Authenticated Network Time Synchronization
summary
A practical authenticated NTP called ANTP replaces per-request public-key work with an infrequent KEM-based exchange and symmetric MACs, implemented in OpenNTPD with OpenSSL and proved secure in a novel model that gives the attacker control of time. Measured throughput drops from ~291k to 175k msg/s (≈1.6× slowdown) and added crypto latency is ~21 μs (≈10 μs extra clock error); AWS tests show network delay dwarfs crypto cost. First-boot PKI remains an open operational issue.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:24Why is it so important to know the time?
- 2:51A Brief History of the Network Time (Protocol)
- 5:09NTP Protocol Design
- 7:20Security Implications
- 7:45Design Goals
- 9:45Utilizing TLS and TLSdate
- 10:51Network Time Security
- 11:42Compare and Contrast
- 12:52Protocol Overview
- 13:29Negotiation Phase
- 14:24Key Exchange Phase
- 15:39Synchronization Phase
- 18:44Security Framework (Cont.)
- 19:34Security Theorem
- 20:36Experiments - Goals
- 20:57Experiments - Overview
- 21:25Experimental Results - Machines at arms width
- 23:52Summary
- 25:28Thank you!
related talks
11mWhat the heck time is it?!?
43mTic-Tac... Bomb! Master time and NTP before it's too late
50mOverTime: Remote Timing Attacks Against IoT Devices
39mNATS-Sync: Secure, Multi-Tenant, Cross Cluster Message Routing
46mBack to the Roots of Single Sign-On: Kerberos
29mRemote Attestation of IoT devices using a discrete TPM 2.0
40mUsing TPMs to Cryptographically Verify Devices at Scale
25mDIY Internet: Snappy, Secure Networking with MinimaLT