Clock synchronization issues

The PACT protocol uses timestamps as part of contact tracing during reporting.

A report includes a (seed, timestamp) pair. The timestamp is expected to be around 14 days old.

There are many possible usage of those timestamps:

• Cull the number of IDs we need to check from a given seed.
• Use tracing-time timestamps to limit which IDs to check against.

The problem with either approach is an assumption that clocks on phone are reasonably synchronized. Phone clocks can be out of sync due to user error, software bugs, etc. A quick online search highlights software issues like this: https://support.google.com/fi/thread/547604?hl=en

Justin found a couple time synchronization packages for both iOS and Android:

https://github.com/instacart/TrueTime.swift https://github.com/instacart/truetime-android

We could adopt those packages as it should increase the accuracy of our system for cooperative devices.

Beyond that, we must have some form of server-side validation of provided timestamps as a way to protect against adversarial devices.