Network Time Security becomes a formal internet standard for secure time

On October 1, 2020, Cloudflare announced that Network Time Security (NTS) has been formally published as a Request for Comments (RFC) by the Internet Engineering Task Force (IETF), the body that develops internet standards. The announcement, written by Cloudflare researcher Watson Ladd, marks an important step in protecting a foundational but often overlooked part of internet security: the clocks inside computers, phones, and servers.

To understand NTS, you first need to know about the Network Time Protocol (NTP), which has been used for decades to let devices synchronize their clocks over the internet. In its original form, NTP sends time information without any encryption or authentication. That means anyone who can intercept network traffic can send fake time responses, quietly shifting a device's clock forward or backward. NTS fixes this by adding two key protections: it encrypts the time data so outsiders cannot read it, and it authenticates the server so the device can be sure the time is coming from a legitimate source and has not been tampered with in transit.

Why does accurate time matter for security? Many modern security mechanisms depend on it. For example, when you visit a secure website using HTTPS, your browser checks the website's digital certificate, which has a validity period. If an attacker shifts your clock back in time, the browser might accept a certificate that has already expired or been revoked. If the clock is shifted forward, the browser might reject a perfectly valid certificate, causing errors or blocking access. DNSSEC, a security extension for the Domain Name System (DNS) that authenticates DNS responses, also relies on time-based signatures. Time manipulation can therefore undermine both encrypted web connections and the integrity of DNS lookups. By protecting the time source, NTS helps keep these other security layers working correctly.

Technically, NTS uses Transport Layer Security (TLS), the same encryption technology that protects HTTPS websites, to establish a secure connection and exchange cryptographic keys with the time server. Once the keys are in place, NTS applies authenticated encryption to the actual NTP packets, preventing both eavesdropping and man-in-the-middle attacks where an attacker sits between the device and the server and alters messages. The new standard is published as RFC 8915. It is designed to work with the connectionless UDP transport that NTP traditionally uses, so it can be deployed without major changes to the underlying internet infrastructure.

Adoption of NTS is growing. Operating system vendors and time server operators are adding support. Cloudflare, for example, operates a public time server at time.cloudflare.com that already supports NTS, allowing users to point their devices to a secure time source. From a privacy perspective, NTS also hides the fact that a particular device is requesting time updates, which could otherwise reveal a device's approximate network location or be used to track its activity over time.

For website owners, businesses, and IT teams, accurate time is a foundational requirement for TLS certificate checks, log correlation, and security event analysis. Pairing secure time with a privacy-first encrypted DNS resolver such as AEU DNS provides defense in depth. The resolver ensures that DNS queries, which are the first step in almost every online activity, are private and cannot be tampered with, while NTS ensures that the clock used to validate security certificates is trustworthy. This layered approach reduces the risk of both time-based and DNS-based attacks without requiring deep technical expertise.