Re: [Add] Fwd: New Version Notification for draft-mglt-abcd-doh-privacy-analysis-00.txt

[Christian Huitema <[e-mail]>]

On 11/7/2019 10:47 AM, Rob Sayre wrote:

> On Wed, Nov 6, 2019 at 3:37 PM Christian Huitema <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     3) But of course there are exceptions to this general rule,
>     specifically
>     when the traffic uses TLS 1.3 and ESNI. That's where Daniel's
>     draft is a
>     bit weak. It develops the arguments (1) and (2), but stops there and
>     does not recognize the exceptions.
>
>     One first exception happens when the DNS requests to the local
>     resolver
>
>  
> ...
>
>     Another exception happens when the traffic uses TLS 1.3 and ESNI.
>
>
> There are other exceptions. For example, the SNI might not match the
> Host header in encrypted HTTP traffic.
>
> It could be something completely mismatched, or it could be a more
> specific subdomain of the host given in the SNI.

There may very well be other exceptions. I think that we should document
them, so we can properly discuss the various trade-off.

As for the HTTP Host vs SNI scenario, that's of course one possible
exception. Possible, because it depends whether the DNS lookup is for
the SNI or the SNI host. If the former, then it is not an exception:
doing a lookup for the SNI would not reveal anything that could not be
inferred from looking at the traffic. But looking for the inner host in
the DNS would indeed reveal that, in the same way that looking at the
ESNI does.

-- Christian Huitema