TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Network Time Synchronization & Debugging Tools

6 posts · Mar 2014 – Jul 2023

What this trail covers

Cloudflare is actively involved in securing Network Time Protocol (NTP) through the development and promotion of Network Time Security (NTS). This includes operating a time service that supports NTS on its officially assigned port (4460), contributing to the standardization process, releasing source code for specialized servers, and working with implementers to resolve bugs. The goal is to improve the security of time synchronization, which is foundational for other security protocols like TLS. This post details the launch of time.cloudflare.com, a free time service that supports both NTP and NTS, addressing vulnerabilities in NTP that allow for time manipulation and denial of service attacks, even from off-path attackers. The service provides secure time synchronization from Cloudflare's global datacenters.

All Cloudflare trails
  1. The day my ping took countermeasuresThis post details the author's investigation into 'ping' utility's 'taking countermeasures' message, triggered by a system clock rollback before NTP synchronization. It explains how 'ping' handles negative RTT measurements by resetting them to 0ms. The post also explores the challenges of tracing time-related system calls (gettimeofday) due to the use of VDSO, and demonstrates how to overcome this by using LD_PRELOAD to force fallback to slower syscalls. Finally, it showcases how strace's fault injection feature can be used to reliably trigger the 'taking countermeasures' message by manipulating the gettimeofday return value.
  2. NTS is now an RFCThis post announces that Network Time Security (NTS) has officially become RFC 8915. Cloudflare has updated its time service to use the officially assigned port of 4460 for NTS key exchange. It highlights the availability of NTS support in chrony and ntpsec, the security implications of not using NTS, and Cloudflare's contributions to NTS development, including specialized server code, standardization participation, and bug hunting. It also draws parallels to the adoption of TLS 1.3 and SSH to encourage NTS adoption.
  3. Announcing cfnts: Cloudflare's implementation of NTS in RustCloudflare has open-sourced its Rust implementation of Network Time Security (NTS), named cfnts. The post details the NTS protocol's two sub-protocols (NTS-KE and NTPv4), the use of cookies for scalability, and the cryptographic extensions used in NTPv4 packets for security. It explains the choice of Rust for its memory safety, non-nullability, thread safety, immutability, and error handling, and the decision to use Mio and Rustls for dependencies. The implementation strategy involved offloading clock adjustment to chrony and focusing on the new protocols. The post also highlights participation in IETF hackathons for interoperability testing.
  4. Introducing time.cloudflare.comThis post introduces time.cloudflare.com, a free time service supporting NTP and NTS. It details vulnerabilities in the core NTP protocol, including time shifting and denial of service attacks exploitable by off-path attackers via IP fragmentation. It also discusses the historical context of NTP, its security limitations, and the evolution towards cryptographically authenticated NTP with NTS. The service aims to provide secure time synchronization from Cloudflare's global datacenters.
  5. Roughtime: Securing Time with Digital SignaturesThis post introduces and details Cloudflare's deployment of the Roughtime protocol, a new authenticated time service. It explains the protocol's mechanics, including nonces, digital signatures, delegation, Merkle trees for batching, and UDP transport. It highlights the problem of clock skew in TLS certificate validation and the security vulnerabilities of unauthenticated NTP. Cloudflare's motivation for deploying Roughtime is to improve the validity of TLS artifacts and contribute to a more robust Roughtime ecosystem by providing an independent server.
  7. It's Go Time on LinuxThis post details how Go programs on Linux leverage the vDSO mechanism for efficient time retrieval via clock_gettime, significantly improving performance compared to traditional system calls. It analyzes the evolution of timekeeping system calls (time, gettimeofday, clock_gettime) and benchmarks the performance gains of using vDSO for time.Now and gettimeofday.