Add nts.amethyst.name

[NaomiAmethyst]

Adds new public Network Time Security (NTS) server, nts.amethyst.name, to the repository's configuration files and documentation.

This is a stratum 2 time server located in Raleigh, NC (US), operated by me (at AS53546).

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
README.md	Unsupported file format
chrony.conf	Unsupported file format
ntp.toml	Unsupported file format
nts-sources.yml	0% smaller

[jauderho]

NTP support seems available but it is not reachable via NTS.

nts-servers jauderho$ rkik nts.amethyst.name
Server: nts.amethyst.name
IP: 144.86.177.123:123
UTC Time: Tue, 16 Jun 2026 05:59:11 +0000
Local Time: 2026-06-15 22:59:11
Clock Offset: 4.187 ms
Round Trip Delay: 70.369 ms

nts-servers jauderho$ rkik --nts nts.amethyst.name
Error: nts.amethyst.name - nts: NTS time query failed: Operation timed out [timeout]

You should also try to improve accuracy of the server

nts-servers jauderho$ rkik compare nts.amethyst.name time.cloudflare.com
Comparing -  nts.amethyst.name:123 and time.cloudflare.com:123
nts.amethyst.name [144.86.177.123 v4]: 4.301 ms
time.cloudflare.com [162.159.200.123 v4]: 0.927 ms
Max drift: 3.373 ms (min: 0.927, max: 4.301, avg: 2.614)

[NaomiAmethyst]

I dug into this in depth, and the server is reachable over NTS; the timeout is a rkik limitation rather than a server fault.

rkik (via rkik-nts/ntpd-rs) only implements the AES-SIV-CMAC-256 AEAD, whose NTS cookies are 96 bytes. For its NTS query it sends a single fixed ~224-byte request with no NTS Cookie Placeholder extension fields (i.e. no padding), and doesn't retry larger.

chrony's NTS server enforces RFC 8915 anti-amplification: it won't emit a response larger than the request, and silently drops requests too small to cover the cookie-replenishment response. With 96-byte SIV-CMAC cookies that minimum works out to ~524 bytes, so rkik's 224-byte packet is dropped before it's processed.

I forced chrony's client onto the same AEAD rkik uses (ntsaeads 15 = AES-SIV-CMAC-256) and pointed different size requests at the server: 224b silent, 324b silent, 424b silent, 524b server responds.

chrony adaptively pads with Cookie Placeholder EFs until it clears the anti-amplification threshold, then gets answered. rkik sends a fixed 224 byte with zero placeholders and gives up. (rkik authenticates fine against servers like nts.netnod.se whose response fits its small request.)

So the server serves NTS correctly over both AES-SIV-CMAC-256 and AES-128-GCM-SIV. Easy to confirm with chrony:

chronyd -Q 'server nts.amethyst.name iburst nts maxsamples 1'

The rkik behavior is an upstream client issue (it should include Cookie Placeholder EFs / pad its NTS request), and it's probably worth reporting upstream.

On accuracy: the ~4 ms you saw is mostly path asymmetry. On more local paths, I see less deviation:

nts.amethyst.name: avg -0.635 ms (min -29.239 ms, max 27.621 ms) rtt 29.431 ms (100 requests)

time.cloudflare.com: avg -2.339 ms (min -29.830 ms, max 11.323 ms) rtt 22.058 ms (100 requests)
Max avg drift: 1.705 ms

[jauderho]

Thank you for the detailed writeup. I would ask that you please share this detail (as an issue in their repo) with the rkik folks as I agree that it would be a useful enhancement.

I can confirm that chronic correctly sees it.

chronyd -Q 'server nts.amethyst.name iburst nts maxsamples 1'

2026-06-20T19:10:02Z chronyd version 4.6.1 starting (+CMDMON +NTP +REFCLOCK +RTC +PRIVDROP +SCFILTER +SIGND +ASYNCDNS +NTS +SECHASH +IPV6 -DEBUG)
2026-06-20T19:10:02Z Disabled control of system clock
2026-06-20T19:10:04Z System clock wrong by 0.003229 seconds (ignored)
2026-06-20T19:10:04Z chronyd exiting

Merging request now. Thanks for the contribution.

[NaomiAmethyst]

@jauderho Fix landed upstream: aguacero7/rkik-nts#8