Re: [TLS] Resolution on gmt_time

It reads for TLS 1.3:
  Server implementations MAY opt to include the time in their
  Server.random values in order to accomodate clients which use  
  that field for time synchronization.

How does the TLS server know if the client uses the field for synchronization?  This feels like an excuse for a lazy implementation to leave it in, and the text does not explain the risk. Yes, there is a risk -- peer-to-peer TLS or peer-to-peer DTLS (such as for WebRTC and DTLS-SRTP).  I would rather kill this entirely, and if someone needs synchronization they can run TLS 1.0-1.2, or use some other protocol like NTP.

-d

On Jul 16, 2014, at 8:09 AM, Eric Rescorla <ekr@rtfm.com> wrote:

> See https://github.com/tlswg/tls13-spec/pull/65
> 
> Expected merge date: Friday Jul 18
> 
> 
> On Sun, Jun 22, 2014 at 10:17 PM, Joseph Salowey (jsalowey) <jsalowey@cisco.com> wrote:
> Thanks all. Based on the list discussion, the chairs believe there
> is rough consensus on the following points:
> 
> For TLS 1.3:
> - Remove GMT time from the ClientHello entirely.
> - Remove GMT time from the ServerHello at the MUST or SHOULD level.
> 
> For TLS 1.2:
> - Remove GMT time from the ClientHello entirely.
> - Remove GMT time from the ServerHello at the SHOULD level.
> 
> Next steps for TLS 1.3 are as follows:
> The editor is directed to remove GMT time from both random values
> and open an issue as to whether or not the ServerHello can have
> a time value in it.
> 
> Next steps for TLS 1.2 are as follows:
> Absent any objections, the chairs intend to adopt draft-matthewson
> as a WG draft. Anyone who objects to this, please say something by
> Friday June 27.
> 
> Joe
> (For the chairs)
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls