Re: [TLS] OPTLS: Signature-less TLS 1.3

[Nico Williams <[e-mail]>]

On Wed, Nov 5, 2014 at 11:56 AM, Watson Ladd <[e-mail]> wrote:
> On Nov 5, 2014 9:51 AM, "Nico Williams" <[e-mail]> wrote:
>> Perhaps we should pin latest datetime advertised by the server for
>> which other things are being pinned.  This would prevent time travel
>> into the past.  Time travel into the far future is, presumably, not
>> that big a deal, even with pinning, because server operators will
>> strive to make sure that doesn't happen.
>
> Or kernels can set the flag that stops this from being possible. We should
> note the issue, and, as with randomness, let the vendors solve it.

User-land code can "correct" kernel time.  For example, most Kerberos
libraries record time offset between the client and the KDC, and
correct local time when making AP-REQs for any service subsequently.
Clients trust KDCs, so that's OK.

But if TLS clients also attempt to correct local clocks on the basis
of time advertised by arbitrary servers...  Obviously, that's the
problem: TLS clients should not use the TLS protocol to attempt to
correct local clock skew.

Nico
--