Re: TCP timestamp starting value

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

> Wouldn't a better idea be to compute HASH(cookie,src,dst) + uptime for
> some random cookie created at boot time? Essentially, you give each
> target a unique monotonic time base, without leaking any data about the
> perceived local time.
I thought about something like that, but then the peer would be able to tell 
when you booted (because the timebase changed). The elegance (or so I think) 
of using real time is that the peer can't tell a reboot from an intermediate 
network failure.
On the other hand, what's so bad about "leaking" information on my perception 
of UTC time?
Perhaps people concerned about privacy in this field should speak up which 
kind of information they not want to leak (and why)? To my knowledge, we 
don't want to leak uptime because a) you could tell how stable the machine 
is, b) you could infer that certain kernel patches can't possibly have been 
applied and c) you could test if some attack you just tried lead to a 
re-boot (which is what the attacker may want or may not want to happen).