Re: [TLS] OPTLS: Signature-less TLS 1.3

[Manuel Pégourié-Gonnard <[e-mail]>]

On 02/11/2014 00:22, Eric Rescorla wrote:
> On Sat, Nov 1, 2014 at 3:22 PM, Watson Ladd <[e-mail]> wrote:
>> Why does the duration of the validity of
>> the response affect the existence of this issue?
>>
> 
> My argument here is that clients have some ability to sanity check
> network time information, and so it's not necessarily like the attacker
> can set the time to anything (I don't know how NTP clients currently
> work). So an attacker who can only move the clock by a day or
> two is going to of course be more effective attacking credentials
> with a short time window than with a long time window
> (though arguably that's because the latter is less secure to start
> out with).
> 
> Does that make sense?
>
I think it does, at least partially

I'm by no means an expert on NTP security, but in my small experience, I've seen
configurations on laptops where the NTP server is started when a network
connection is established, and with an option that abruptly sets the time
(rather than slowly shifting it) on startup (that's the -s option to openntpd
for example).

So, while I tend to agree that in theory clients could be able to sanity-check
the network time if a precision of the order of days is desired, I'm afraid in
practice it's not happening everywhere.

But sure, needing a higher level of precision can only make more attacks
practical in more circumstances.

Manuel.