Subject: Re: [TLS] Resolution on gmt_time

From: Eric Rescorla <[email-masked]>
Date: Wed, 16 Jul 2014 08:09:29 -0700

See https://github.com/tlswg/tls13-spec/pull/65

Expected merge date: Friday Jul 18

On Sun, Jun 22, 2014 at 10:17 PM, Joseph Salowey (jsalowey) <
[email-masked]> wrote:

> Thanks all. Based on the list discussion, the chairs believe there
> is rough consensus on the following points:
>
> For TLS 1.3:
> - Remove GMT time from the ClientHello entirely.
> - Remove GMT time from the ServerHello at the MUST or SHOULD level.
>
> For TLS 1.2:
> - Remove GMT time from the ClientHello entirely.
> - Remove GMT time from the ServerHello at the SHOULD level.
>
> Next steps for TLS 1.3 are as follows:
> The editor is directed to remove GMT time from both random values
> and open an issue as to whether or not the ServerHello can have
> a time value in it.
>
> Next steps for TLS 1.2 are as follows:
> Absent any objections, the chairs intend to adopt draft-matthewson
> as a WG draft. Anyone who objects to this, please say something by
> Friday June 27.
>
> Joe
> (For the chairs)
>
> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Dan Wing <[email-masked]>
Date: Fri, 18 Jul 2014 15:51:18 -0700

It reads for TLS 1.3:
  Server implementations MAY opt to include the time in their
  Server.random values in order to accomodate clients which use  
  that field for time synchronization.

How does the TLS server know if the client uses the field for synchronization?  This feels like an excuse for a lazy implementation to leave it in, and the text does not explain the risk. Yes, there is a risk -- peer-to-peer TLS or peer-to-peer DTLS (such as for WebRTC and DTLS-SRTP).  I would rather kill this entirely, and if someone needs synchronization they can run TLS 1.0-1.2, or use some other protocol like NTP.

-d

On Jul 16, 2014, at 8:09 AM, Eric Rescorla <[email-masked]> wrote:

> On Sun, Jun 22, 2014 at 10:17 PM, Joseph Salowey (jsalowey) <[email-masked]> wrote:

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 18 Jul 2014 15:56:30 -0700

I left this as an open issue per chair direction:

https://github.com/tlswg/tls13-spec/issues/64

I'll take this as an argument on one side of the issue. Let's discuss
in YYZ.

-Ekr

On Fri, Jul 18, 2014 at 3:51 PM, Dan Wing <[email-masked]> wrote:

> How does the TLS server know if the client uses the field for
> synchronization?  This feels like an excuse for a lazy implementation to
> leave it in, and the text does not explain the risk. Yes, there is a risk
> -- peer-to-peer TLS or peer-to-peer DTLS (such as for WebRTC and
> DTLS-SRTP).  I would rather kill this entirely, and if someone needs
> synchronization they can run TLS 1.0-1.2, or use some other protocol like
> NTP.
>
> -d
>
>