Re: [TLS] Let's remove gmt_unix_time from TLS

[Nick Mathewson <[e-mail]>]

On Wed, Sep 11, 2013 at 12:53 PM, Hanno Böck <[e-mail]> wrote:
> On Wed, 11 Sep 2013 11:43:53 -0400
> Nick Mathewson <[e-mail]> wrote:
>
>> Despite the late date, much of the world is still not
>> synchronized to the second via an ntp-like service. This means
>> that different clients have different views of the current time,
>> which provides a fingerprint that helps to track and distinguish
>> them.  This fingerprint is useful for tracking clients as they
>> move around.  It can also distinguish clients using a single VPN,
>> NAT, or privacy network.  (Tor's modified firefox avoids this by
>> not sending the time.)
>
> I can't help getting the feeling that you're trying to fix the wrong
> thing here. People use computers with a wrong clock. That's the problem
> here. You should try to fix that and not workaround it.

I respect your argument, and I used to think the same way myself.
Unfortunately, this doesn't seem to work so well in practice.

Consider that NTP has been around since before the web, and yet
typical consumer computers in the wild still have seconds to minutes
of clock skew.  Consider also that authenticated NTP is even less well
deployed than regular NTP, and that the possibility of
adversary-introduced clock skew reintroduces the fingerprinting
problem.

Also, consider that although fingerprinting issue is worst with large
skew, even less than a second of skew can be used to partition users:
If Alice's clock is only .1 second behind Bob's, a passive observer
can still conclude of 10% of Alice's TLS connections that they could
not have been sent by Bob, and of 10% of Bob's TLS connections that
they could not have been sent by Alice.  Over time, little
observations like this can add up to a lot of information for a clever
attacker.


Also, one could as easily argue that a broken PRNG is a problem that
needs to be fixed and not worked-around, and so gmt_unix_time should
not be supported. ;)

> My suggestion: Tor could detect on startup if the time is correct via
> ntp (or even through the tor network itself with the next server). If
> its not, it refuses to start unless an option like
> "iknowmytimeisbrokenandidontcare" is set. For the gui, issue a warning
> and an easy option to fix the time.

This idea has some merit, although we would need to find a workaround
for the fact that the initial TLS connection to the Tor network would
leak what time the client had thought it was until their anonymous NTP
requests had told them the real time.

In the short term, however, removing gmt_unix_time seems like a much
simpler fix: it can be done with a one-line patch to OpenSSL and/or
NSS, to improve the privacy of a great number of users, even those who
do not yet have an authenticated anonymized byzantine-fault-tolerant
NTP client.


yrs,
-- 
Nick