Re: [dnssd] Next steps for privacy discovery
Christian Huitema <huitema@huitema.net> Mon, 29 October 2018 17:21 UTC
Return-Path: <huitema@huitema.net>
X-Original-To: dnssd@ietfa.amsl.com
Delivered-To: dnssd@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1])
by ietfa.amsl.com (Postfix) with ESMTP id 22757131038
for <dnssd@ietfa.amsl.com>; Mon, 29 Oct 2018 10:21:18 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5
tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7,
SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44])
by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id 32xS3hABIs2x for <dnssd@ietfa.amsl.com>;
Mon, 29 Oct 2018 10:21:15 -0700 (PDT)
Received: from mx43-out1.antispamcloud.com (mx43-out1.antispamcloud.com
[138.201.61.189])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by ietfa.amsl.com (Postfix) with ESMTPS id E8979131023
for <dnssd@ietf.org>; Mon, 29 Oct 2018 10:21:14 -0700 (PDT)
Received: from xsmtp04.mail2web.com ([168.144.250.231])
by mx62.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.89) (envelope-from <huitema@huitema.net>) id 1gHBE0-0004fX-8Z
for dnssd@ietf.org; Mon, 29 Oct 2018 18:21:13 +0100
Received: from [10.5.2.49] (helo=xmail11.myhosting.com)
by xsmtp04.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.63) (envelope-from <huitema@huitema.net>) id 1gHBDq-0005pX-U3
for dnssd@ietf.org; Mon, 29 Oct 2018 13:21:08 -0400
Received: (qmail 14842 invoked from network); 29 Oct 2018 17:20:59 -0000
Received: from unknown (HELO [192.168.1.100])
(Authenticated-user:_huitema@huitema.net@[172.56.42.225])
(envelope-sender <huitema@huitema.net>)
by xmail11.myhosting.com (qmail-ldap-1.03) with ESMTPA
for <dnssd@ietf.org>; 29 Oct 2018 17:20:59 -0000
To: Lanlan Pan <abbypan@gmail.com>
Cc: dnssd <dnssd@ietf.org>
References: <48bc4612-018e-7aac-6492-05657c466313@huitema.net>
<CANLjSvXkQS3hGYCHoXu-jNP0Hvad02XBw4AsPMwTM02BvQkKKQ@mail.gmail.com>
From: Christian Huitema <huitema@huitema.net>
Openpgp: preference=signencrypt
Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata=
xsBNBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS
HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO
I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy
IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ
olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB
AAHNJ0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PsLAeQQTAQIAIwUC
UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m
VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf
wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3
6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0
D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd
6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1bOwE0EUhFfyAEIAKp7Cp8lqKTV
CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG
5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ
bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o
G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y
wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAcLBfgQYAQIACQUCUhFfyAIb
LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c
YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az
tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w
uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq
4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz
BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT
u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST
Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7
jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw
Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY
1cnrjgAWUh/Ucvr++/KbD9tD6C8=
Message-ID: <0f32e79a-447a-f308-4888-4037a41716dd@huitema.net>
Date: Mon, 29 Oct 2018 10:20:56 -0700
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <CANLjSvXkQS3hGYCHoXu-jNP0Hvad02XBw4AsPMwTM02BvQkKKQ@mail.gmail.com>
Content-Type: multipart/alternative;
boundary="------------C426693994AA3714F6D694B9"
Content-Language: en-US
X-Originating-IP: 168.144.250.231
X-AntiSpamCloud-Domain: xsmtpout.mail2web.com
X-AntiSpamCloud-Username: 168.144.250.0/24
Authentication-Results: antispamcloud.com; auth=pass
smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com
X-AntiSpamCloud-Outgoing-Class: unsure
X-AntiSpamCloud-Outgoing-Evidence: Combined (0.25)
X-Recommended-Action: accept
X-Filter-ID: EX5BVjFpneJeBchSMxfU5rm4BWBOK7o3nnEkYLYU6hd602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx
q3u0UDjvOzXMPpKBnlzcICbdbWbUSKtVjyn5UrUp4n4yKOOaq9AxWU3OM5er+4OpHk4e537NbVDj
fzzJ6O8jiVhZi+WiYeCsScX6I9Dl5i6VrUM1b/j5NAmFR3BiNNySzE1qhn3ItE5EpHPznVavQp4h
1cyzxbQFXqQgkkYk8mNUb0+uxPxhiSGt4Ko2sv7hY6P0Yu3OA+AIcPc2JG++Fh0y/kogNkMJ0464
etNXHOU+5Kb0QuG3bATPP9eeLWC5kDweN7crsXBXvrLBlKCVRjjdPbjQ4HmidG0pg2HLuLsP3mPp
isElTs5Ex5aNZlcgVQFtAhrEij3dKxLhoxcmaInYbR5vlqETd+klAX+KFYkIxu6zxdn+X2XX9bIs
GDSYq5OAASmskVIcMSgqtcKbU9La+AHiCFB9vuYMeDoXsMJDD9CZFW2DHXeua4usuyudZl7ZJWmg
5a0jiD6XqsJZtjQxlyCdsexk4wJWtdaqW2wvzQnHqHofPwUimsNGvJJilSn4u6QSZMYxY+yfwQdi
60gXjcORueAs95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GALxCCXdUXmVhCtBec/fcEYvj
esdofIZr77ejLGfC2JB7N1zg8T9ahw4hquQDupK1jk8cW9l7L/bUyy3TdA61l2cpmNv6myoo0El0
HMr4saZ1zojKkehi/vTYmvdG6r3KiNIivy+nwsaRXVdompsKqyK6MiFNXPsSc8iR2XN+gTM3647l
NwN4qOsSZg+fYhVZGz9r7Mz0gFF1wxz5bb0bhP2vPRlp44C0jVYGRiPSt4ToCZPO2GKNZaMtjfyA
obtcMvAFMvX7q8M4x6bP/gjzw0OjTdGcfvx5IojyUdakbY3OIKvEx19waJj/yR/yCVBWvmU/ts+C
IC6rClmkQnuoxlv2OKHH5lr9xXvSM4nM3avg
X-Report-Abuse-To: spam@quarantine6.antispamcloud.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/dnssd/vH1Vqy948pTcHN8IJfxLSvTUPXE>
Subject: Re: [dnssd] Next steps for privacy discovery
X-BeenThere: dnssd@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Discussion of extensions to DNS-based service discovery for routed
networks." <dnssd.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dnssd>,
<mailto:dnssd-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dnssd/>
List-Post: <mailto:dnssd@ietf.org>
List-Help: <mailto:dnssd-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnssd>,
<mailto:dnssd-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Oct 2018 17:21:18 -0000
On 10/28/2018 6:48 PM, Lanlan Pan wrote: > > > Christian Huitema <huitema@huitema.net > <mailto:huitema@huitema.net>>于2018年10月26日周五 下午3:09写道: > > ... > > 4) If we kept the current "two phase" structure, use a TLS protocol > extension to demonstrate knowledge of the server's public key in the > client hello. I think we can build on the work done for SNI > encryption, > which would fit quite well. > > > I wonder if we could consider about use tls psk (pre-shared key) ? > server can assign different key to different client. That's what we were specifying in the current privacy draft. There are two issues. The first one is that if you use TLS-PSK, the Client Hello must include a key identifier. If there is a different key for each client, the key identifier could become a client identifier. We solved that by using a "predictable nonce" for key identifier. The second issue is of course that assigning different keys to different clients requires extra management at the server, something that is not needed in the "private public key" class of solutions. -- Christian Huitema
- [dnssd] Next steps for privacy discovery Christian Huitema
- Re: [dnssd] Next steps for privacy discovery Bob Bradley
- Re: [dnssd] Next steps for privacy discovery Lanlan Pan
- Re: [dnssd] Next steps for privacy discovery Christian Huitema
- Re: [dnssd] Next steps for privacy discovery Mohit Sethi M
- Re: [dnssd] Next steps for privacy discovery Christian Huitema
- Re: [dnssd] Next steps for privacy discovery Daniel Kaiser
- Re: [dnssd] Next steps for privacy discovery Daniel Kaiser
- Re: [dnssd] Next steps for privacy discovery Lanlan Pan