Subject: Re: [perpass] [TLS] Let's remove gmt_unix_time from TLS

From: Peter Gutmann <[email-masked]>
Date: Thu, 12 Sep 2013 05:20:42 +0000

Eric Rescorla <[email-masked]> writes:

>Before we discuss mechanisms, it would be good to verify that in general 
>clients and servers don't become unhappy if the timestamp is radically 
>wrong. Has someone done measurements to verify that this is in fact the 
>case at a broad scale?

Yes.  I've been putting random noise in the timestamp field for about 15
years (or more specifically I've never put a timestamp in the timestamp
field), no user has ever reported problems with this.

Peter.

---

From: Marsh Ray <[email-masked]>
Date: Thu, 12 Sep 2013 08:25:48 +0000

>Before we discuss mechanisms, it would be good to verify that in
>general clients and servers don't become unhappy if the timestamp is
>radically wrong. Has someone done measurements to verify that this is
>in fact the case at a broad scale?

I just checked and the current version doesn't do this, but ISTR older Internet Explorer would populate the "GMT" field with the local time. If my recollection is true, this would probably represent "broad scale".

This would reveal the client's time zone. So particularly for clients traversing VPNs and proxies it would represent an info leak to a passive eavesdropper positioned near the server.

- Marsh