[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5495A4D2.1050700@fifthhorseman.net>
Date: Sat, 20 Dec 2014 11:33:22 -0500
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: oss-security@...ts.openwall.com
Subject: Re: can we talk about secure time?
On 12/20/2014 09:42 AM, Stuart Henderson wrote:
> On 2014/12/20 12:27, Hanno Böck wrote:
>> Is there any reason not to tell everyone to use tlsdate?
>> What's the distro's take on this? afaik many ship ntp-based solutions
>> by default.
>
> That won't work well for OpenBSD; libressl uses a random value instead
> of the timestamp.
It's not just libressl, there's a general push to do this:
https://tools.ietf.org/html/draft-mathewson-no-gmtunixtime-00
and the upcoming TLS 1.3 is likely to have the timestamp removed from
the handshake entirely:
https://tools.ietf.org/html/draft-ietf-tls-tls13-03#section-1.2
tlsdate can also fetch the Date: header from https connections, though,
so that should make it possible to withstand the removal from the handshake.
Even if the time were to remain in the handshake (or we're ok with using
the HTTP Date: header), tlsdate has a chicken-and-egg problem: if you
want to actually verify the TLS connection, you need to validate a
signature from a valid X.509 certificate; but knowing the validity of
any given certificate is dependent on knowing the correct time.
the default installation of tlsdate on debian jessie (0.0.12-1) appears
to list 143 CAs in /etc/tlsdate/ca-roots/tlsdate-ca-roots.conf (all the
usual suspects :/) so it doesn't appear to be using any targeted
cryptographic keying material beyond the general public CA expectations.
if we're going to solve the network time situation with cryptographic
mechanisms, using time-bounded certificates for validity seems problematic.
That said, for systems which need only rough precision and stronger
network security (which is most systems), tlsdate does a much better job
at the moment compared to ntp. (ntp offers more precision and less
security, which seems like the wrong tradeoff for most
internet-connected devices)
--dkg
Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
