Security

CTS has no authentication of its own: it relies on BLE pairing. Keep in mind:

• Reading the time is possible for every device in range (unless you make the characteristic require encryption). The time that you read from an unknown device is not trustworthy: do not use it for certificates or for security decisions.
• Setting the time over Bluetooth is off by default. server.enableTimeSetting() lets clients write the Current Time and the Local Time Information, and requires an encrypted (paired) connection. enableTimeSetting(false) allows it without pairing: use that only in a trusted environment, because everybody in range could change the time that you serve.
• The time source must implement setTimeMs() to accept the time (TinyCTSClockSource and TinyCTSSystemSource do).

Platform notes

• ArduinoBLE can not refuse a write: the real time is restored after a refused write. With enableTimeSetting() the writable characteristics need an encrypted connection also for reading.
• Pico W: pairing is "just works" (no passkey). It is selected before the BLE hardware starts, so the server has to be started first if a client is used on the same board.
• Linux: if the device requires an encrypted connection, pair it first (e.g. with bluetoothctl) before tinycts set.

Compared with TinyNTP there is no shared secret: tinyntp set signs the request with HMAC-SHA256, tinycts set depends on the pairing of the Bluetooth stack.