Paper 2015/171

Authenticated Network Time Synchronization

Benjamin Dowling, Douglas Stebila, and Greg Zaverucha


The Network Time Protocol (NTP) is used by many network-connected devices to synchronize device time with remote servers. Many security features depend on the device knowing the current time, for example in deciding whether a certificate is still valid. Currently, most services implement NTP without authentication, and the authentication mechanisms available in the standard have not been formally analyzed, require a pre-shared key, or are known to have cryptographic weaknesses. In this paper we present an authenticated version of NTP, called ANTP, to protect against desynchronization attacks. To make ANTP suitable for large-scale deployments, it is designed to minimize server-side public-key operations by infrequently performing a key exchange using public key cryptography, then relying solely on symmetric cryptography for subsequent time synchronization requests; moreover, it does so without requiring server-side per-connection state. Additionally, ANTP ensures that authentication does not degrade accuracy of time synchronization. We measured the performance of ANTP by implementing it in OpenNTPD using OpenSSL. Compared to plain NTP, ANTP’s symmetric crypto reduces the server throughput (connections/second) for time synchronization requests by a factor of only 1.6. We analyzed the security of ANTP using a novel provable security framework that involves adversary control of time, and show that ANTP achieves secure time synchronization under standard cryptographic assumptions; our framework may also be used to analyze other candidates for securing NTP.

Available format(s)
Publication info
Preprint. MINOR revision.
time synchronizationNetwork Time ProtocolNTPprovable securitynetwork security
Contact author(s)
gregz @ microsoft com
2016-04-06: last of 2 revisions
2015-02-27: received
See all versions
Short URL
Creative Commons Attribution


      author = {Benjamin Dowling and Douglas Stebila and Greg Zaverucha},
      title = {Authenticated Network Time Synchronization},
      howpublished = {Cryptology ePrint Archive, Paper 2015/171},
      year = {2015},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.