Crate rtime_nts 

Network Time Security (NTS, RFC 8915) for the rTime NTP daemon.

NTS adds authentication and replay protection to NTPv4 without per-packet asymmetric crypto: a TLS 1.3 handshake (NTS-KE) establishes keys and issues opaque cookies, and each subsequent NTP exchange is protected with AEAD (AEAD_AES_SIV_CMAC_256).

Modules

• ke — the NTS-KE (key establishment) record exchange over TLS.
• records — NTS-KE record framing and parsing.
• aead — AEAD encryption/decryption of NTP extension fields.
• cookie — cookie issuance, storage, and rotation.

Protocol constants (algorithm ids, ports, key lengths) and the crate error type NtsError are defined at the crate root.

Modules

aead

AEAD operations for NTS using AES-SIV-CMAC-256 (RFC 8915 Section 5.1).

cookie

NTS cookie generation and validation (RFC 8915 Section 6).

ke

NTS Key Exchange (NTS-KE) protocol (RFC 8915 Section 4).

records

NTS-KE record types (RFC 8915 Section 4).

Enums

NtsError

Constants

AEAD_AES_SIV_CMAC_256

AEAD_AES_SIV_CMAC_256 algorithm identifier (RFC 5116 Section 5.4). This is the mandatory-to-implement AEAD algorithm for NTS (RFC 8915 Section 5.1).

AEAD_AES_SIV_CMAC_256_KEYLEN

Key length in bytes for AEAD_AES_SIV_CMAC_256. The “256” refers to the output tag size; internally it uses two 128-bit subkeys (32 bytes total).

DEFAULT_COOKIE_COUNT

Default number of cookies provided during NTS-KE.

NTS_KE_PORT

NTS-KE TCP port (RFC 8915 Section 4).

NTS_NEXT_PROTOCOL_NTPV4

NTPv4 next protocol identifier for NTS-KE (RFC 8915 Section 4.1.2).

NTS_TLS_EXPORTER_LABEL

TLS exporter label for NTS key derivation (RFC 8915 Section 5.1).