NTS: Authenticated Time at Meta

Meta has added Network Time Security (NTS), standardized in RFC 8915, to its public time service at nts.meta.com and open-sourced its protocol, server, and client through Meta’s Time library. The change addresses a security gap in traditional NTP: devices accept time without authenticating its origin, even though clock readings govern certificate checks, credential expiry, replay protection, and event ordering. As TLS certificates become shorter-lived and renewals increasingly automated, an incorrect clock can cause security failures that go unnoticed or leave devices unable to connect to the services needed to repair them. NTS separates setup from time exchanges: a client establishes keys through TLS 1.3, then uses authenticated NTP packets. Forged responses fail verification, while unique request identifiers help reject replays.

The design lets servers remain stateless. Each cookie contains session keys sealed with a key derived from a shared master secret and the current epoch day, so any responder can validate it without a replicated key ring or client-session database. Meta says this makes it straightforward to add servers and lets one NTS setup direct a client to multiple independent time sources. A chrony configuration using “pool nts.meta.com nts iburst maxsources 5” can establish five authenticated associations. NTS prevents attackers from forging time replies, which could otherwise make expired certificates or credentials valid again, or cause broad failures by pushing clocks forward. It does not prevent delay attacks: an attacker who holds packets can still shift the client’s clock by up to half the imposed delay. Meta encourages maintainers of Android and iOS NTP clients to add NTS support.