search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
534 stars 46 forks source link

Secure time syncronisation (with tlsdate) #2342

Open rugk opened 7 years ago

rugk commented 7 years ago

An exact time of a device is an important thing for many cryptographic actions (e.g. in TLS/PKI) and therefore the integrity of any time synchronisation should be ensured.

Currently this is AFAIK best possible with tlsdate, a tool, which uses the timestamp send in TLS connections and therefore ensures the integrity of the timestamp one gets.

Preferably this should be used for all VMs.

adrelanos commented 7 years ago

tlsdate has been developed by Jacob Appelbaum (@ioerror). Due to the recent news surrounding him, him now doing no more public communication, I think it is safe to assume he will stay away from the computer security and development community. So it is probably save to assume all of his projects abandoned.

adrelanos commented 7 years ago

Disclaimer: As a developer of sdwdate I am probably biased.

https://github.com/ioerror/tlsdate

Pros:

Cons:

adrelanos commented 7 years ago

A great deal was spend on secure time synchronization by @HulaHoopWhonix and me.

Help with ticket Qubes-Whonix-Gateway as ClockVM, more generally, sdwdate tickets or sdwdate-gui tickets would be appreciated!

rugk commented 7 years ago

Wait a minute: What is currently used by QubesOS? Sdwdate?

Personally, I'd say sdwdate looks nice too. So if it has already been implemented feel free to close this issue.

rugk commented 7 years ago

Cannot connect to (most) Tor hidden services, because most of those do not support SSL.

Facebook does. :smiley:

adrelanos commented 7 years ago

rugk:

Wait a minute: What is currently used by QubesOS? Sdwdate?

Still NTP. Only Qubes-Whonix uses sdwdate. That's what the ticket I linked above is for.

Personally, I'd say sdwdate looks nice too. So if it already has been implemented feel free to close this issue.

I guess we can use a ticket to fix secure time synchronization.

rugk commented 7 years ago

tlsdate isn't abandoned, stop slandering jacob

I think the personal issues of a developer do not matter. It is his project, which matters here, so let us looking at the facts.

This looks a bit like the project is not developed actively anymore. To be fair I'll ping @ioerror.

rugk commented 7 years ago

FYI there is also a new protocol by @agl for secure time synchronisation: roughtime (more information).

jpouellet commented 7 years ago

OpenNTPD is relevant here and IMO should be considered.

It has a much better security track record than ntp.org ntpd.

Relevant feature here, from the OpenNTPD man page:

ntpd(8) can be configured to query the ‘Date’ from trusted HTTPS servers via TLS. This time information is not used for precision but acts as an authenticated constraint, thereby reducing the impact of unauthenticated NTP man-in-the-middle attacks. Received NTP packets with time information falling outside of a range near the constraint will be discarded and such NTP servers will be marked as invalid. -- http://man.openbsd.org/OpenBSD-current/man5/ntpd.conf.5#CONSTRAINTS

marmarek commented 7 years ago

Indeed interesting. Any idea why it isn't packaged in Fedora?

Best Regards, Marek Marczykowski-Górecki Invisible Things Lab A: Because it messes up the order in which people normally read text. Q: Why is top-posting such a bad thing?

jpouellet commented 7 years ago

Pinging OpenNTPD-portable maintainer: @busterb

Indeed interesting. Any idea why it isn't packaged in Fedora?

IIRC there was a period where it was being maintained only in OpenBSD's tree, but this is no longer the case for almost 2 years now. Perhaps simply nobody picked it up?