Subject: [Dtls-iot] Reference to mathewson-no-gmtunixtime

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 15 Jul 2015 13:20:46 +0200

Stephen wrote:

(8) 14: You are RECOMMENDING to follow
mathewson-no-gmtunixtime which is fine. That however
means that that's a normative reference on which you
need to wait. I'm fine with that, but the WG may or may
not be.

I was worried about this issue myself as well. I was hoping that
mathewson-no-gmtunixtime would have moved along at the time when we get
the profile draft to the IESG. Obviously, this has not happened.

I see the following possible next steps:

a) Remove the reference to mathewson-no-gmtunixtime and point out that
somewhere a secure time source needs to be made available.

b) Copy the relevant text from mathewson-no-gmtunixtime  into this
document (with appropriate attribution). mathewson-no-gmtunixtime  cites
a different motivation for doing what he suggests, which I believe is
less applicable to our scenario.

c) Work with Mathewson on mathewson-no-gmtunixtime  to get it finished.
The profile document would be blocked till that time.

If you ask me for a preference then I would probably go for (b). I am
not sure it is, however, in the mandate of the working group to define
TLS-specific functionality.

Hence, I fear that we have to shoot for (a).

Ciao
Hannes

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 15 Jul 2015 13:46:22 +0200

> TLS-specific functionality.

Hmm, profiling this specific field in a way that makes sense for a
constrained implementation is well in the purview of the WG.

Also, 5246 says:
      gmt_unix_time
         The current time and date in standard UNIX 32-bit format
         (seconds since the midnight starting Jan 1, 1970, UTC, ignoring
         leap seconds) according to the sender's internal clock.  Clocks
         are not required to be set correctly by the basic TLS protocol;
         higher-level or application protocols may define additional
         requirements.  Note that, for historical reasons, the data
         element is named using GMT, the predecessor of the current
         worldwide time base, UTC.

"Clocks are not required..."
"higher-level or application protocols may define..."

The license to fix this in a profile is right there.

(b) is the right way to handle this. ✅

(On a technical level, it seems the intention was to have a source of
entropy that also has a good chance to be unique over time.  No idea
whether this sentiment should be picked up here.)

Grüße, Carsten

---

From: Hannes Tschofenig <[email-masked]>
Date: Tue, 21 Jul 2015 14:56:57 +0200

Hi Carsten,

thanks for sharing your views. Good that you noticed this paragraph that
would indeed make it possible to add appropriate text to the draft.

I will work on a proposal and share it with the group.

Ciao
Hannes

On 07/15/2015 01:46 PM, Carsten Bormann wrote:
> _______________________________________________
> dtls-iot mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dtls-iot
>