IETF Logo Mail Archive

Re: [TLS] Consensus Call on Removing GMT from the Handshake

Watson Ladd <watsonbladd@gmail.com> Mon, 16 June 2014 01:53 UTC

Return-Path: <watsonbladd@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 457ED1B29C2 for <tls@ietfa.amsl.com>; Sun, 15 Jun 2014 18:53:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Level:
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4v1tFMcL6NG8 for <tls@ietfa.amsl.com>; Sun, 15 Jun 2014 18:52:58 -0700 (PDT)
Received: from mail-yk0-x22d.google.com (mail-yk0-x22d.google.com [IPv6:2607:f8b0:4002:c07::22d]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA41D1B29BD for <tls@ietf.org>; Sun, 15 Jun 2014 18:52:58 -0700 (PDT)
Received: by mail-yk0-f173.google.com with SMTP id q200so3670133ykb.4 for <tls@ietf.org>; Sun, 15 Jun 2014 18:52:58 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=Z5TzJED8n0dPk0CHSZDO055XqzkzbIKClMpPFgOC41Y=; b=QTG3dGXvKt9oJqdv0IEBcnkAvJoKGccmmb/sHoWcgf1qxFuaPMP9dp5BzWr3psz3Kp OtLcLrNwsH4FMqUM9ju9xrhydaQii8cpTwsB6AQjcwSle2IULs72hm5kDyNEje0G2UQT VNqVyWyV3frTnKxHbh/jiypwFnvwpje/fX6km+lQDkj0QwrhLndw4HmnG6DAbEkN62kP v0CuY1rvgH0PCTeJKZZzHuSK85mj5Pbm7y0wyrOxhYBkGgzOgHpC8KWWXZRSEsHh4vAT oUcuAS2lgJyiocY7HsMZfOc888ZXd1lRiSxKZREASpTx6Qar7h6IJyEqpjCn8EZfw5s6 +LWw==
MIME-Version: 1.0
X-Received: by 10.236.53.69 with SMTP id f45mr29416093yhc.53.1402883578095; Sun, 15 Jun 2014 18:52:58 -0700 (PDT)
Received: by 10.170.39.136 with HTTP; Sun, 15 Jun 2014 18:52:58 -0700 (PDT)
In-Reply-To: <914e7a8836ad1efd761f7d867c5cb881.squirrel@www.trepanning.net>
References: <FA6199E3-0994-43FC-89BA-9F236F8567A0@cisco.com> <CAFggDF1CRwfvvj2HBD=6x4-+Q514XqKuLu-o3Zxy89BzLuShQQ@mail.gmail.com> <914e7a8836ad1efd761f7d867c5cb881.squirrel@www.trepanning.net>
Date: Sun, 15 Jun 2014 22:52:58 -0300
Message-ID: <CACsn0cnBoK5hJkOs79t2+9kP2JUP0_Xm0K+XuD1XCWV_H=JjsQ@mail.gmail.com>
From: Watson Ladd <watsonbladd@gmail.com>
To: Dan Harkins <dharkins@lounge.org>
Content-Type: text/plain; charset="UTF-8"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/x0b0H5wCU6Ib3j2cGdx4Z9xrnuM
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Consensus Call on Removing GMT from the Handshake
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 16 Jun 2014 01:53:00 -0000

On Sun, Jun 15, 2014 at 9:52 PM, Dan Harkins <dharkins@lounge.org> wrote:
>
> On Sat, June 14, 2014 6:31 am, Jacob Appelbaum wrote:
>> On 6/13/14, Joseph Salowey (jsalowey) <jsalowey@cisco.com> wrote:
>>> There appears to be significant support for the removal of GMT from the
>>> client
>>> and server random values in TLS. The chairs would like to ask two
>>> questions:
>>>
>>> - Should we remove the GMT values from the client and server values in
>>> TLS
>>> 1.3?
>>>
>>
>> I would request that the language in 1.3 be MUST for clients to avoid
>> client fingerprinting by a passive or active adversary. For servers, I
>> would request that they servers SHOULD make it random. I would also
>> request that for 1.3 that it isn't a requirement (MUST) to make it
>> random.
>
>   I see no value in retaining the GMT value in the server random. Making
> it optional requires some justification. Care to share it?

Tails currently uses the gmt time from servers to figure out what time
it is. Making it optional lets them ween off.

Sincerely,
Watson Ladd
>
>   Dan.
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls



-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin

v2.23.0 | Report a Bug | By Email