Subject: Re: [TLS] OPTLS: Signature-less TLS 1.3

From: Peter Gutmann <[email-masked]>
Date: Mon, 3 Nov 2014 18:00:33 +0000

Hanno Böck <[email-masked]> writes:

>I recently changed my servers from ntpd to tlsdated. That's probably what
>everyone should do. (this still leaves open the question whom you trust for
>your timesource - but it's certainly an improvement over insecure ntp)

See my recent post to the SAAG list where this is also being discussed, this
hack already doesn't work for some TLS servers and won't work at all in the
future when the nonce is just 32 random bytes.

(Also, if everyone is trusting some TLS server as their time source then all
you need to do is spoof that server's NTP source and you've spoofed the time
for every client that relies on it).

Peter.

---

From: Martin Thomson <[email-masked]>
Date: Mon, 3 Nov 2014 11:41:26 -0800

> future when the nonce is just 32 random bytes.

Yes, the current TLS 1.3 draft says this:

       opaque                 client_random[32];
       opaque                 server_random[32];

With no mention of times.

Though you can get a similar capability by talking to an HTTPS server
you trust.  Date is a mandatory header field.