Spectracom SecureSync 1200 User Reference Manual page 123

NTP Autokey: IFF Autokey Support
The IFF Autokey Support is demonstrated in the figure below. The IFF identity scheme is used
with Multiple Stratum NTP Time Servers. The example below shows 3 Stratum layers. Stratum 1
NTP Servers are close to the physical time references. All Stratum 1 servers can be Trusted
Hosts. One of them is the trusted route used to generate the IFF Group/Client Key. This defines
the IFF Group.
All other group members generate Group Certificate and RSA public/private keys using MD5
digest. Each group member must share the common IFF Group/Client Key. Stratum 2 NTP serv
ers are also members of the Group. All NTP Stratum 1 servers are Trusted Hosts. The NTP serv
ers closest to the actual time reference (Stratum 1) should be designated trusted. A single
Stratum 1 NTP server generates the IFF Group/Client Keys. There is NO group name feature
supported. The Group can use the same passphrase (password) or different passphrases for
each client.
An NTP Server Group member is configured by enabling Autokey and creating certificate and
public/private key pair while not enabling the Client Only selection. A Client Only NTP server
is configured by enabling Autokey and creating certificate and public/private key pair and
enabling the Client Only selection.
CHAPTER •
2 SecureSync User Reference Guide Rev. 23
Note: Passphrases can be identical for all group members and Client NTP Serv
ers. Or passphrases can be the same for group members and a different pass
phrase shared between the Client Only NTP Servers.
2.15 Configuring NTP
107