Summary

  • RFC 9581 gives CBOR distinct tags for extended time, duration and period, plus fields for timescale, clock class, accuracy, variance, uncertainty and a stated guarantee. These fields preserve what an emitter says about time; they do not attest the emitter, its clock source or its current discipline.
  • Resolution, accuracy and event truth are different receipts. A timestamp may carry microsecond digits and millisecond uncertainty, while a valid period can still fail to prove causal order, deadline compliance or application completion.

The log entry looked unusually complete. It carried a nanosecond fraction, declared TAI, named a clock class, supplied an uncertainty and added a guarantee. The incident dashboard treated that density as proof that service A acted before service B.

The missing line was the simplest one: when had either clock last synchronized?

RFC 9581 solves a real interchange problem. Earlier CBOR time tags cover an RFC 3339 string or a POSIX-style number. The newer extended-time tag 1001 places one base time in a map and permits precision, timescale, clock-quality and display-intent fields around it. Tag 1002 represents a duration. Tag 1003 represents a period as start and end, or one endpoint plus a duration. The RFC Editor record, Datatracker record, history and errata page establish the specification’s status and provenance. They do not establish deployment in any particular system.

A parser can validate shape, not history

Tag 1001 requires exactly one unsigned base-time key. Key 1 carries POSIX-style seconds; keys 4 and 5 permit decimal-fraction or bigfloat representations. Negative keys are elective. A decoder must ignore an unknown negative or text key. Unknown unsigned keys are base-time or critical information and must cause an error.

That distinction is operationally important. Two decoders can accept the same instant while one discards supplementary meaning it does not understand. The IANA CBOR registries define the shared vocabulary; RFC 8949 defines the underlying data model. Successful decoding proves that the object fits those rules. It does not prove who emitted the object, whether the bytes were altered before authentication, or whether the source clock was sane.

The fraction keys expose a familiar trap. RFC 9581’s own example can encode a timestamp to microsecond resolution while declaring uncertainty of one millisecond. More digits describe the representation. They do not automatically narrow the range in which the event probably occurred.

UTC, TAI and a clock-shaped assertion

Timescale values distinguish UTC with the POSIX epoch from TAI with the PTP epoch. A missing scale implies UTC. Elective timescale keys may be ignored; the positive key 13 is critical. The RFC deliberately excludes “GPS” and “NTP” as scale names and instead specifies offset conversion to UTC or TAI.

Clock-quality keys borrow class, accuracy and offset-scaled log variance from the PTP vocabulary represented by RFC 8575. Key -7 carries expanded measurement uncertainty for coverage factor k=2. Key -8 carries a stated maximum deviation from true time. RFC 9581 is unusually candid: such a guarantee is theoretically unattainable, but systems such as the RFC 3161 time-stamp protocol need to represent one.

The word “stated” carries the governance burden. The map does not name the party underwriting the guarantee, the oscillator, the upstream grandmaster, the calibration chain, the network-delay model, the holdover interval or the last alarm. RFC 5905 describes NTP’s protocol machinery; the NIST Internet Time Service is an example of a live source and operating service outside the serialized object. The BIPM/JCGM publications define how measurement uncertainty is expressed. Merely filling key -7 does not prove that discipline was followed.

Display intent is not location evidence

RFC 9581 can also carry a time-zone hint or RFC 9557 suffix information. An elective negative key may be ignored; a positive counterpart is critical. These fields help a recipient display or interpret an instant. They are not GPS coordinates, proof of physical location or proof that the emitter operated under a particular jurisdiction. The RFC also notes that converting an extended date-time to a POSIX base can lose the original numeric offset.

Time metadata can itself leak characteristics of the emitting system: its zone, resolution or wall-clock offset. RFC 9581 flags ambiguity in security-relevant freshness and validity spans. A collector therefore needs both a semantic policy and a disclosure policy.

Build the receipt chain

For an auditable event, retain the canonical CBOR bytes and decoder result first. Then retain authenticated emitter identity, source and timescale realization, last successful synchronization, holdover state, estimated offset and delay, quality derivation, wall-clock value, a monotonic counter, capture latency and collector receipt time. Only after those receipts can an investigator compare two uncertainty intervals or make a bounded ordering claim.

A period needs the same discipline. Tag 1003 can prove that a payload contains a structurally valid start/end pair or endpoint-plus-duration. It cannot prove that work began at the first instant, finished at the second, or met an SLA. That last receipt belongs to the application that accepted, processed and completed the work.

Heng Lu’s reality-layers essay explains why a richer symbol must not consume authority from the physical system. Running-Code Primacy puts interoperability in the encoder and decoder but truth in operating evidence. Why BTW Media exists supplies the editorial obligation: show the join that is missing, rather than letting a precise-looking timestamp hide it.

Sources