NTS Enabled Across Our Entire Pool Secured

Time synchronization is a critical component of any IT infrastructure. Until now, the NTP protocol transmitted time in plaintext and without authentication, exposing systems to potential attacks. With the activation of NTS on our infrastructure, your systems can now cryptographically verify that the time received actually comes from our servers.

Why Enable NTS Now?

NTS (Network Time Security), standardized by RFC 8915 in September 2020, represents a major evolution of the NTP protocol. Here is why now is the time to adopt this technology.

Adoption Is Accelerating

Technical and Operational Benefits

Benefit	Impact
DNSSEC Validation	DNSSEC depends on accurate time to validate signatures. Manipulated time can compromise the entire DNS chain.
TLS/SSL Certificates	Incorrect time can cause acceptance of expired or not-yet-valid certificates, opening the door to attacks.
2FA Authentication (TOTP)	One-time tokens (Google Authenticator, etc.) depend on time synchronized to +/- 30 seconds. Learn more →
Financial Transactions	Trading systems, payments, and auditing require reliable and tamper-proof timestamping.
Logs and Compliance	Compromised time invalidates audit logs, which is problematic for GDPR, PCI-DSS, SOC2.

Security Risks Without NTS

The NTP protocol, designed in the 1980s, includes no native security mechanism. NTP packets travel over UDP without encryption or authentication, exposing systems to several well-documented attack types:

How Does NTS Work?

NTS (Network Time Security) is defined by RFC 8915. The protocol operates in two phases:

1. Establishment Phase (NTS-KE): The client establishes a TLS 1.3 connection with the server on port 4460. They exchange encrypted cookies that will be used to authenticate subsequent NTP exchanges.
2. Synchronization Phase: Standard NTP requests (port 123) now include cryptographic extensions. Each response is authenticated using the cookies negotiated previously.

Our Available NTS Servers

Our entire NTP pool now supports NTS. You can use any of these servers for secure synchronization. All TLDs are valid: .com, .fr, .eu, .net, .org, .be, .biz, .info.

Individual Servers (Stratum 2)

Pool Entries (Load-Balanced)

Configure Your NTS Client

Chrony is the recommended NTP client for using NTS. It is available on most modern Linux distributions and natively supports NTS since version 4.0.

Chrony Configuration with NTS

Edit your /etc/chrony/chrony.conf (or /etc/chrony.conf) file:

# /etc/chrony/chrony.conf - NTS RDEM Systems Configuration

# NTS RDEM Systems servers (secured)
# You can mix TLDs: .com, .fr, .eu, .net, .org, .be, .biz, .info
server ntp-pool.rdem-systems.com iburst nts
server ntp-1.rdem-systems.fr iburst nts
server ntp-2.rdem-systems.eu iburst nts
server ntp-3.rdem-systems.net iburst nts

# Drift file
driftfile /var/lib/chrony/drift

# Allow significant updates at startup
makestep 1.0 3

# Enable real-time clock sync
rtcsync

# Logging
logdir /var/log/chronyCopier

Installation and Restart

# Install Chrony (Debian/Ubuntu)
sudo apt update && sudo apt install chrony

# Or on RHEL/CentOS/Fedora
sudo dnf install chrony

# Restart the service
sudo systemctl restart chronyd

# Check the status
sudo systemctl status chronydCopier

Verify That NTS Is Working

After configuring Chrony with NTS, verify that authentication is working correctly:

chronyc sources Command

sudo chronyc -N sourcesCopier

You should see your sources with the N flag indicating that NTS is active:

MS Name/IP address         Stratum Poll Reach LastRx Last sample
===============================================================================
^* ntp-pool.rdem-systems.c>     2   6   377    23   -145us[ -201us] +/-   12ms
^+ ntp-1.rdem-systems.com       2   6   377    24   +234us[ +178us] +/-   15ms
^+ ntp-2.rdem-systems.com       2   6   377    25   -89us[ -145us] +/-   14ms

Check NTS Status

sudo chronyc -N authdataCopier

This command displays the NTS authentication details for each source:

Name/IP address         Mode KeyID Type KLen Last Atmp  NAK Cook CLen
=========================================================================
ntp-pool.rdem-systems.c> NTS     1   15  256  23m    0    0    8  100
ntp-1.rdem-systems.com   NTS     1   15  256  24m    0    0    8  100
ntp-2.rdem-systems.com   NTS     1   15  256  25m    0    0    8  100

Frequently Asked Questions

Does NTS work with ntpd?

No, the standard ntpd daemon does not support NTS. You must use Chrony (recommended), NTPsec, or ntpd-rs (Rust) to benefit from NTS. Windows W32Time does not support NTS either.

What is the performance impact?

The impact is negligible. The TLS negotiation only occurs at startup and during cookie renewal (approximately every hour). Regular NTP exchanges add only ~100 bytes for authentication.

Can I mix NTS and standard NTP?

Yes, Chrony can simultaneously use NTS sources and standard NTP sources. However, for optimal security, prefer NTS sources.

What happens if NTS fails?

By default, if NTS cannot be established, Chrony will not use the affected source. This is secure behavior: it is better not to synchronize than to synchronize without authentication.

How many NTS servers exist worldwide?

Only 60 to 70 public NTS servers exist globally, including about 45-50 in Europe. The institutional leaders are Netnod (Sweden, 12+ servers), PTB (Germany, 4 servers), and SIDN Labs (Netherlands). France is underrepresented, which motivates our commitment.

Why is there no NTS pool like pool.ntp.org?

The traditional pooling mechanism is incompatible with NTS because each server requires its own TLS certificate. A project funded by ICANN (2025-2027) is working on a solution, but for now, NTS servers must be configured individually.

Which operating systems support NTS by default?

Ubuntu 25.10+ will enable Chrony with NTS by default — a major turning point. RHEL/Fedora and SUSE document NTS configuration. Most modern Linux distributions allow easy NTS activation with Chrony.

Check the NTS compatibility of your server with the tester ntp-tester.eu/nts