Skip to content

SYSTEM Cited by 1 source

NTS Meta Time Service

Meta's public, authenticated time service — the NTS (Network Time Security, RFC 8915) front end to Meta's existing public NTP service. It is reachable at nts.meta.com (key establishment) which steers clients to time.meta.com (authenticated NTP), is free to use, and is the production deployment of Meta's open-source Time library. It is the authenticity complement to Meta's earlier precision work (ntpd → chrony, 10 ms → 100 µs): "That work made time precise. This work makes it verifiable." (Source: sources/2026-10-06-meta-nts-authenticated-time-at-meta)

Architecture: two tiers that never talk to each other

  • NTS-KE tier (nts.meta.com) — terminates key exchange only. TLS 1.3 over TCP/4460, negotiated with ALPN ntske/1. It agrees an AEAD, derives the directional session keys from the TLS session, issues eight cookies, advertises an NTP responder via a server- negotiation record, and closes. "The host you configure is not the host you end up talking to."
  • Authenticated-NTP tier (time.meta.com) — standard NTPv4 over UDP/123 with NTS extension fields. Opens the client's cookie to recover the session keys, verifies the request authenticator, and replies with fresh cookies encrypted inside the response authenticator.

The two tiers are "different machines in different places, and they never exchange anything." That split is only possible because the cookie seal key is derived identically on every server (see patterns/stateless-token-via-time-derived-key) — no cookie minted by a KE host needs to be shared with the responder host that later opens it. "Adding a server is adding a server."

Statelessness

The servers hold no per-client state: no key ring, no replication, no session table, nothing for an attacker to exhaust (concepts/stateless-compute). Each cookie is sealed with AES-SIV under a key derived as HKDF-SHA256(master, salt = BE32(day), info = "fbnts-cookie-seal-v1"), where day is whole 24-hour periods since the Unix epoch. The integer day is the cookie key ID, travels in the clear, and lets any server open a cookie it has never seen. Meta accepts two days back and one forward to cover skew around a rotation boundary (concepts/key-rotation).

AEAD negotiation

Three AEADs are offered, client preference wins (patterns/protocol-algorithm-negotiation):

ID AEAD Note
15 AES-SIV-CMAC-256 RFC 8915 mandatory-to-implement; the likely default for an unknown client
17 AES-SIV-CMAC-512
30 AES-128-GCM-SIV chrony lists it first; chosen in the sample authdata

Attack resistance

  • No NTS NAK. A forged packet is dropped silently — a failure is indistinguishable from packet loss, so it cannot be used to force a client into a fresh key exchange (concepts/downgrade-attack).
  • Replay-proof. A replayed response carries the wrong unique identifier and matches no outstanding request.
  • Unlinkable. Replacement cookies ride inside the response authenticator, so an observer sees a different opaque blob each exchange and cannot follow a client between networks (concepts/forward-security).
  • Clients spend each cookie once — the client's half of the stateless bargain.

Client configuration

One line of chrony config:

pool nts.meta.com nts iburst maxsources 5

pool (not server) asks for maxsources independent associations so NTP can outvote a bad source; each runs its own KE over its own TLS session and ends with a distinct C2S/S2C key pair. Five sources come up in ~20 minutes as each member completes its own KE in turn. Sample chronyc authdata:

Name/IP     | Mode | KeyID | Type | KLen | Last | Atmp | NAK | Cook | CLen
time1.meta.com | NTS |   5 |  30 |  128 |   27 |    0 |   0 |    8 |   68

Type 30 = AES-128-GCM-SIV; KLen 128-bit session key; CLen 68 = 36-byte envelope around two 16-byte keys; Cook 8 cookies in hand; NAK 0 none rejected.

Known limits (named, not solved)

Delay attacks (shift the clock by ≤ half the induced delay — undetectable), bootstrapping (TLS wants a working clock — circular), wrong-but-authenticated servers (NTS authenticates the path, not the answer), and non-monotonicity (authenticated wall-clock still moves backward at leap seconds). See concepts/authenticated-time for the full framing.

Seen in

Last updated · 854 distilled / 2,448 read