Topic

NTS

1 post about NTS. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Meta
NTS: Authenticated Time at Meta
Meta launched NTS (RFC 8915) authentication for its public time service at nts.meta.com, enabling clients to verify the origin and integrity of time packets. The service separates key establishment over TLS 1.3 from authenticated NTP, with cookie keys derived daily from a shared secret so servers hold no per-client state. Shortening TLS certificate lifetimes to 100 days in 2027 and 47 days in 2029 makes automated certificate renewal increasingly essential, creating a dangerous circular dependency on an authenticated clock. Meta open-sourced its NTS implementation and encourages mobile OS vendors to add client support, as Android and iOS currently sync time over unauthenticated UDP. The protocol does not prevent delay attacks, and device bootstrapping remains circular since NTS-KE requires TLS validation that itself demands a correct clock.

The best engineering reads, once a week.

Topic

1 post about NTS. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Meta
NTS: Authenticated Time at Meta
Meta launched NTS (RFC 8915) authentication for its public time service at nts.meta.com, enabling clients to verify the origin and integrity of time packets. The service separates key establishment over TLS 1.3 from authenticated NTP, with cookie keys derived daily from a shared secret so servers hold no per-client state. Shortening TLS certificate lifetimes to 100 days in 2027 and 47 days in 2029 makes automated certificate renewal increasingly essential, creating a dangerous circular dependency on an authenticated clock. Meta open-sourced its NTS implementation and encourages mobile OS vendors to add client support, as Android and iOS currently sync time over unauthenticated UDP. The protocol does not prevent delay attacks, and device bootstrapping remains circular since NTS-KE requires TLS validation that itself demands a correct clock.

The best engineering reads, once a week.