Date: Thu, 23 Apr 2015 17:37:48 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: tlsdate havoc ahead - default host randomizes tls timestamps Hi, It was pointed out to me that tlsdate behaved strangely for a couple of people. The reason is that www.ptb.de - the default tls host pre-configured in tlsdate - now seems to use randomized TLS timestamps. Background: tlsdate is a replacement for timesetting tools like ntpd/rdate that doesn't use ntp, instead it sets the time based on a TLS timestamp. However it became recently popular to hide the TLS timestamp to make fingerprinting harder and not expose the time of servers. There are plans to remove the TLS timestamp. Anyway: It seems yesterday or today the operators of www.ptb.de (a german government institution operating atomic clocks) decided to do that on their servers. This means all default installations of tlsdate may set the system time to random values. Some distributions (e.g. Gentoo) have changed the default to www.google.com, which seems wise (although I recently objected to this change... always wiser afterwards). Google itself is using tlsdate in chromeos, so they are probably aware of this problem and won't randomize the timestamps. Another alternative is to use tlsdate with http header timestamps instead. I urge all distributions to check what their implementations do and patch them to use www.google.com (or do something else to fix it) as soon as possible. I know Debian and Ubuntu have a problem. I haven't checked others. I have recommended tlsdate as a safer alternative to ntp in the past a lot. Please note that there are two places where tlsdate has www.ptb.de preconfigured - one in the default config for tlsdated and one hardcoded into the tlsdate binary itself. In other news: There's some interesting development going on in terms of secure time. openntpd (the openbsd thing) has some nice solution using tls timestamps as a boundary for ntp timesetting. This combines the security of tlsdate with the precision of ntp. And there is some work done in the IETF to create a secure version of ntp: https://tools.ietf.org/html/draft-ietf-ntp-network-time-security-08 https://tools.ietf.org/html/draft-ietf-ntp-cms-for-nts-message-03 https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp-00  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783174 cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.