Model: MTS200 (1U)
Doc. Ref. no. : m08/om/201
Issue no. : 03
User’s Manual
Page 126 of 195
Page 126 of 195
Autokey involves public and private key in which public key cryptography is based on a private key known
only to creator or trusted server and a public key known to all participants. NTP client can verify the
originator has the private key using the public key and any of several digital signature algorithms.
Autokey subnet includes three main type of NTP devices as follows:
1. Trusted Server/Trusted Authority: This are lowest stratum server in NTP network which can generate
self-certified certificate marked as trusted and group key.
2. Server: This are the secondary NTP servers which do not own trusted certificate but only self
generate certificate which are not trusted marked.
3. Clients: These are normal ntp clients which uses only public keys to authenticate trusted server and
servers.
The group key or public key has to be transferred to other ntp clients and server using secure means only
such as HTTPS, SSH or SCP.
MTS200 is a stratum 1 server so it can act as Trusted Server in ntp network. Also, there are multiple
MTS200 units installed in a network, user can make one unit as Trusted server and others as normal
Server. MTS200 supports two type of Autokey Identity schemes which are PC (Private Certificate)
scheme and IFF (Schnorr) Cryptosystem scheme.
11.3.3.4.2.1 NTP Autokey PC Scheme:
The PC scheme uses a private certificate (X509.3 type certificate) generated by Trusted host as the
group key and is distributed to all ntp group clients by secure means such as HTTPS or SCP. It is owner
or operator responsibility to reveal this group key outside the ntp group. This scheme is cryptographically
strong as long as the private certificate is kept secured. Refer below figure for further understanding of
PC scheme.
Whenever a new private certificate is generated by Trusted host, it is necessary to distribute new key to
all ntp clients for successful associations.
Procedure to Generate NTP Autokey PC Scheme keys in MTS200:
User can generate Autokey for PC and IFF scheme based authentication files in MTS200 using
webserver only. To generate PC schemes keys, user need to go device webserver page Security, in
which NTP Autokey section is provided.
Step 1:
Then, user need to select PC option in field “Identity Scheme” and mark Certificate Type as
“Trusted Server”. Autokey PC scheme need password to be entered to generate
private key and private certificate. User need to remember this password to set in ntp
client ntp.conf file while starting PC scheme based ntp associations between server
and client.
