Re: [DNSOP] Proposal for a new record type: SNI

[Ben Schwartz <[e-mail]>]

On Fri, Feb 17, 2017 at 5:03 PM, John Levine <[e-mail]> wrote:

> In article <CAHbrMsA278usgFNzxhrsLS6_EfXPeMoAKN65ec0YhCW93oKNYg@
> mail.gmail.com> you write:
> >I know this approach is controversial, so I'm also very curious to hear
> any
> >suggestions of other ways that we could fix this privacy leak without
> >slowing down everyone's connections.
>
> I have problems with the word "other".  This approach depends for its
> security on the assumption that it is hard to reverse SNI record
> lookups, that is, to find the qname(s) that have SNI records with
> given contents.
>

That was not my intent, and I don't think it's accurate.  We can consider
two cases

1. Multiple domains on the same host set the same SNI record.  Possession
of a global DNS database is no help to the adversary.  The adversary still
cannot distinguish the domains.  This is the intended use.

2. A domain sets an SNI record that is unique to that domain.  This is not
the intended use.

Case 1 is achievable whenever there are multiple domains in a certificate
(Subject Alternative Name or wildcard), with greater privacy protection as
a wider range of domains shares a certificate.

Case 2 is the only option if the domain is alone in its certificate.  In
this scenario, with current TLS, this is unavoidable.

We can certainly imagine solutions to Case 2.  For example, the SNI record
could include a public key that can be used to encrypt the SNI, e.g. RDATA
= "pubkey=<base64 encoded key>".  I would strongly support such a proposal.

Implementation of such a proposal would require changes to TLS, but would
be compatible with this draft's extensibility model.  I view this draft as
a modest step toward such solutions, allowing us to separate the question
of a new DNS record from possible TLS changes.


> That is a poor assumption.  There are many large passive DNS
> databases, and a lot of people have access to them.  My working
> assumption is that anyone sophisticated enough to peek at TLS
> handshake packets is sophisticated enough to find a passive DNS
> source.
>
> So to me the question is whether the small speculative incremental
> increase in user security is worth the investment to define a new
> record type, add it to DNS servers and provisioning systems, add it to
> web server configuration languages, and set up whatever infrastructure
> is needed to coordinate the published SNI records and what the web
> servers expect.
>
> I'd also note that if the assumption is that people will publish SNI
> records through the usual registrar and dns hosting operators managed
> through web consoles, there is no chance that the webware will support
> SNI records.  We know this because they don't support any other
> RRTYPEs defined in the past decade, either.
>
> R's,
> John
>
> _______________________________________________
> DNSOP mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dnsop
>