate clock offset and round-trip delay:

T1: Client sends request timestamp
T2: Server receives request timestamp
T3: Server sends reply timestamp
T4: Client receives reply timestamp

Offset = ((T2-T1) + (T3-T4)) / 2
Delay = (T4-T1) - (T3-T2)

4. Security Mechanisms

▶

NTP authentication mechanisms:

Mechanism	Description	ISO A.8.24
Symmetric Key (MD5/SHA)	Pre-shared key authentication	Basic — acceptable for internal
Autokey (RFC 5906)	Public key authentication	DEPRECATED — known weaknesses
NTS (RFC 8915)	Network Time Security — TLS-based	RECOMMENDED — modern, secure

Security: Unprotected NTP is vulnerable to time-shift attacks. Use NTS (RFC 8915) or at minimum symmetric key authentication.

5. Security Considerations

▶

Time-shift attacks: Manipulating time can expire certificates prematurely, extend Kerberos ticket validity, or corrupt log timelines
Multiple sources: Use at least 4 NTP sources to detect and mitigate a faulty/malicious server
Monitoring: Alert on clock drift exceeding threshold (e.g., >128ms) — A.8.16
Firewall rules: Allow NTP (UDP 123) only to trusted time sources
Leap seconds: Ensure systems handle leap seconds correctly to prevent outages