sdwdate: Secure Distributed Web Date

Introduction

Time keeping is crucial for security, privacy, and anonymity. sdwdate is a Tor-friendly replacement for rdate and ntpdate that sets the system's clock by communicating via end-to-end encrypted TCP with Tor onion webservers. Chosen time providers are exclusively reputable sources (whistle-blowing and privacy-friendly onion sites) that are highly likely to be hosted on different hardware.

At random intervals, sdwdate connects to a variety of webservers and extracts the time stamps from http headers (see: RFC 2616).

sdwdate vs ntp

Table: sdwdate vs ntp Comparison

	sdwdate	ntp
Written in memory-safe language	Yes	No
Distributed trust	Yes	No
Secure connection by default (authentication and encryption)	Yes	No
Gradual clock adjustments	Yes	Yes
Daemon	Yes	Yes
Functional over Tor	Yes	No
Tor not required	No	Yes
Client, time fetcher	Yes	Yes
Server, time provider	No, not yet	Yes
Apparmor profile	Yes	Yes
Drop-in config folder	Yes	No
Proxy support	Yes	No
Possible to secure by default on GNU/Linux distribution level	Yes	No
Secure	Yes	No
Optional GUI	Yes, sdwdate-gui (a systray icon)	No

See also:

• Time Attacks
• Dev/TimeSync
• sdwdate-gui

TODO:

• Server, time provider
• sdwdate issue tracker: https://phabricator.whonix.org/project/view/6/

sdwdate Design

Server Authentication

sdwdate only connects to Tor onion services, which are encrypted by default and do not rely on SSL certificate authorities (CAs). Three different pools are used for time sources so that if too many connections fail for any given pool, the pool is considered as potentially compromised and sdwdate aborts.

sdwdate Source Pools

Determining what sources should be trusted it is important issue; this is also a problem with NTP.

The sdwdate pools used by Whonix are based on stable and reliable Tor onion service web servers. The pools are listed in /etc/sdwdate.d/30_default.conf.

The various onion services are categorized into three different pools according to their members' relationship to the members in other pools. For instance, any member in one pool should be unlikely to share logs (or other identifying data), or agree to send fake time information, with a member from the other pools. In basic terms, sdwdate picks three random servers - one from each pool - and then builds the mediate (middle position) of the three advertised dates.

sdwdate is only using 'pal' pools and not relying on 'neutral' and 'foe' pools as per tails_htp, because a good rationale for that approach has not yet been provided.

Trusted Time Sources

The links below are listed to keep track of pool candidates:

• https://en.wikipedia.org/wiki/SecureDrop
• https://freedom.press/securedrop/directory
• https://www.riseup.net/en/tor#riseups-tor-hidden-services
• https://en.wikipedia.org/wiki/GlobaLeaks#GlobaLeaks_uses
• site:http://leakdirectory.org onion

Footnotes

---

Random News:

Have you read our Documentation, Technical Design and Developer Portal links yet?

---

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)

Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint.