Hack the Route Start free Open app Network services
NTS
Authenticating an NTP server over TLS so a spoofed or man-in-the-middle time source is refused.
Plain NTP trusts any reply, so an attacker who answers first, or sits on the path, can move a victim's clock and break certificate checks, Kerberos and log order. Network Time Security (RFC 8915) fixes authenticity: the client first does a TLS handshake to the server on TCP 4460 (NTS key establishment), checking the server's certificate by name against a trusted CA, and is given keys and cookies. Every later time packet on UDP 123 carries a cookie-keyed authentication code, so a reply the real server did not send — from a spoofer or an untrusted certificate — is rejected. It protects the time's authenticity and integrity, not its secrecy.