Date: Sat, 20 Dec 2014 11:33:22 -0500 From: Daniel Kahn Gillmor <dkg@...thhorseman.net> To: oss-security@...ts.openwall.com Subject: Re: can we talk about secure time? On 12/20/2014 09:42 AM, Stuart Henderson wrote: > On 2014/12/20 12:27, Hanno Böck wrote: >> Is there any reason not to tell everyone to use tlsdate? >> What's the distro's take on this? afaik many ship ntp-based solutions >> by default. > > That won't work well for OpenBSD; libressl uses a random value instead > of the timestamp. It's not just libressl, there's a general push to do this: https://tools.ietf.org/html/draft-mathewson-no-gmtunixtime-00 and the upcoming TLS 1.3 is likely to have the timestamp removed from the handshake entirely: https://tools.ietf.org/html/draft-ietf-tls-tls13-03#section-1.2 tlsdate can also fetch the Date: header from https connections, though, so that should make it possible to withstand the removal from the handshake. Even if the time were to remain in the handshake (or we're ok with using the HTTP Date: header), tlsdate has a chicken-and-egg problem: if you want to actually verify the TLS connection, you need to validate a signature from a valid X.509 certificate; but knowing the validity of any given certificate is dependent on knowing the correct time. the default installation of tlsdate on debian jessie (0.0.12-1) appears to list 143 CAs in /etc/tlsdate/ca-roots/tlsdate-ca-roots.conf (all the usual suspects :/) so it doesn't appear to be using any targeted cryptographic keying material beyond the general public CA expectations. if we're going to solve the network time situation with cryptographic mechanisms, using time-bounded certificates for validity seems problematic. That said, for systems which need only rough precision and stronger network security (which is most systems), tlsdate does a much better job at the moment compared to ntp. (ntp offers more precision and less security, which seems like the wrong tradeoff for most internet-connected devices) --dkg Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.