[Add] DDR and SNI -- proposed draft in TLS WG to fix IP addresses in SNI

[Erik Nygren <[e-mail]>]

At the risk of re-opening a can of worms, on a re-read of DDR last week
I was reminded how much I think we will regret not having clients send
the IP address in SNI, which there is no way to currently handle.
After some discussion with Rich Salz, I wrote up a draft for the TLS WG
on how IP addresses might be represented in SNI:

      https://datatracker.ietf.org/doc/draft-nygren-tls-ip-in-sni/

Actual discussion on the draft itself likely makes sense to happen
in the TLS WG.  (See the mail I just sent to the TLS list
on the topic.)   But if we can get this fixed/addressed in TLS,
it would be highly valuable if we could also fix it in DDR.

What motivated me to realize we need to solve this is that
draft-ietf-add-ddr uses IP SANs in a new way.  Rather than the
client connecting to an IP address and expecting to see a SAN
(where returning a cert associated with the IP address containing
a SAN that the client connected to is straight-forward),
DDR has clients connecting to a different IP and then
expects to find an original IP also in the SAN list.
This means that for an ISP with a large number of IPs
(or using a services who operates DoH service on-behalf
of many entities), you'd need to quickly/wastefully burn through IPv4
addresses to enable a unique cert per original IP.

As my employer operates recursive DNS services for ISPs,
I'm seeing serious challenges in being able to effectively enable
encrypted upgrades via DDR without having the desired IP address in SNI,
if only due to challenges with scaling up IPv4 addresses to deal
with the lack of SNI.

    Erik


---------- Forwarded message ---------
From: <[e-mail]>
Date: Wed, Jul 27, 2022 at 2:20 PM
Subject: New Version Notification for draft-nygren-tls-ip-in-sni-00.txt
To: Erik Nygren <[e-mail]>, Rich Salz <[e-mail]>



A new version of I-D, draft-nygren-tls-ip-in-sni-00.txt
has been successfully submitted by Erik Nygren and posted to the
IETF repository.

Name:           draft-nygren-tls-ip-in-sni
Revision:       00
Title:          Representing IP addresses in TLS Server Name Indication
(SNI)
Document date:  2022-07-27
Group:          Individual Submission
Pages:          7
URL:
https://www.ietf.org/archive/id/draft-nygren-tls-ip-in-sni-00.txt
Status:         https://datatracker.ietf.org/doc/draft-nygren-tls-ip-in-sni/
Htmlized:
https://datatracker.ietf.org/doc/html/draft-nygren-tls-ip-in-sni


Abstract:
   This specification provides a mechanism for clients to send IP
   addresses in a TLS Server Name Indication (SNI) extension as part of
   TLS handshakes, allowing servers to return a certificate containing
   that subjectAltName.  This is done by converting the IP address to a
   special-use domain name.




The IETF Secretariat