tirdad - TCP ISN CPU Information Leak Protection

Kicksecure ™

Download

On Computer USB Installation Intel / AMD64 ARM64 Raspberry Pi PPC64 Windows (VM) Mac Linux (VM) VirtualBox (VM) Qubes (VM) KVM (VM) Debian morph to Kicksecure More options Source Code

About

Overview Features Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Forum Best Practices Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

This page explains a Linux TCP Initial Sequence Number (ISN) side-channel information leak and introduces tirdad, a kernel module that helps mitigate it by randomizing TCP ISNs.

TCP ISN CPU Information Leaks

• Issue summary: The Linux kernel has a side-channel information leak bug that can leak information through outgoing TCP traffic. This can allow side-channel attacks because sensitive information about a system's CPU activity may be inferred remotely.

• Why it matters: This may be particularly dangerous for long-running cryptographic operations.
• Real-world impact: Research has demonstrated that related techniques can be used for de-anonymization of location-hidden services.
• Clock skew notes:
  • Leak source: Clock skew is leaked through TCP ISNs (Initial Sequence Numbers) by the Linux kernel.
  • Remote detection: Clock skew can be remotely detected by observing ISNs.
  • Attack amplification: Clock skew can be induced by an attacker by producing load on the victim machine.

What the Linux ISN leaks is the difference between two timestamps, not the timestamp itself. A difference lets you work out drift and skew, which can help someone fingerprint the computer hardware, its environment and load. Of course that only works if you can probe a computer, and maintain the same source/destination port and IP address.Add research idea for Linux TCP Initial Sequence Numbers may aid correlation: comment by Steven J. Murdoch

... it is worth complaining to the kernel developers for the simple reason that adding the 64ns timer post-hash probably *does* leak side channels about CPU activity, and that may prove very dangerous for long-running cryptographic operations (along the lines of the hot-or-not issue). Unfortunately, someone probably needs to produce more research papers before they will listen.Add research idea for Linux TCP Initial Sequence Numbers may aid correlation: comment by Mike Perry

• Further reading:
  • Introduction: An analysis of TCP secure sequence number generation in Linux and its privacy issues.
  • Background discussion: Initial sequence number generation in Linux TCP stack
  • Linux source reference: Linux source: secure_seq.c (v3.16-rc1)
  • Forum discussion: TCP ISNs and temperature induced clock skews
  • Forum discussion: TCP ISN CPU information leak protection (tirdad)
  • IETF tcpm thread: IETF: [tcpm Security concerns with relative timestamp exposure through TCP ISNs - mailing list thread]

Mitigation

TCP Initial Sequence Numbers (ISNs) randomization to help prevent TCP ISN based CPU information leaks.

tirdad is a kernel module to hot-patch the Linux kernel to generate random TCP Initial Sequence Numbers for IPv4 and IPv6 TCP connections.

Platform specific.

• Kicksecure: tirdad is installed by default.
• Kicksecure for Qubes: Requires In-VM Kernel.

Architecture Support

tirdad has limited Intel/AMD64 only. For "normal" computers that most people are using. At the time of writing, tirdad has limited Architecture Support. For technical reasons, see footnote.

For example, tirdad is unsupported on ARM64, Apple Silicon (M#). This list is not exhaustive.

amd64 might imply AMD only. This is wrong.

amd64 means Intel and AMD.

For technical reasons, in Debian (and in many other Linux / Freedom Software related places) both, Intel and AMD, is called amd64. This is common knowledge without controversy among technical people, in doubt see Wikipedia X86-64.

Development

• source code: https://github.com/Kicksecure/tirdad

Footnotes

Kicksecure A secure by default operating system with the latest security research in place.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Kicksecure is proudly supported until 2026 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Kicksecure we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2026 ENCRYPTED SUPPORT LLC

Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!