RFC 7822

Network Time Protocol Version 4 (NTPv4) Extension Fields

📅 published March 2016, from ietf

RFC 7822: Network Time Protocol Version 4 (NTPv4) Extension Fields 🎀

Okay bestie, this is RFC 7822 📜 and the title block gives us the main facts:

Authors: T. Mizrahi (Marvell) and D. Mayer (Network Time Foundation) 👩‍💻
Category: Standards Track ✨
Date: March 2016 📅
ISSN: 2070-1721
Updates: RFC 5905 🔥
Obsoletes: nothing listed

Abstract ✨

NTPv4 has this optional thing called extension fields 🧚 They sit at the end of the NTP header and let you add extra capabilities or info that the standard header doesn't carry, as defined in RFC 5905. This doc updates RFC 5905 to clarify some points about extension fields and how they work with Message Authentication Codes (MACs) 💖

Status of This Memo 📋

This is an Internet Standards Track document.

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). More info on Internet Standards is in Section 2 of RFC 5741.

Info about the current status of this document, any errata, and how to send feedback can be found at http://www.rfc-editor.org/info/rfc7822.

Copyright Notice ⚖️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date. Please read those documents carefully, since they spell out your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as described in the Simplified BSD License.

Table of Contents 🗺️

1. Introduction ....................................................2
2. Conventions Used in This Document ...............................3
   2.1. Terminology ................................................3
   2.2. Terms and Abbreviations ....................................3
3. NTP Extension Fields - RFC 5905 Update ..........................3
4. Security Considerations .........................................6
5. References ......................................................7
   5.1. Normative References .......................................7
   5.2. Informative References .....................................7
Acknowledgments ....................................................8
Authors' Addresses .................................................8

1. Introduction 🦋

Okay so the NTP header is a set of fixed fields, and it can be followed by some optional fields. There are two kinds of optional fields: Message Authentication Codes (MACs), and extension fields as defined in Section 7.5 of [NTPv4] ✨

If a MAC is used, it lives at the end of the packet. It can be 24 octets long, 20 octets long, or a 4-octet crypto-NAK 🔐

NTP extension fields were defined in [NTPv4] as a generic mechanism. It lets people add future extensions and features without changing the NTP header format (Section 16 of [NTPv4]) 🌈

The only extension fields defined so far are the ones used by the Autokey protocol [Autokey] and the Checksum Complement [RFC7821] 💅 An Autokey extension field is always followed by a MAC, and Section 10 of [Autokey] lays out the parsing rules that let a host tell an extension field apart from a MAC. BUT a MAC isn't mandatory after an extension field. A packet can carry one or more extension fields with no MAC at all 🙈 This behavior is specified in Section 7.5 of [NTPv4] and in [Err3627], and this document clarifies it even more.

So this doc updates [NTPv4] (RFC 5905) by clearing up some points about how extension fields get used. It fixes errors that were found in the extension field stuff after [NTPv4] was published. Specifically, it updates Section 7.5 of [NTPv4] to clarify how extension fields and MACs relate, and it defines what a host should do when it receives an unknown extension field 🫶

2. Conventions Used in This Document 💅

2.1. Terminology

Okay, the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this doc get read the way [KEYWORDS] describes 📖

2.2. Terms and Abbreviations

MAC          Message Authentication Code

NTPv4        Network Time Protocol version 4 [NTPv4]

3. NTP Extension Fields - RFC 5905 Update 🌸

This document updates Section 7.5 of [NTPv4] as follows:

OLD:

7.5. NTP Extension Field Format

In NTPv4, one or more extension fields can go after the header and before the MAC, and the MAC is always there whenever an extension field is. Other than defining the field format, this doc doesn't use the field contents. An extension field carries a request or response message in the format shown in Figure 14 🎀

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Field Type           |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
.                                                               .
.                            Value                              .
.                                                               .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Padding (as needed)                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                 Figure 14: Extension Field Format

Every extension field gets zero-padded out to a word (four octets) boundary. The Field Type is specific to the function it serves and isn't explained here. The minimum field length that holds the required fields is four words (16 octets), but a maximum field length is still TBD 🤷‍♀️

The Length field is a 16-bit unsigned integer. It tells you the length of the whole extension field in octets, Padding included.

NEW:

7.5. NTP Extension Field Format

In NTPv4, one or more extension fields can go after the header and before the MAC, but only if a MAC is present 🔑

Apart from defining the field format, this doc still doesn't use the field contents. An extension field carries a request or response message in the format shown in Figure 14.

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|          Field Type           |            Length             |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
.                                                               .
.                            Value                              .
.                                                               .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|                       Padding (as needed)                     |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                 Figure 14: Extension Field Format

All extension fields are zero-padded out to a word (four octets) boundary.

The Field Type, Value, and Padding fields are specific to whatever function they serve and aren't explained here. The Field Type value comes from an IANA registry. Its Length, Value, and Padding values are defined by the document the registry points to. If a host receives an extension field with a Field Type it doesn't recognize, the host SHOULD ignore that extension field, and it MAY drop the packet altogether if policy requires it 🚫

The minimum field length that holds the required fields is four words (16 octets). The maximum field length can't be longer than 65532 octets, because of the maximum size of the Length field 📏

The Length field is a 16-bit unsigned integer that tells you the length of the entire extension field in octets, Padding included.

7.5.1. Extension Fields and MACs

7.5.1.1. Extension Fields in the Presence of a MAC

An extension field can be used in an NTP packet that includes a MAC, for example the one defined in [Autokey] 🔐 A specification that defines a new extension field MUST say whether that field requires a MAC or not. If the extension field requires a MAC, its specification MUST define the algorithm used to create that MAC, plus the length of the resulting MAC. An extension field MAY allow more than one algorithm. If it does, the extension field itself MUST include info about which algorithm got used ✨

7.5.1.2. Multiple Extension Fields with a MAC

If there are multiple extension fields that require a MAC, they MUST all use the same algorithm and MAC length. Extension fields that don't require a MAC can be included alongside extension fields that do 💖

An NTP packet MUST NOT be sent with two or more extension fields that require a MAC using different algorithms 🙅‍♀️

If an NTP packet is received with two or more extension fields that this receiver recognizes, and those fields require a MAC with different algorithms, the packet MUST be discarded. No exceptions, bestie 💀

7.5.1.3. MAC in the Absence of an Extension Field

A MAC MUST NOT be longer than 24 octets if there is no extension field present, unless a longer MAC is agreed upon by both client and server. The client and server can negotiate this behavior using a previous exchange of packets with an extension field that defines the size and algorithm of the MAC transmitted in NTP packets 🤝

7.5.1.4. Extension Fields in the Absence of a MAC

If a MAC is not present, one or more extension fields can be inserted after the header, following these rules:

If the packet includes a single extension field, the length of that extension field MUST be at least 7 words, i.e., at least 28 octets. 🧚
If the packet includes more than one extension field, the length of the last extension field MUST be at least 28 octets. In this case, the length of each of the other extension fields MUST be at least 16 octets. 🍓

4. Security Considerations 🔒✨

Okay bestie, this is the serious part 😤 but it's also kinda iconic. The security considerations of time protocols in general are discussed in [SecTime], and the security considerations of NTP are discussed in [NTPv4]. Go read those for the full tea 🍵

Now, DDoS attacks on NTP servers are when someone floods a server with a high rate of NTP packets 🌊 Malicious usage of extension fields cannot amplify these attacks 🙅‍♀️ and that's because NTP servers ignore unknown extension fields (as discussed in Section 3) and only respond, if needed, with known extension fields. It's giving "don't take the bait" 💅 Extension fields from incoming packets are neither propagated by NTP servers nor included in any response. NTP servers create their own extension fields if needed for a response, so nothing gets passed along 🦋

Here's the main vibe check 👀 A large number of extension fields should be flagged by an NTP server as a potential attack 🚩 Large extension field sizes should also be flagged, unless they are expected to be large. Being big isn't automatically sus, but it's worth a second look 🧐

Middleboxes such as firewalls MUST NOT filter NTP packets based on their extension fields 🛑 Middleboxes should not examine extension fields in the packets at all, since NTP packets may contain new extension fields that the middleboxes have not been updated to recognize. Like, the middlebox is literally always going to be a step behind the new stuff, so don't let it be the bouncer 🙈

5. References 📚

5.1. Normative References 💜

[KEYWORDS]  Bradner, S., "Key words for use in RFCs to Indicate
            Requirement Levels", BCP 14, RFC 2119,
            DOI 10.17487/RFC2119, March 1997,
            <http://www.rfc-editor.org/info/rfc2119>.

[NTPv4]     Mills, D., Martin, J., Ed., Burbank, J., and W. Kasch,
            "Network Time Protocol Version 4: Protocol and Algorithms
            Specification", RFC 5905, DOI 10.17487/RFC5905,
            June 2010, <http://www.rfc-editor.org/info/rfc5905>.

5.2. Informative References 🌸

[Autokey]   Haberman, B., Ed., and D. Mills, "Network Time Protocol
            Version 4: Autokey Specification", RFC 5906,
            DOI 10.17487/RFC5906, June 2010,
            <http://www.rfc-editor.org/info/rfc5906>.

[Err3627]   RFC Errata, Erratum ID 3627, RFC 5905.

[RFC7821]   Mizrahi, T., "UDP Checksum Complement in the Network Time
            Protocol (NTP)", RFC 7821, DOI 10.17487/RFC7821,
            March 2016, <http://www.rfc-editor.org/info/rfc7821>.

[SecTime]   Mizrahi, T., "Security Requirements of Time Protocols in
            Packet Switched Networks", RFC 7384,
            DOI 10.17487/RFC7384, October 2014,
            <http://www.rfc-editor.org/info/rfc7384>.

Acknowledgments 🫶

The authors gratefully acknowledge Dave Mills for his insightful comments. The authors also thank Tim Chown, Sean Turner, Miroslav Lichvar, Suresh Krishnan, and Jari Arkko for their thorough review and helpful comments. Huge thank-yous, the whole squad deserves a gold star ⭐

Authors' Addresses 🧚

Tal Mizrahi
Marvell
6 Hamada St.
Yokneam, 20692
Israel

Email: talmi@marvell.com


Danny Mayer
Network Time Foundation
PO Box 918
Talent, OR  97540
United States

Email: mayer@ntp.org

📦 where this page comes from

ietf: rfc7822 2016-03
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms