ntp-keygen Command for NTPv4

Purpose

Generate public and private keys.

Syntax

ntp-keygen [ -deGHIMPT ][ -b modulus ] [ -c [ RSA-MD2 | RSA-MD5 | RSA-SHA | RSA-SHA1 | RSA-MDC2 | RSA-RIPEMD160 | DSA-SHA | DSA-SHA1 ] [ -C cipher ] [ -i group ] [ -l days ] [ -m modulus ] [ -p passwd ] [ -q passwd ] [ -S [ RSA | DSA ] ] [ -s host ] [ -V nkeys ]

Description

The ntp-keygen command generates cryptographic data files that are used by the Network Time Protocol (NTP) version 4 authentication and identification schemes. It generates message digest keys that are used in symmetric key cryptography.

The ntp-keygen command generates the message digest keys file in a format compatible with NTP version 3 (NTPv3). All other files are in privacy enhanced mail encoded (PEM-encoded) printable ASCII format that enables them to be embedded as Multipurpose Internet Mail Extensions (MIME) attachments in emails to other sites.

To generate message digest keys, the ntp-keygen command creates a file with ten pseudo-random printable ASCII strings compatible with the Message-Digest algorithm 5 (MD5) that is provided in the distribution. If the OpenSSL library is installed, it generates an extra ten hex-encoded random bit strings suitable for the Secure Hash Algorithm 1 (SHA1), AES-128 Cipher-based Message Authentication Code (CMAC), and other message digest algorithms. The file that contains message digest keys must be distributed and stored securely, beyond the scope of NTP. In addition to the keys used for ordinary NTP associations, additional keys can be defined as passwords for the ntpq and ntpdc utility commands.

The remaining generated files are compatible with other OpenSSL applications and Public Key Infrastructure (PKI) resources. The ntp-keygen command generates certificates compatible with current industry practice, although some users find the interpretation of X509v3 extension fields flexible. However, the identity keys are not compatible with anything other than Autokey.

The ntp-keygen command encrypts some files by using a private password. The -p password option specifies the password for the local encrypted files and -q password option specifies the password for encrypted files that are sent to remote sites. If no password is provided, Unix uses the hostname that is returned by the gethostname subroutine, which typically corresponds to the Domain Name System (DNS) name of the host.

The pw option in the crypto configuration command specifies the password to read the files for previously encrypted local files. It must match the local password that is used by the ntp-keygen command. If not specified, the hostname is used. Therefore, if this program generates files without a password, the ntpd command can read them back without a password, but only on the same host.

Each host generates encrypted files for its own use and restricts their usage to that specific host, with few exceptions. The symmetric keys file ntp.keys is commonly installed in /etc directory. Other files and links are installed in the /usr/local/etc directory, which is normally located in a shared filesystem in NFS-mounted networks and cannot be changed by shared clients. The keys directory location can be modified by using the keysdir configuration command. The keysdir command is located in the /etc directory.

This program sends comments and error messages to the stderr error stream and outputs remote files to the stdout output stream. The stderr error stream and stdout output stream allows the comments, error messages, and output files to be piped to other applications or redirected to other files. Generated files and links use names that begin with the string ntpkey and include the file type, generating host, and file stamp. For more information about the cryptographic data files, see the Cryptographic Data Files page.

Running the program

The host key, which must be an RSA type, is used to encrypt the cookie when needed. By default, the host key also functions as the sign key that is used to encrypt signatures. You can assign a different sign key by using the -S option, and it can be either RSA or Digital Signature Algorithm (DSA) type. The default type of the signature message digest is MD5. However, you can specify any combination of the sign key type and message digest that the OpenSSL library supports by using the -c option.

The rules state that cryptographic media must be generated with proven timestamps, which means that the host must be synchronized before the net-keygen command is used. This rule creates a chicken-and-egg problem when starting the host for the first time. Therefore, initially set the host time manually to ensure that the certificate lifetime falls within the current year. Once the host is synchronized to a proventic source, regenerate the certificate.

For more information about trusted groups and identity schemes, see the Autokey Public-Key Authentication page.

Flags

Exit Status

The ntp-keygen command returns the following exit values:

Security

Access Control

You must have root authority to run this command.

Auditing Events

N/A

Examples

An output similar to the following example is displayed:

            Using OpenSSL version 90804f

            Generating RSA keys (512 bits)...

            RSA                                             3 1 2

            Generating new host file and link

            ntpkey_host_aixfvt12->ntpkey_RSAkey_aixfvt12.3444540821

            Using host key as sign key

            Generating certificate RSA-SHA

            X509v3 Basic Constraints: critical,CA:TRUE

            X509v3 Key Usage: digitalSignature,keyCertSign

            Generating new cert file and link

            ntpkey_cert_aixfvt12->ntpkey_RSA-SHAcert_aixfvt12.3444540821

Files