IETF Logo Mail Archive

Re: [TLS] Relative vs absolute ServerConfiguration.expiration_date

Blake Matheny <bmatheny@fb.com> Wed, 22 July 2015 21:15 UTC

Return-Path: <prvs=46459d10f6=bmatheny@fb.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39BEB1A0193 for <tls@ietfa.amsl.com>; Wed, 22 Jul 2015 14:15:04 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.367
X-Spam-Level:
X-Spam-Status: No, score=-2.367 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, IP_NOT_FRIENDLY=0.334, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3asE1xfhKU0w for <tls@ietfa.amsl.com>; Wed, 22 Jul 2015 14:15:03 -0700 (PDT)
Received: from mx0a-00082601.pphosted.com (mx0b-00082601.pphosted.com [67.231.153.30]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69E0F1B2E70 for <tls@ietf.org>; Wed, 22 Jul 2015 14:15:00 -0700 (PDT)
Received: from pps.filterd (m0004003 [127.0.0.1]) by mx0b-00082601.pphosted.com (8.14.5/8.14.5) with SMTP id t6MLEtAY006185; Wed, 22 Jul 2015 14:14:59 -0700
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=fb.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-id : content-transfer-encoding : mime-version; s=facebook; bh=g/qeeIlyrIdhlDcMjNA8rQ761pIrFslC54wT32qtjT4=; b=mHS0RvOUV/6wns8krK91NjRfRviyaDaxYkpwKpN00LHytG87PtK4xXR9tDuoXS2H6LEO 1dLV67rW815jVSApC7s2J2d/CELpiCyVM5wMUADl6u7958juP8b0v5S1GKgLOboEZVTh 6HxyrawD7UP/6L3JAEblRVW1maCauKnLzpE=
Received: from mail.thefacebook.com ([199.201.64.23]) by mx0b-00082601.pphosted.com with ESMTP id 1vtjqgg1gn-1 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT); Wed, 22 Jul 2015 14:14:59 -0700
Received: from PRN-MBX02-4.TheFacebook.com ([169.254.2.114]) by PRN-CHUB10.TheFacebook.com ([fe80::c983:d64f:e422:461d%12]) with mapi id 14.03.0195.001; Wed, 22 Jul 2015 14:14:40 -0700
From: Blake Matheny <bmatheny@fb.com>
To: Eric Rescorla <ekr@rtfm.com>
Thread-Topic: [TLS] Relative vs absolute ServerConfiguration.expiration_date
Thread-Index: AQHQxLhtAHKzuQna7EW41OtNBaA7dZ3oXbMAgAAw8oD//9+PAIAAJhAA
Date: Wed, 22 Jul 2015 21:14:39 +0000
Message-ID: <45822829-5DA1-4AA8-9317-BE4D4AEC41E6@fb.com>
References: <8965F344-4921-4F99-8A5A-BA7BCAAB0D7C@fb.com> <CABcZeBPTnXzDwoGTS5=m7mzaxiZtqKzMG33ghTzFcJSbFQyAsQ@mail.gmail.com> <3D04F5AE-61E1-45A9-A794-C3F0E6F3DEAD@fb.com> <CABcZeBN_3fXKSrNCyhL5FY+VOu_wG8EH9oKAe2Ss3KOn1dU8cA@mail.gmail.com>
In-Reply-To: <CABcZeBN_3fXKSrNCyhL5FY+VOu_wG8EH9oKAe2Ss3KOn1dU8cA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/0.0.0.150701
x-originating-ip: [192.168.52.123]
Content-Type: text/plain; charset="utf-8"
Content-ID: <D7402C8DAB1B9A48AF19FDE492191ADB@fb.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-Proofpoint-Spam-Reason: safe
X-FB-Internal: Safe
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:5.14.151, 1.0.33, 0.0.0000 definitions=2015-07-22_07:2015-07-22,2015-07-22,1970-01-01 signatures=0
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/4a7BScjk6na_mTTlau6n0bXUUEI>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Relative vs absolute ServerConfiguration.expiration_date
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Jul 2015 21:15:04 -0000

Ahh. I can't tell, the data I have is only clients with very very broken clocks who failed validation as a result. My assumption would be that there is a much larger number of clients that fit what you described (cert/OCSP check passes, but ServerConfiguration would not be). Since I don’t have the data, I can’t say that for sure, but anecdotal evidence would indicate that this is the case.

-Blake




On 7/22/15, 10:58 PM, "Eric Rescorla" <ekr@rtfm.com> wrote:

>I guess what I'm trying to get at is the following:
>Are there a lot of people whose clocks are accurate enough that they will be able to connect to the server and check the certificate/OCSP but not accurate enough to process ServerConfiguration if it is in absolute time.

v2.23.0 | Report a Bug | By Email