2. Conformance

As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.

The key words MUST and SHOULD are to be interpreted as described in [RFC2119].

Some conformance requirements are phrased as requirements on attributes, methods or objects. Such requirements are to be interpreted as requirements on user agents.

The IDL fragments in this specification must be interpreted as required for conforming IDL fragments, as described in the Web IDL specification. [ WebIDL]

3. Time Origin

The time origin is the time value from which time is measured:

• If the global object [HTML51] is a Window object, the time origin must be equal to:
  • the time when the browsing context is first created if there is no previous document;
  • otherwise, the time of the user confirming the navigation if a confirmation dialog is displayed during the prompt to unload algorithm;
  • otherwise, the time of starting the navigation responsible for loading the Window object's newest Document object.
• If the global object is a WorkerGlobalScope object, the time origin must be equal to the official moment of creation of the worker. [WORKERS]
• Otherwise, the time origin is undefined.

4. The DOMHighResTimeStamp Type

The DOMHighResTimeStamp type is used to store a time value measured relative from the time origin or a time value that represents a duration between two DOMHighResTimeStamps.

typedef double DOMHighResTimeStamp;

A DOMHighResTimeStamp SHOULD represent a time in milliseconds accurate to 5 microseconds - see 8. Privacy and Security.

5. The Performance interface

[Exposed=(Window,Worker)]
interface Performance : EventTarget {
    DOMHighResTimeStamp now();
    serializer = {attribute};
};

The now() method MUST return a DOMHighResTimeStamp representing the time in milliseconds from the time origin to the occurrence of the call to the Performance.now method.

6. The performance attribute

The GlobalPerformance.performance attribute allows access to performance related attributes and methods from the global object.

[NoInterfaceObject,
 Exposed=(Window,Worker)]
interface GlobalPerformance {
    [Replaceable]
    readonly attribute Performance performance;
};

Window implements GlobalPerformance;

WorkerGlobalScope implements GlobalPerformance;

7. Monotonic Clock

The time values returned when calling the Performance.now method on Performance objects with the same time origin MUST be monotonically increasing and not subject to system clock adjustments or system clock skew. The difference between any two chronologically recorded time values returned from the Performance.now method MUST never be negative if the two time values have the same time origin.

8. Privacy and Security

Access to accurate timing information, both for measurement and scheduling purposes, is a common requirement for many applications. For example, coordinating animations, sound, and other activity on the page requires access to high-resolution time to provide a good user experience. Similarly, measurement enables developers to track the performance of critical code components, detect regressions, and so on.

However, access to the same accurate timing information can sometimes be also used for malicious purposes by an attacker to guess and infer data that they can't see or access otherwise. For example, cache attacks and statistical fingerprinting is a privacy and security concern where a malicious web site may use high resolution timing data of various browser or application-initiated operations to differentiate between subset of users, and in some cases identify a particular user - see [ CACHE-ATTACKS].

This specification defines an API that provides sub-millisecond time resolution, which is more accurate than the previously available millisecond resolution exposed by DOMTimeStamp. However, even without this new API an attacker may be able to obtain high-resolution estimates through repeat execution and statistical analysis. To ensure that the new API does not significantly improve the accuracy or speed of such attacks, the recommended minimum resolution of the Performance interface should be set to 5 microseconds.

Mitigating such timing side channel attacks entirely is practically not possible: either all operations would have to execute in a time that does not vary based on the value of any confidential information, or, the application would need to be isolated from any time-related primitives (clock, timers, counters, etc). Neither is practical due to the associated complexity for the browser and application developers and the associated negative effects on performance and responsiveness of applications.