9
$\begingroup$

I have a time authority and I want to securely set a client's time to this authority's time/date within a precision of $\delta$ seconds. The authority's public key is known to the client. This was my idea:

  1. A client sends a request with a 128-bit randomly generated nonce to the authority, and starts a timer.
  2. The server replies with $time\_data$ and $sign(time\_data || nonce)$. $time\_data$ is some representation of time with a high precision and constant length (for example 16 bytes).
  3. The client waits until a response is received or until $2\delta$ seconds have passed.
  4. The client stops the timer, having measured $\Delta t$ since it started, and verifies that ${\Delta t \over 2} < \delta$. Then it verifies the signature using the given time data and the latest sent nonce. If everything passes then it sets the time to $time\_data + {\Delta t \over 2}$. If not go back to step 1.

As far as I can see there is no attack on this scheme that allows any adversary to let the client accept a time that is not within $\delta$ seconds of the actual time of the authority. Am I missing something?

I'm also wondering if there's any way to improve precision above the minimum delay $\Delta t$ of the network without losing security of the synchronized time, similar to what NTP does with estimating network latency.

| improve this question | |
$\endgroup$
  • 1
    $\begingroup$ Why not simply use NTP over TLS? $\endgroup$ – Stephen Touset Aug 7 '13 at 21:21
  • 1
    $\begingroup$ @StephenTouset I don't know (and haven't found accesible modern literature) how secure NTP is against active attackers. And it kind of blows my technology stack out of the water in terms of complexity, both server-side and client-side. And doesn't NTP use UDP? $\endgroup$ – orlp Aug 7 '13 at 21:29
  • $\begingroup$ @StephenTouset Also I just realized TLS will likely be too expensive considering the budget and the expected workload of the server infrastructure. $\endgroup$ – orlp Aug 7 '13 at 21:53
  • 1
    $\begingroup$ @Thomas Why? 1) Then nonce serves as a challenge, else an attacker could simply return an old signed time. The nonce is an essential part of this scheme. 2) A signature scheme may or may not be randomized. I don't see how that matters here. $\endgroup$ – CodesInChaos Aug 7 '13 at 23:14
  • 1
    $\begingroup$ @B-Con: 1) Read: "The authority's public key is known to the client.". Also, what's the point of a signature if an adversary is assumed to be able to forge one? 2) Yes, the client should only accept the latest sent nonce - let me edit the question clearing that up a bit more. $\endgroup$ – orlp Aug 7 '13 at 23:19
7
$\begingroup$

Yes, this is a perfectly secure solution.

The principle drawback is that the precision available is limited by the round-trip time to the trusted time server. If the trusted time server is 50ms away (i.e., 100ms round-trip time), which is a plausible situation that might arise in real life, then you cannot synchronize the client's time to within a guaranteed precision of better than $\pm$ 50ms (or so). If this is adequate for your purposes, then yes, this is a fine solution. If this is not enough precision, then you have a harder problem, and I'm not sure whether there's anything you can do in the presence of an active adversary.

Despite what has been claimed in the comments, the nonce is essential to security (otherwise a man-in-the-middle could trivially break the protocol). Keep the nonce. Do not remove it. I think you know all that already, just re-emphasizing it for clarity.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks, that confirms my idea. I know Crypto.SE disapproves of literature recommendations, but do you know any literature on securely (that is with a provable precision bound $\delta$) synchronizing time beyond the latency of the connection, possibly affected by an active adversary? $\endgroup$ – orlp Aug 8 '13 at 21:37
  • 1
    $\begingroup$ @nightcracker, alas, I don't know of any literature on it. On first glance, it hardly seems possible (though maybe I shouldn't say that, maybe someone has some clever way that hasn't occurred to me). I wasn't aware that there was any issue with literature recommendations; my impression is that there's an issue with open-ended questions that solicit many answers ("what's the best book on cryptography?"), but not focused questions ("what's the state of the art on X?"), particularly if you done some searching on your own first. $\endgroup$ – D.W. Aug 9 '13 at 8:52
  • $\begingroup$ This close reason made me think that: "Requests for reference recommendations are off-topic here." $\endgroup$ – orlp Aug 9 '13 at 8:56
  • 3
    $\begingroup$ @nightcracker: Our very first meta question was about literature recommendations (but see also this later question). Generally, I'd say the SE network frowns on 1) vague subjective questions with many equally valid answers and 2) answers that only link to external resources. Asking "What's a good book about X?" tends to fall into both categories, whereas "Is there any way to do X?" doesn't. $\endgroup$ – Ilmari Karonen Aug 9 '13 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.