[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 21 Dec 2014 22:28:38 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: can we talk about secure time?
* Dave Horsfall:
> On Sun, 21 Dec 2014, Florian Weimer wrote:
>
>> [...] but I have the impression that the correct clock changes every
>> couple of years.
>
> This sounds like you're referring to leap seconds,
No, I meant the recommend time to use in this context. If
clock_gettime(CLOCK_MONOTONIC) is the right choice, that's good,
because it has vdso accelleration (but I don't know how effective that
is in practice). On some systems, obtaining time is really painfully
slow. [*]
> where due to the
> Earth's rotation slowing down (as determined by the International Earth
> Rotation Service), an extra second is inserted every so often, typically
> in July; it's quite fun watching it on a GPS receiver (assuming that it
> even survives the event, as I've seen a few cheaper ones lose the plot).
GPS time does not have leap seconds.
[*] If you upgrade OpenSSL and RAND_bytes is suddenly so much slower,
that's the place to lookâupstream mixes not just the PID, but also the
current time into the pool to achieve more complete fork protection.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
