{"record":{"id":"4f1f70a70f803db1","repo":"kovidgoyal/kitty","slug":"ignoring-encrypted-rc-command-with-timestamp-delt","errorCode":null,"errorMessage":"Ignoring encrypted rc command with timestamp {delta / 1e9:.1f} seconds from now. Could be an attempt at a replay attack or an incorrect clock on a remote machine.","messagePattern":"Ignoring encrypted rc command with timestamp (.+?) seconds from now\\. Could be an attempt at a replay attack or an incorrect clock on a remote machine\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kitty/remote_control.py","lineNumber":72,"sourceCode":"    if not isinstance(pcmd, dict) or 'version' not in pcmd:\n        log_error('JSON payload of remote command is invalid, must be an object with a version field')\n        return {}\n    pcmd.pop('password', None)\n    if 'encrypted' in pcmd:\n        if pcmd.get('enc_proto', '1') != RC_ENCRYPTION_PROTOCOL_VERSION:\n            log_error(f'Ignoring encrypted rc command with unsupported protocol: {pcmd.get(\"enc_proto\")}')\n            return {}\n        pubkey = pcmd.get('pubkey', '')\n        if not pubkey:\n            log_error('Ignoring encrypted rc command without a public key')\n        d = AES256GCMDecrypt(encryption_key.derive_secret(base64.b85decode(pubkey)), base64.b85decode(pcmd['iv']), base64.b85decode(pcmd['tag']))\n        data = d.add_data_to_be_decrypted(base64.b85decode(pcmd['encrypted']), True)\n        pcmd = json.loads(data)\n        if not isinstance(pcmd, dict) or 'version' not in pcmd:\n            return {}\n        delta = time_ns() - pcmd.pop('timestamp')\n        if abs(delta) > 5 * 60 * 1e9:\n            log_error(\n                f'Ignoring encrypted rc command with timestamp {delta / 1e9:.1f} seconds from now.'\n                ' Could be an attempt at a replay attack or an incorrect clock on a remote machine.'\n            )\n            return {}\n    return pcmd\n\n\nclass CMDChecker:\n    def __call__(self, pcmd: dict[str, Any], window: Optional['Window'], from_socket: bool, extra_data: dict[str, Any]) -> bool | None:\n        return False\n\n\n@lru_cache(maxsize=64)\ndef is_cmd_allowed_loader(path: str) -> CMDChecker:\n    import runpy\n\n    try:\n        m = runpy.run_path(path)","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/kovidgoyal/kitty/blob/6d5d0c440603ad9bdf6dcd599f73f6dde21acb44/kitty/remote_control.py#L54-L90","documentation":"After decrypting an encrypted remote-control command, kitty compares its embedded timestamp with the local clock; if they differ by more than ±5 minutes the command is rejected to block replay attacks.","triggerScenarios":"abs(time_ns() - pcmd['timestamp']) > 5*60*1e9 — the sending machine's clock is >5min off, or a captured payload is being replayed.","commonSituations":"System clock drift / NTP not synced on the client machine, dual-boot clock skew, VMs with paused time, or genuine replay attempts.","solutions":["Sync clocks: enable NTP/chrony on both client and server machines","Check timezone-independent system clock (UTC) correctness in VMs/dual-boot setups","If it persists after sync, treat as suspicious and audit who has socket access"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from time import time_ns\nassert abs(time_ns() - payload['timestamp']) <= 5 * 60 * 1e9, 'clock skew > 5 min'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run NTP/chrony on all machines using remote control","Re-check clock sync in VMs and dual-boot setups before debugging kitty"],"tags":["kitty","remote-control","clock-skew","replay-attack"],"backgroundTag":"timestamp-clock-skew","analyzedSha":"6d5d0c440603ad9bdf6dcd599f73f6dde21acb44","analyzedAt":"2026-08-27T14:20:20.142Z","schemaVersion":2},"datasetVersion":"2026-08-27T19:17:21.184Z"}