# Meta open sources NTS implementation and launches authenticated time service

> **Key takeaway:** Meta has open-sourced its Network Time Security (NTS) implementation and launched a public, authenticated time service at nts.meta.com.

**Published:** 2026-10-06T16:00:06+00:00 
**Source:** Meta Engineering & Open Source 
**Category:** bigtech-foss 
**Canonical URL:** https://fosswire.org/news/meta-open-sources-nts-implementation-and-launches-authentica.html 

## Summary
Meta has released its NTS (RFC 8915) implementation, including the protocol, server, and client, via its Time library on GitHub. The company has also launched a public time service at nts.meta.com to provide verifiable time, addressing security vulnerabilities inherent in unauthenticated NTP. The implementation uses a stateless cookie mechanism to ensure scalability without requiring per-client state replication.

## Technical details of Meta's NTS deployment
- **Two-phase process**: Uses TLS 1.3 over TCP/4460 for Key Establishment (NTS-KE) and standard NTPv4 over UDP/123 for authenticated time exchange.
- **Stateless design**: Servers do not store per-client state; instead, they use cookies containing session keys sealed with AES-SIV, derived from a shared master secret and the current day.
- **AEAD support**: Negotiates algorithms including **AES-SIV-CMAC-256** (mandatory per RFC 8915), **AES-SIV-CMAC-512**, and **AES-128-GCM-SIV**.
- **Security improvements**: Protects against forged packets and replay attacks by using unique identifiers and encrypted cookies within the response authenticator.

## Why it matters
By providing a verifiable time source, Meta aims to secure critical security decisions like TLS certificate validation and token expiry, which rely on accurate local clocks.