Meta が検証可能なタイムサービス用 NTS を発表

Each server derives the sealing key from a shared master secret and the current day: key = HKDF-SHA256(master, salt = BE32(day), info = “fbnts-cookie-seal-v1”)

NTS support exists where you would expect it in the server world – chrony and ntpsec implement it.

Server-side, the public NTS list today runs to a few dozen entries, mostly national metrology institutes and internet infrastructure operators such as PTB, Netnod, and time.nl.

Each row’s session keys came out of its own TLS handshake and work only for that association.

Precision without authenticity only gets you a very accurate number from an unknown source. Now it can be both.

Cloudflare had launched time.cloudflare.com with NTS 15 months earlier, in June 2019, against the then-current draft, and showed it works at scale.

every one of them is trusting an unauthenticated UDP packet.

CLen 68 is the cookie: 36 bytes of envelope around the two 16-byte keys inside.

That indirection is why we use pool rather than server. A single server line gives you one association and one responder, which is a single point of failure – and NTP is a protocol that wants several sources so it can outvote a bad one. pool asks for maxsources independent assoc…

One line of chrony config: pool nts.meta.com nts iburst maxsources 5

Type 30 is the negotiated AEAD, AES-128-GCM-SIV, with KLen 128 bits of session key — chrony lists it first and client preference wins.

RFC 8915, Network Time Security for the Network Time Protocol, was published on the IETF Standards Track as a Proposed Standard in September 2020.

Phase 2 – Authenticated NTP: Standard NTPv4 over UDP/123 to the advertised server, with NTS extension fields.

Android’s platform time sync is plain SNTP over UDP/123 – a fixed 48-byte packet with no extension-field handling, alongside NITZ and GNSS – so there is no NTS path in it.

NTS works in phases, and separating them is what makes it deployable. Phase 1 – Key Establishment (NTS-KE): TLS 1.3 over TCP/4460, negotiated with ALPN ntske/1.

chrony runs perfectly well on Android

We’ve open sourced everything, including the protocol, server, client through Meta’s Time library on GitHub.

The key that seals them into a cookie is the shared one – the epoch day number from the derivation above, identical on every responder we run, stamped inside each cookie and never visible to the client.

Meta’s public time service now speaks NTS (Network Time Security, RFC 8915) at nts.meta.com.

We’ve previously written about building a more accurate time service at Meta scale – migrating from ntpd to chrony, going from 10 milliseconds to 100 microseconds, and opening time.meta.com to everyone.