Time Risk

System time is a root-of-trust dependency. Authentication windows, certificate validity, distributed databases, failover decisions, transaction ordering, log correlation, and regulatory audit trails all depend on clocks remaining accurate and on the time source being identifiable.

Clock failure is rarely isolated to a clock. A sufficient offset can invalidate certificates, break Kerberos and replay-prevention windows, alter event ordering, or make records from different systems impossible to reconcile. For regulated systems, unexplained timestamp drift also weakens the evidential value of the audit trail.

Unauthenticated NTP

Traditional NTP was designed for a cooperative network. It does not authenticate the server or the time packets it receives. Off-path attackers can attempt spoofing or exploit rate-limiting behaviour to isolate a client from its configured sources. On-path attackers can delay, substitute, or gradually alter responses. Open pool selection also introduces servers operated by parties the organisation has not identified or contracted with.

The operational problem is detection. Gradual drift and loss of synchronisation can resemble ordinary network failure or oscillator error. Systems may continue producing internally plausible timestamps while no longer sharing a trustworthy timeline.

What NTS changes

Network Time Security, RFC 8915, authenticates key establishment over TLS and protects subsequent NTP packets with session-derived keys. It materially improves on unauthenticated NTP by detecting altered or substituted packets and binding them to an authenticated session.

NTS does not by itself decide which organisation should be trusted as the time authority. That still depends on how the endpoint is discovered, which certificate authorities the client accepts, who operates the service, where it is governed, and what happens when the external network or upstream reference is unavailable.

CNX Precision Time uses a private trust anchor dedicated to the service rather than the operating system's general public CA bundle. Clients use a defined CNX endpoint and trust chain, reducing reliance on unrelated public certificate authorities and open NTP pool selection.

Jurisdiction and accountability

Anonymous public time services have no customer contract, audit right, service level, or accountable supplier relationship. Their infrastructure may be operated outside Cambodia and subject to foreign legal process. An organisation relying on that service cannot demonstrate who was responsible for its time reference or obtain evidence about service operation during a disputed interval.

CNX provides an identifiable Cambodian operator, documented service architecture, contractual service levels for subscribed services, and a defined chain from the physical time source to delivery. The Compliance page maps these controls to the relevant audit-trail and third-party-service requirements.

Resilience and holdover

A remote time service depends on the path to that service and on its own upstream references. CNX's Stratum-1 infrastructure uses GNSS receivers disciplined by in-country Rubidium atomic oscillators. Atomic holdover allows the service to maintain a stable reference during external-signal or international-connectivity disruption rather than immediately falling back to an ordinary server oscillator.

NTS is used where authenticated packet delivery is required. PTP is used where hardware timestamping and sub-microsecond precision are required. The TSA addresses a separate requirement: independently attesting that specific data existed at a particular time.

Choosing the service

• Directly connected Exchange routers can use the member NTP service over the IPv6 peering network.
• Servers and logging infrastructure use contracted NTS when authenticated millisecond-level synchronisation is required.
• Switches, payment systems, and hypervisor clusters use PTP when the application requires hardware-assisted precision.
• Documents, logs, backups, and release artifacts use TSA when independent proof of existence is required.