Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Apr 2015 17:37:48 +0200
From: Hanno Böck <>
Subject: tlsdate havoc ahead - default host randomizes tls timestamps


It was pointed out to me that tlsdate behaved strangely for a couple of
people. The reason is that - the default tls host
pre-configured in tlsdate - now seems to use randomized TLS timestamps.

Background: tlsdate is a replacement for timesetting tools like
ntpd/rdate that doesn't use ntp, instead it sets the time based on a
TLS timestamp.

However it became recently popular to hide the TLS timestamp to make
fingerprinting harder and not expose the time of servers. There are
plans to remove the TLS timestamp.

Anyway: It seems yesterday or today the operators of (a
german government institution operating atomic clocks) decided to do
that on their servers. This means all default installations of tlsdate
may set the system time to random values.

Some distributions (e.g. Gentoo) have changed the default to, which seems wise (although I recently objected to
this change... always wiser afterwards). Google itself is using
tlsdate in chromeos, so they are probably aware of this problem and
won't randomize the timestamps.
Another alternative is to use tlsdate with http header timestamps

I urge all distributions to check what their implementations do and
patch them to use (or do something else to fix it) as
soon as possible. I know Debian and Ubuntu have a problem. I haven't
checked others. I have recommended tlsdate as a safer alternative to
ntp in the past a lot.

Please note that there are two places where tlsdate has
preconfigured - one in the default config for tlsdated and one
hardcoded into the tlsdate binary itself.

In other news: There's some interesting development going on in terms
of secure time. openntpd (the openbsd thing) has some nice solution
using tls timestamps as a boundary for ntp timesetting. This combines
the security of tlsdate with the precision of ntp.

And there is some work done in the IETF to create a secure version of


Hanno Böck


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.