[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141222073925.3ac4e58d@pc>
Date: Mon, 22 Dec 2014 07:39:25 +0100
From: Hanno Böck <hanno@...eck.de>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: can we talk about secure time?
On Sun, 21 Dec 2014 23:30:10 -0700
Kurt Seifried <kseifried@...hat.com> wrote:
> Having to reconcile multiple logs/events across widely distributed
> systems, especially in high volume situations, 1-2 seconds is a deal
> breaker. Or people running SCADA systems for industrial plants. Or
> people that run financial systems.
I don't think this contradicts my statement that average consumer hw
doesn't need the high accuracy of ntp :-)
> So it's not an either/or situation (care about security, or have
> accurate time, sometimes we need both).
Yeah, I totally agree that this would be the desired thing to have.
However the facts are that at the moment we don't. And imho for
consumer HW the slight inaccuracy of tlsdate doesn't matter, while the
insecurity of ntp does (as the very practical hsts attack has shown).
I read these days that the Linux foundation is sponsoring some work on
NTP. Anyone involved in this and can comment whether secure
authentication for NTP is something that's being looked at or if it is
only about creating a better implementation of the ntp software?
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
