Re: [TLS] Server time

[Jeffrey Walton <[e-mail]>]

On Sat, Apr 4, 2015 at 5:57 PM, Dave Garrett <[e-mail]> wrote:
> ...
>
> Do a ping with a time request after authentication and it would be protected, measure latency, and easily provide precise remote time adjusted for response time. Might be overkill, though it'd be simple enough to add.
>
I think the problem here is channel setup will fail *if* the client's
clock is wrong. The client will fail to validate the end-entity
certificate due to problems with the notBefore and notAtfer (even
though its correct). You won't have a channel to perform the ping.

I like the idea of a field like ServerHello.time so the server can
communicate its belief in time. A client can defer a simple failure
based on time until key exchange completes. If key exchange completes
successfully, then the client can decide if it wants to accept the
server's view of time.

The functionality leads to other attack surfaces, like a rogue server
rolling back its time and using compromised key. But I think that can
be solved with a good degree of certainty using Guttmann's security
diversification techniques.

Jeff