As I understand the paper An Improved Clock-skew Measurement Technique for Revealing Hidden Services (6/23 = pdf page 3), it implies that a NTP client leaks the system's local time because of TCP sequence numbers.

Is this the case or does that paper mean something else?

2 Answers 2


Regardless of what is contained in the paper a standard ntp request datagram does contain a timestamp that represents the time the datagram was sent. From page 22 of the RFC:

Origin Timestamp (org): Time at the client when the request departed
for the server, in NTP timestamp format.

The answer to the question "Does ntp leak system time?" is "Yes. A standard ntp installation will leak local time to all of servers that have been configured for time syncronization."

RFC 5905: https://www.ietf.org/rfc/rfc5905.txt

Addendum: As far as the paper goes the reference to NTP is whether NTP skew adjustments affect the timer in question. From the paper

ICMP timestamps have a fixed frequency of 1 kHz. Their disadvantage is that they are affected by clock adjustments done by the Network Time Protocol (NTP) [9], which makes estimation of variable clock skew more difficult.


No, the paper means something else.

The paper talks about connecting multiple times to the same Tor Hidden service to increase the load, and at the same time measuring clock skew from candidate IP addresses. If the candidate shows clock skew during the attack, the server can be identified.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .