← Wednesday, October 7, 2026Cloud & infraDeep dive

Meta’s NTS time service authenticates packets without per-client server state

engineering.fb.com 11 min read Editor score 7/10

Meta’s public time service uses NTS, with stateless servers and cookie keys derived rather than stored or replicated; the implementation is open source. The design is a useful example of adding authenticated time while limiting server-side state.

What

Meta's public time service uses Network Time Security to authenticate packets, and its servers hold no per-client state.

How

NTS-KE uses TLS 1.3 over TCP/4460 for client and server to agree on an AEAD algorithm; cookie keys are derived, not stored or replicated.

Why it matters

Authenticated time helps protect certificate validation, token expiry, replay windows, and log ordering from incorrect or modified time.

Read on engineering.fb.com →

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.