openssl/openssl — pull request #23 by nmathewson (2013-09-20 05:08:28+00:00)
Title: Let's stop sending gmt_unix_time

Hi, all.

Ben Laurie asked me to do this as a pull request. I've sent the most ambitious version by asking that it go into 1.0.1.

This patch's goal is to simply stop sending gmt_unix_time as a part of client or server Random fields.

We discussed this on the tls-wg mailing list last week, and the best use of the gmt_unix_time field anybody found was the tlsdate program -- but tlsdate is also from Tor, and tlsdate is easily adapted to speak HTTPS instead: see my tlsdate repository.

The main rationale for having gmt_unix_time in SSL3 in the first place was to prevent collisions if the RNG was broken. But it's neither necessary nor sufficient, and it leads to bad linkability issues in practice. See the tls-wg mailing list for further discussion.