Date: Sun, 21 Dec 2014 22:28:38 +0100 From: Florian Weimer <fw@...eb.enyo.de> To: oss-security@...ts.openwall.com Subject: Re: can we talk about secure time? * Dave Horsfall: > On Sun, 21 Dec 2014, Florian Weimer wrote: > >> [...] but I have the impression that the correct clock changes every >> couple of years. > > This sounds like you're referring to leap seconds, No, I meant the recommend time to use in this context. If clock_gettime(CLOCK_MONOTONIC) is the right choice, that's good, because it has vdso accelleration (but I don't know how effective that is in practice). On some systems, obtaining time is really painfully slow. [*] > where due to the > Earth's rotation slowing down (as determined by the International Earth > Rotation Service), an extra second is inserted every so often, typically > in July; it's quite fun watching it on a GPS receiver (assuming that it > even survives the event, as I've seen a few cheaper ones lose the plot). GPS time does not have leap seconds. [*] If you upgrade OpenSSL and RAND_bytes is suddenly so much slower, that's the place to look—upstream mixes not just the PID, but also the current time into the pool to achieve more complete fork protection.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.