Questions tagged [time]

For security issues relating to the system time of a host, or relating real-world clocks more generally. Please use the tags [timestamp] or [performance] for questions on those topics.

Filter by
Sorted by
Tagged with
61
votes
9answers
11k views

How important is local time for security?

I recently wanted to see what happens when I change my local time to something obviously wrong. I tried the year 2218, so 200 years in the future. The result: I couldn't access any website anymore (I ...
37
votes
3answers
7k views

Why should memcmp not be used to compare security critical data?

From man 3 memcmp: Do not use memcmp() to compare security critical data, such as cryptographic secrets, because the required CPU time depends on the number of equal bytes. Instead, ...
30
votes
12answers
8k views

Could I recover the content of file from its checksum/hash?

Let's say I have a video file that is split into multiple parts. Each piece is 2 Megabytes. I also have a list of the *insert hash name here* for each piece and also for the full file. Now assume ...
8
votes
1answer
3k views

What is the purpose of JSON Web Token (JWS)'s issued at “iat” field?

RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary: This claim can be used to determine the age of the JWT. What is the purpose ...
7
votes
1answer
3k views

PHP Session Vulnerability

I'm trying to solve a challenge on a CTF, with PHP sessions. The goal is to make check.php echo $_PASSWORD. I do not have access to the files themselves, and therefore I cannot edit them. My ...
6
votes
1answer
816 views

Mitigate Time Spoofing Attack

Say Alice receives synchronized time from Tina the timekeeper. Say Ted spoofs a GPS signal, fooling Tina about the current time. Tina sends this fake time to Alice. What can Alice do to avoid being ...
5
votes
1answer
668 views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
5
votes
1answer
267 views

What use does a TPM have for accurate timekeeping?

I stumbled across this image and something immediately stood out to me. This is a photograph of a discrete TPM card. That silver cylinder on the left is a crystal oscillator, used to tell time with ...
5
votes
1answer
480 views

Overall Security of Network Time Protocol

I am doing some research in order to get an understanding of the security of the Network Time Protocol. In particular, my goal was/is to understand how the protocol is secured and what the issues are. ...
4
votes
1answer
2k views

Brute Forcing LUKS Full Disk Encryption - Time?

let's say we have encrypted our drive with AES 256 XTS and the following Hash: SHA1 with ~500k Iterations and a 20+ password SHA512 with ~250k Iterations and the same 20+ password. Let's think of ...
4
votes
1answer
335 views

Can I disable access to JS APIs in the browser such as highres timers?

In the wake of recent news of CPU bugs like Meltdown and Spectre which rely on precise(-ish) measurments of elapsed time, I find myself in the mood for disabling things like window.performance.now() ...
3
votes
3answers
893 views

Feasibility of time-based database brute-force attacks on websites

I recently learned that there is an attack that utilizes the fact that when brute-forcing a compared string (e.g. hash from a password or token) in a database the query fails a few nanoseconds earlier ...
2
votes
2answers
406 views

Does x509 have an “issued at” timestamp? Can you tell when an x509 certificate was issued?

The JWT Spec (RFC 7519) has an issued at field ("iat"). Does x509 have any analogous value? I see a Validity field, but nothing else time related.
2
votes
1answer
54 views

Authorization expiration without reliable clock / time

I've been looking, but I think its impossible to find a pairing solution that has the benefits of authorization expiration and renewal (like x509 cert expiry and OAuth expires_in), but that works ...
2
votes
1answer
186 views

Are servers that do not implement time services vulnerable to clock skew attacks?

An article describes clock skew attack possibilities §§: These can be attacked by repeatedly connecting to the hidden service, causing its CPU load, hence temperature, to increase and so ...
1
vote
1answer
663 views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
1
vote
1answer
1k views

Can setting the date on your iPhone to the epoch really brick it? [closed]

So, I've started seeing warnings that there is a troll/hoax saying that people should set the date on their phone to 1st January 1970 to get a retro logo to display. The warnings say that this will ...
1
vote
1answer
137 views

Is it possible to verify that a signature was made prior to the content of the document it is found on?

In What to do after I signed a blank sheet of paper given to me by my manager?, a distressed individual (B) has signed a blank piece of paper and given it to an adversary (A). A has openly stated to ...
1
vote
1answer
60 views

How is resynchronization performed for security keys / MFA devices?

When a MFA (time based) device security key drifts out of synchronization there is a procedure to resynchronize it. But there is no input to the device itself. Smartphone apps don't have this ...
1
vote
5answers
359 views

Does disclosing server local time to users cause any security risks?

I need to implement a number of web pages for resetting an API access key: user must be logged in first user gets to "confirmation" page that has a "confirmation" link with a time token inserted user ...
1
vote
0answers
79 views

How to get a completely isolated virtual time using Xen? [closed]

Referring to the following quote https://www.kernel.org/doc/Documentation/virtual/kvm/timekeeping.txt 4.8) Covert channels and leaks In addition to the above problems, time information will ...
0
votes
1answer
56 views

Adobe PSIRT Average Response Time [closed]

Anyone have any experience in contacting the Adobe Product Security Incident Response Team (PSIRT)? I sent in an exploit that I found two weeks ago and I have not heard from them since. Would they ...
0
votes
0answers
59 views

Time of using proxy-servers?

For example using different proxies on some services-sites. Sometimes using e.g. tor, some connections change randomly. For which time-frame are such servers avaiable if we pick up some of such ...
-4
votes
2answers
4k views

AES algorithm encryption time

What is the time taken by an AES Encryption algorithm, with a key of 128 bits, operating on a normal computer (say with Intel i7) and what will be the impact be on the time if I wish to use a 256 bit ...