Re: [TLS] Server time

[Adam Caudill <[e-mail]>]

On Mon, Apr 6, 2015 at 12:30 PM, Jeffrey Walton <[e-mail]> wrote:

> On Mon, Apr 6, 2015 at 12:13 PM, Martin Thomson
> <[e-mail]> wrote:
> > On 6 April 2015 at 05:45, Peter Gutmann <[e-mail]>
> wrote:
> >> Using TLS as a pseudo-NTP source makes about as much sense as using
> HTTP as a
> >> pseudo-NTP source, which has happened a number of times in the past.
> TLS is a
> >> means of building a secure tunnel from A to B, not a kludgy way of
> avoiding
> >> use of NTP.
> >
> > Yes, this is right.  There's nothing inherently wrong with using a
> > HTTP server that you trust to have good time for a little sanity
> > checking.  That said, it doesn't make any sense to use arbitrary
> > servers.
> +1. That was the exact use case I was envisioning - an LG refrigerator
> abandons the browser security model and pins to LG's CA. In this case,
> it trusts its own organization's PKI and servers (but no others).
>
> Jeff
>
>
In certain circumstances, using a HTTPS server as a time source isn't a
horrible idea, but why change TLS for such an edge case? To me, this seems
like a clear case of trying to address the issue at the wrong level - this
adds no security, introduces privacy issues, and introduces further changes
for an edge case that could easily be addressed in many other ways.

If there are use cases where it is important that time be acquired from an
HTTPS, have the server return the timestamp at whatever precision desired
as the body of the response to the GET request - it's still simple to work
with, and doesn't impact all TLS users as this would.