|
Message-ID: <20141220144232.GQ15831@symphytum.spacehopper.org> Date: Sat, 20 Dec 2014 14:42:32 +0000 From: Stuart Henderson <stu@...cehopper.org> To: oss-security@...ts.openwall.com Subject: Re: can we talk about secure time? On 2014/12/20 12:27, Hanno Böck wrote: > Is there any reason not to tell everyone to use tlsdate? > What's the distro's take on this? afaik many ship ntp-based solutions > by default. That won't work well for OpenBSD; libressl uses a random value instead of the timestamp. Using tlsdate against such a server: V: In TLS response, T=978796414 V: In TLS response, T=3901855112 V: In TLS response, T=602561497 V: In TLS response, T=4259017273 V: In TLS response, T=1129774656 V: In TLS response, T=2844925558 There are certainly reasons you might not want to expose exact server time of a general purpose server, e.g. passing time(NULL) to srand is very common, but that's another can of worms (we also had some changes in that area recently).. As far as NTP goes, OpenNTP does at least send cookies in some fields and check returned valuess, mitigating against blind spoofing. For sure it's not perfect, but requires no configuration and is better than not doing it.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.