Re: [TLS] Let's remove gmt_unix_time from TLS

[Martin Thomson <[e-mail]>]

On 9 December 2013 10:49, Nick Mathewson <[e-mail]> wrote:
> On the latter point, I'd suggest that rounding is a little better than
> adding random skew, since only a smaller fraction of a client's
> declared times will leak anything about the client's skew.
> Randomize-and-round might be better still, though I'm afraid I haven't
> worked through the full analysis.

It depends on what you believe you are protecting against, but if you
intend to protect against revealing the value of the local clock, then
neither is sufficient.  It all depends on how many samples your
adversary has available.

With rounding, all you need to recover the time is to watch for edge
crossings and align them.  With randomization, you ultimately reveal
time by hitting the limits of the random space.  9 bits of space
doesn't require a lot of samples.

If you want to do a really good job, then a 1-dimensional application
of the methods described in
http://tools.ietf.org/html/draft-thomson-geopriv-location-obscuring-01
would most likely work.  I'd probably go with full random before I
went there though - maintaining more secrets sounds like a good way to
get in trouble.