[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 20 Dec 2014 14:42:32 +0000
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Subject: Re: can we talk about secure time?
On 2014/12/20 12:27, Hanno Böck wrote:
> Is there any reason not to tell everyone to use tlsdate?
> What's the distro's take on this? afaik many ship ntp-based solutions
> by default.
That won't work well for OpenBSD; libressl uses a random value instead
of the timestamp. Using tlsdate against such a server:
V: In TLS response, T=978796414
V: In TLS response, T=3901855112
V: In TLS response, T=602561497
V: In TLS response, T=4259017273
V: In TLS response, T=1129774656
V: In TLS response, T=2844925558
There are certainly reasons you might not want to expose exact server
time of a general purpose server, e.g. passing time(NULL) to srand
is very common, but that's another can of worms (we also had some
changes in that area recently)..
As far as NTP goes, OpenNTP does at least send cookies in some fields
and check returned valuess, mitigating against blind spoofing. For sure
it's not perfect, but requires no configuration and is better than not
doing it.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
