Re: [TLS] No more GMT exposure in the handshake

[Kurt Roeckx <[e-mail]>]

On Sat, Jun 07, 2014 at 09:55:23PM +0000, Jacob Appelbaum wrote:
> On 6/7/14, Daniel Kahn Gillmor <[e-mail]> wrote:
> > On 06/07/2014 10:56 AM, Watson Ladd wrote:
> >> Putting the clock time in the TLS handshake enables fingerprinting.
> >> It's useless cryptographically: 32 random bytes is exceedingly
> >> unlikely to repeat.
> >
> > There seems to be a growing consensus on this point:
> >
> >   https://tools.ietf.org/html/draft-mathewson-no-gmtunixtime
> >
> 
> I've said as much to Nick and to Eric (in the context of working on
> tlsdate[0]) but perhaps not on this tls list:
> 
> I'd like to see servers provide 64bits of time resolution in the
> ServerHello and nothing but randomness in that field in the
> ClientHello.
> 
> The current 32bit field isn't accurate enough for replacing NTP. If we
> can't make the time field useful for accurate secure time exchange - I
> hope we'll remove all network visible distinguishers, even ones that
> are currently useful for totally bizarre reasons.

Would that be in the same format as NTP, with 32 bit for the
seconds and 32 bit for fractional second, and so a resolution
of 0.2 nano seconds?  I'm wondering what kind of accuracy you'll
get.

Anyway, how do you plan to deal with checking the status of the
certificate if you don't know what the current time is?


Kurt