Show simple item record

dc.contributor.authorMalhotra, Aanchalen_US
dc.contributor.authorGundy, Matthew Vanen_US
dc.contributor.authorVaria, Mayanken_US
dc.contributor.authorKennedy, Haydnen_US
dc.contributor.authorGardner, Jonathanen_US
dc.contributor.authorGoldberg, Sharonen_US
dc.contributor.editorKiayias, Aggelosen_US
dc.date.accessioned2018-05-29T19:55:32Z
dc.date.available2018-05-29T19:55:32Z
dc.date.issued2017
dc.identifierhttps://doi.org/10.1007/978-3-319-70972-7
dc.identifier.citationMalhotra A., Van Gundy M., Varia M., Kennedy H., Gardner J., Goldberg S. (2017) The Security of NTP’s Datagram Protocol. In: Kiayias A. (eds) Financial Cryptography and Data Security. FC 2017. Lecture Notes in Computer Science, vol 10322. Springer, Cham. DOI https://doi.org/10.1007/978-3-319-70972-7_23
dc.identifier.urihttps://hdl.handle.net/2144/29024
dc.description.abstractFor decades, the Network Time Protocol (NTP) has been used to synchronize computer clocks over untrusted network paths. This work takes a new look at the security of NTP’s datagram protocol. We argue that NTP’s datagram protocol in RFC5905 is both underspecified and flawed. The NTP specifications do not sufficiently respect (1) the conflicting security requirements of different NTP modes, and (2) the mechanism NTP uses to prevent off-path attacks. A further problem is that (3) NTP’s control-query interface reveals sensitive information that can be exploited in off-path attacks. We exploit these problems in several attacks that remote attackers can use to maliciously alter a target’s time. We use network scans to find millions of IPs that are vulnerable to our attacks. Finally, we move beyond identifying attacks by developing a cryptographic model and using it to prove the security of a new backwards-compatible client/server protocol for NTP.en_US
dc.description.urihttps://eprint.iacr.org/2016/1006.pdf
dc.description.urihttps://eprint.iacr.org/2016/1006.pdf
dc.format.extentp. 405 - 423en_US
dc.publisherSpringeren_US
dc.relation.ispartofFinancial Cryptography
dc.subjectNetwork Time Protocolen_US
dc.subjectRFC5905en_US
dc.titleThe security of NTP's datagram protocolen_US
dc.typeConference materialsen_US
dc.description.versionPublished versionen_US
pubs.elements-sourcedblpen_US
pubs.notesEmbargo: Not knownen_US
pubs.organisational-groupBoston Universityen_US
pubs.organisational-groupBoston University, College of Arts & Sciencesen_US
pubs.organisational-groupBoston University, College of Arts & Sciences, Department of Computer Scienceen_US


This item appears in the following Collection(s)

Show simple item record