Roughtime

Roughenough is an implementation of the IETF Roughtime secure time synchronization protocol. Roughenough provides both server and client components for cryptographically verifiable time synchronization.

Features

• Full implementation of the (draft) Roughtime RFC specification
• Command-line client with multiple output formats and server validation
• Performance oriented batching UDP server
• Clients can (optionally) report malfeasance to a remote server for analysis
• Multiple backends for secure key and identity protection (KMS, Secret Manager, Linux KRS, SSH agent, PKCS#11)

Quick Start

System Requirements

• MSRV 1.88, Rust 2024 edition
• Linux, MacOS, or other Unix-like operating system
• Optional: cloud provider credentials for backend key storage

Installation

Build all components:

cargo build --release

Build with all optional features:

# Enable all optional features
cargo build --release --all-features 

Running the Server

The server refuses to start without a long-term identity seed. Pass one with --seed (or the ROUGHENOUGH_SEED environment variable), or pass --insecure-zero-seed to run with an all-zero seed for testing.

# Debug build, testing-only zero seed
cargo run --bin roughenough_server -- --insecure-zero-seed

# Release build with optimizations and a real seed
cargo run --release --bin roughenough_server -- --seed <SEED>

# Run the server binary directly
target/release/roughenough_server --seed <SEED>

The server will start listening for UDP requests on the default port (2003).

Running the Client

Basic usage:

# Query a Roughtime server
cargo run --bin roughenough_client -- roughtime.int08h.com 2003

# Verify server public key
cargo run --bin roughenough_client -- roughtime.int08h.com 2003 -k <base64-or-hex-key>

# Multiple requests
cargo run --bin roughenough_client -- roughtime.int08h.com 2003 -n 10

# Verbose output
cargo run --bin roughenough_client -- roughtime.int08h.com 2003 -v

# Different time formats
cargo run --bin roughenough_client -- roughtime.int08h.com 2003 --epoch  # Unix timestamp
cargo run --bin roughenough_client -- roughtime.int08h.com 2003 --zulu   # ISO 8601 UTC

Query multiple servers from an RFC compliant JSON list:

cargo run --bin roughenough_client -- -l servers.json

Running Tests

# Run all tests
cargo test

# Run tests for specific crate
cargo test -p roughenough-protocol

# Run integration tests
target/debug/roughenough_integration_test

Project Structure

Roughtime is structured as a Cargo workspace with multiple crates:

• protocol - Core wire format handling, request/response types, data structures
• merkle - Merkle tree implementation with Roughtime-specific tweaks
• server - High-performance UDP server with async I/O and batching
• client - Command-line client for querying Roughtime servers
• common - Shared cryptography and encoding utilities
• keys - Key material handling with multiple secure storage backends
• reporting-server - Web server for collecting malfeasance reports
• integration - End-to-end integration tests
• fuzz - Fuzzing harness

Optional Features

Client Features

• reporting - Enables clients to report malfeasance to a remote server

  cargo build -p roughenough-client --features reporting
  cargo run --bin roughenough_client -- hostname.com 2003 --report

Keys Crate Features

See doc/PROTECTION.md for detailed information on seed protection strategies.

Runtime Protection (Online Key Backends)

• online-linux-krs (default): Store seed in Linux Kernel Keyring for runtime protection
• online-ssh-agent Use SSH agent for seed storage and signing operations
• online-pkcs11 PKCS#11 hardware security module integration (Yubikey, HSM, etc)

Long-term Protection (Seed Storage)

• longterm-aws-kms AWS Key Management Service for seed encryption
• longterm-gcp-kms Google Cloud KMS for seed encryption
• longterm-aws-secret-manager AWS Secrets Manager for seed storage
• longterm-gcp-secret-manager Google Cloud Secret Manager for seed storage

Contributing

Contributions are welcome! Please see CONTRIBUTING.md for guidelines.

Thank you to all past and present contributors:

• Stuart Stock (stuart {at} int08h.com)
• Aaron Hill (aa1ronham {at} gmail.com)
• Peter Todd (pete {at} petertodd.org)
• Muncan90 (github.com/muncan90)
• Zicklag (github.com/zicklag)
• Greg at Unrelenting Tech (github.com/unrelentingtech)
• Eric Swanson (github.com/lachesis)
• Marcus Dansarie (github.com/dansarie)
• Marco Davids (github.com/mdavids)
• Tanner Ryan (github.com/tannerryan)

License

Copyright (c) 2025-2026 the Roughenough Project Contributors.

Roughenough is licensed under either of

• Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0)
• MIT License (http://opensource.org/licenses/MIT)

at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.