Re: [DNSOP] Proposal for a new record type: SNI

Warren Kumari <> Wed, 15 February 2017 00:32 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3108612945B for <>; Tue, 14 Feb 2017 16:32:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 4-KbdiWPzGXJ for <>; Tue, 14 Feb 2017 16:32:05 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400d:c09::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 88B48129444 for <>; Tue, 14 Feb 2017 16:32:05 -0800 (PST)
Received: by with SMTP id u25so138760979qki.2 for <>; Tue, 14 Feb 2017 16:32:05 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20150623; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc; bh=PrjZ3ySCkS9KvY8s6eho2cnMtrQZtqw1OwAZJRHBRT8=; b=0zXOYNBnB3zqumO6fjl8ZYEm9p/eyLEVS02+aC/DHrULl7K12Gf0CaMVM/iKe6j2QS A4/26tR3jKNvn5ShM58vGR7z6v1QCtd5/RMKXzIS1/LpJJEPdfsXjWA37OdIfIcv3Ncv 3CNpmPnCO6FRrAP3hH7KVqYynUUYLUUU7e4bTXIGHoO8RQBeMYqQAhHaQIzUgFXbw8LO CNiHXXhm2p4mZG1qUbe/F0BpnwoO4hhKmVQiClXxJPwspFu6ISOd8tR5H8bMKMoeX1j2 KaEkAMAxS+1eYfPjdiK6dJWBESCs7m43Qn+AiUBbf/jhbTaXyzB7Fs0+pScNI98SSuJY 1rFg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20161025; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc; bh=PrjZ3ySCkS9KvY8s6eho2cnMtrQZtqw1OwAZJRHBRT8=; b=gMaY8AUu3Fx+lt4CsWOv23xUF28qcw8pXxoXUptV19mgHvNYH/K4C+h8jqon90DJJH KuzwItVycpHxjNosT9CRo8UvARU9nsyvHLsHJY1uqHb5HHkg1zeTB/ySu1r1Fc+gwABE qhVD6upVNKxE3niVpjceWb/s8p4wj3eB7IQpFrtH6LEB8aTlwryKAwKi0bYZGUOH467y fsbIYe0MIwON3Qgcw523TVhbkS3atqFHPtNOjUchhwrjJPtdD+KoJ6Wuu/Y5GlCSRgdg yeOOwXHl60nABhAbR1YS0Gn00EPBEMLvV9T9aJTppkt7GAP8EOYE6AwlIuiiNcZ2G2Qr ECsA==
X-Gm-Message-State: AMke39nqEJNNA7VchyH/CDzh6Va23Z63Ux/OjZEFs7lju1+r1chTID2koIaKES9Jq0/6Ao3WyJ3vBAGS5SksAMH8
X-Received: by with SMTP id u193mr33199890qka.72.1487118724446; Tue, 14 Feb 2017 16:32:04 -0800 (PST)
MIME-Version: 1.0
Received: by with HTTP; Tue, 14 Feb 2017 16:31:33 -0800 (PST)
In-Reply-To: <20170214221432.15487.qmail@ary.lan>
References: <> <20170214221432.15487.qmail@ary.lan>
From: Warren Kumari <>
Date: Tue, 14 Feb 2017 19:31:33 -0500
Message-ID: <>
To: John Levine <>
Content-Type: text/plain; charset=UTF-8
Archived-At: <>
Cc: dnsop <>, Paul Wouters <>
Subject: Re: [DNSOP] Proposal for a new record type: SNI
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: IETF DNSOP WG mailing list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 15 Feb 2017 00:32:07 -0000

On Tue, Feb 14, 2017 at 5:14 PM, John Levine <> wrote:
> In article <> you write:
>>This seems like a bandaid to TLS that I think just needs
>>fixing in the TLS protocol.
> For once I agree with Paul.
> If you're going to change the client anyway, why is this better than a
> modified handshake that sets up the encrypted channel before sending
> the SNI?  I realize this is not a great time to open up TLS, with the
> dust from TLS 1.3 just settling, but there's never a good time for
> some stuff.

I'm /soooo/ not a TLS person, but I think that this was discussed in
the TLS WG and didn't make it into the final spec -- it requires (at
least) an additional RTT. You do get SNI encryption with Zero-RTT, but
it's too later by then...
Some slideware:
The DNS SNI lookup could at least be done in parallel with the
"normal" DNS one (and, possibly returned in a
draft-wkumari-dnsop-multiple-responses answer :-))

> You should assume that bad guys have access to passive DNS databases,
> so it's not hard to reverse the indirection that SNI records provide.

Yup. I believe that much of the privacy benefit is gained if you
happen to host your site on the same domain / IP as many other sites.
Unfortunately this is true not just for domain fronting / this
technique, but for many other situations -- it doesn't matter how well
the SNI is hidden, if you connect to an IP address which only hosts a
small number of sites (or sites all on the same topic) you've lost.

An example of this is - the only other site on that IP is - if you had an expectation of privacy, it
probably doesn't matter which one of the two names you went to...

> If you used TXT records the reversal would be slightly harder, since
> you'd have to pick them out from all the other cruft that's encoded
> in _prefix TXT records.

Hmmmm... are you suggesting we make TXT records cruftier to increase
privacy? :-)


> R's,
> John
> _______________________________________________
> DNSOP mailing list

I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.