[Whonix-devel] Can TCP Sequence Numbers leak System Clock?

Patrick Schleizer adrelanos at riseup.net
Wed Mar 1 19:34:00 CET 2017


Is it possible to derive and/or estimate the system clock by observing
TCP sequence numbers?

Jacob Appelbaum [1]:
> In the Linux kernel, TCP Sequence numbers embed the system clock and
then hash it. Yet another way to leak the system clock to the network.

As I understand the paper 'An Improved Clock-skew Measurement Technique
for Revealing Hidden Services' [2] (6/23 = pdf page 3), it implies that
TCP sequence numbers can leak the system clock.

> Some clocks can be queried remotely:
> Clock: TCP sequence numbers
> Firewall: Cannot be blocked
> Other: Linux specific, very difficult to use

Is this the case or does that paper mean something else?

On the other hand, I've read the claim "The kernel embeds the system
time in microseconds in TCP connections.", but I haven't found the code
in question to confirm, that this is so. Any idea?

Was also recently raised on Tor's issue tracker. [3]

More resources: [4] [5]

CC'd whonix-devel. By answering to this e-mail, your reply will also be
posted on the whonix-devel public mailing list.


[1] https://twitter.com/ioerror/status/509159304323416064
[2] http://caia.swin.edu.au/talks/CAIA-TALK-080728A.pdf
[3] https://trac.torproject.org/projects/tor/ticket/16659
[4] http://lxr.free-electrons.com/source/net/ipv4/tcp_ipv4.c

More information about the Whonix-devel mailing list