IETF Logo Mail Archive

Re: [TLS] Relative vs absolute ServerConfiguration.expiration_date

Eric Rescorla <ekr@rtfm.com> Thu, 23 July 2015 05:03 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 86C801A1AC9 for <tls@ietfa.amsl.com>; Wed, 22 Jul 2015 22:03:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.377
X-Spam-Level:
X-Spam-Status: No, score=-1.377 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, J_CHICKENPOX_12=0.6, RCVD_IN_DNSWL_LOW=-0.7] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3QPxscAQ51gg for <tls@ietfa.amsl.com>; Wed, 22 Jul 2015 22:03:05 -0700 (PDT)
Received: from mail-wi0-f179.google.com (mail-wi0-f179.google.com [209.85.212.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C69481A1AB5 for <tls@ietf.org>; Wed, 22 Jul 2015 22:03:04 -0700 (PDT)
Received: by wibud3 with SMTP id ud3so200972967wib.0 for <tls@ietf.org>; Wed, 22 Jul 2015 22:03:03 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=t0d4X8z7y/6pAEQdcmCoBSAYEAq3tzyf6lKgSjj6UAM=; b=fDE7n0qX9AgHQAOaRHlwARDR00ftH3MVo6QjpBuQO8DB48R774zjm+5Nudo4VloKG4 AHvDuGmvpG0Pl1QAqZu9WgkpiDPAGp7XxwiXiJXrxEHC0v5GMSD0vfDZ3xdcSGeczMe9 NQjqSX0XFRJ1A4J68jPRuO8hYt66/jkS/CWwsC82arhslDew+F16vq9ugLzVCiEK1AMB BlKiy13P5jhuIWNIy6jTPHgdpZ50UjGUeNyvf0VPbrSBgLlwwABN1iSStK64ZoiyYGdF RM2T9sokLtEkObuRvGwLl5cbe6YATy3tGNtTeTh5d7zcj9MWJN2N+tSXZjQG28rehdY0 +H5Q==
X-Gm-Message-State: ALoCoQlnDPy/7ZWux2//X5R1gz7N+kDEzlVG89LZQPWt+aQETzdAciqDt6ktLTBTialaoaLZmqHF
X-Received: by 10.180.75.78 with SMTP id a14mr13488960wiw.68.1437627783567; Wed, 22 Jul 2015 22:03:03 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.27.85.75 with HTTP; Wed, 22 Jul 2015 22:02:24 -0700 (PDT)
In-Reply-To: <r422Ps-1075i-2B99FA179EAA462989B17C5443053D7F@Williams-MacBook-Pro.local>
References: <45822829-5DA1-4AA8-9317-BE4D4AEC41E6@fb.com> <r422Ps-1075i-2B99FA179EAA462989B17C5443053D7F@Williams-MacBook-Pro.local>
From: Eric Rescorla <ekr@rtfm.com>
Date: Thu, 23 Jul 2015 07:02:24 +0200
Message-ID: <CABcZeBPWG92TTwKGBO3ecYKez29vUJJs0fdhDXxT6M7DsV-HjA@mail.gmail.com>
To: Bill Frantz <frantz@pwpconsult.com>
Content-Type: multipart/alternative; boundary="f46d0438eb9d5bf1df051b83cdfb"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/yaKfSA1lPU9Aq4GBildMCmgNAIs>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Relative vs absolute ServerConfiguration.expiration_date
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Jul 2015 05:03:06 -0000

On Thu, Jul 23, 2015 at 3:38 AM, Bill Frantz <frantz@pwpconsult.com> wrote:

> One place we may run into a lot of those clients are on machines like the
> Raspberry Pi and Beaglebone machines. These boards do not include clock
> chips, so the machines must get the current time via NTP every time they
> power on. If there is a problem with NTP, or if the shell script to set the
> clock is not run, then the date will probably be 20 or 30 years back in the
> last millenium.
>

That's definitely a problem, but not a specific problem for
ServerConfiguration since those implementations will also have problems
with certificates (and ironically, will accept ServerConfiguration just
fine)

-Ekr

Cheers - Bill

>
> On 7/22/15 at 2:14 PM, bmatheny@fb.com (Blake Matheny) wrote:
>
>  Ahh. I can't tell, the data I have is only clients with very very broken
>> clocks who failed validation as a result. My assumption would be that there
>> is a much larger number of clients that fit what you described (cert/OCSP
>> check passes, but ServerConfiguration would not be). Since I don’t have the
>> data, I can’t say that for sure, but anecdotal evidence would indicate that
>> this is the case.
>>
>> -Blake
>>
>>
>>
>>
>> On 7/22/15, 10:58 PM, "Eric Rescorla" <ekr@rtfm.com> wrote:
>>
>>  I guess what I'm trying to get at is the following:
>>> Are there a lot of people whose clocks are accurate enough that they
>>> will be able to connect to the
>>>
>> server and check the certificate/OCSP but not accurate enough to process
>> ServerConfiguration if it is in absolute time.
>> _______________________________________________
>> TLS mailing list
>> TLS@ietf.org
>> https://www.ietf.org/mailman/listinfo/tls
>>
>>  -----------------------------------------------------------------------
> Bill Frantz        | Ham radio contesting is a    | Periwinkle
> (408)356-8506      | contact sport.               | 16345 Englewood Ave
> www.pwpconsult.com |  - Ken Widelitz K6LA / VY2TT | Los Gatos, CA 95032
>
>

v2.29.0 | Report a Bug | By Email | System Status