Re: [TLS] Let's remove gmt_unix_time from TLS

[Wan-Teh Chang <[e-mail]>]

Sorry about my late reply. I am a programmer working on the NSS crypto
libraries. While reviewing recent changes to NSS, I noticed that
Nick's proposal 1 has been implemented in the OpenSSL and NSS source
code repositories, which led me to this old email thread.

The only protocol feature I know of that uses the gmt_unix_time field
of ClientHello.random is Adam Langley's TLS Snap Start Internet-Draft
[1]. See Section 3 of Adam's draft. This method is one of the
anti-reply mechanisms being considered in Eric Rescorla's TLS 1.3 new
handshake flows Internet-Draft [2], and is being used in the QUIC
protocol.

So, I'd like to offer another proposal:

PROPOSAL 4:

Add a random clock skew to the current time. For example, generate a
random signed integer in the interval [-512, 511] (inclusive) and add
it to the return value of time(). This adds roughly a +/-8.5 minutes
skew to the current time.

If this proposal is an acceptable solution to the client
fingerprinting problem, then gmt_unix_time in ClientHello.random will
remain viable as part of an anti-reply mechanism for TLS 1.3 new
handshake flows.

Wan-Teh Chang

[1] http://tools.ietf.org/html/draft-agl-tls-snapstart-00
[2] http://tools.ietf.org/html/draft-rescorla-tls13-new-flows-00