Re: [Hotrfc] ECH Deployment Considerations

Hi Andrew,

This is to let you know that we received your HotRFC abstract. You'll be on the agenda. 

If you will be participating remotely, which is fine, please let us know (so we're not looking around the room to try to find you, during the HotRFC slot).

Please send us your slides and any abstract updates no later than the first day of the upcoming IETF meeting, Saturday, at 2400 UTC. This will allow us to upload everything to the datatracker without wild panic and confusion.

To help others help you - please make sure you're clear on what you want from other participants. You might be looking for people to help you on new proposals, specifications, implementations, or a variety of other things. You can put that in your slides, or just say it out loud, but don't let it be a mystery!

And thanks for participating in HotRFC!

The HotRFC Team

Liz Flynn
Project Manager / IETF
lflynn@amsl.com

> On Jul 21, 2023, at 1:39 PM, Andrew Campling <andrew.campling@419.consulting> wrote:
> 
> Talk title: ECH Deployment Considerations 
> 
> Presenter, Affiliation, and whether you'll be presenting in person or remotely: Andrew Campling, 419 Consulting, in person 
> 
> Short topic abstract (topics should be IETF- or IRTF-related in some way)
> We are working on a document that is intended to inform the community about the impact of the deployment of the proposed Encrypted Client Hello (ECH) standard that encrypts Server Name Indication (SNI) and other data.  Data encapsulated by ECH (ie data included in the encrypted ClientHelloInner) is of legitimate interest to on-path security actors including those providing inline malware detection, parental controls, content filtering to prevent access to malware and other risky traffic, mandatory security controls etc.
> 
> The current draft of the document already includes observations on current use cases for SNI data in a variety of contexts.  It highlights how the use of that data is important to the operators of both public and private networks and shows how the loss of access to SNI data will cause difficulties in the provision of a range of services to end-users, including the potential weakening of cybersecurity defences.  Some mitigations are identified that may be useful for inclusion by those considering the adoption of support for ECH in their software.
> 
> What you're looking for (education, collaborators, implementers, etc.)
> We'd welcome input from additional collaborators to augment the contributions that we have already and are continuing to gather, especially from the end-user and opsec communities.
> 
> Coordinates to learn more, contact those involved, participate in existing mailing lists and scheduled meetings, and/or relevant formal or side meetings.
> Andrew Campling and Arnaud Taddei will be available in Continental 2-3 on Tuesday from 8-8:30am or can be reached via Andrew.Campling@419.Consulting and Arnaud.Taddei@Broadcom.Com respectively.
> 
> 
> Any relevant drafts or helpful resources you'd like collaborators to look at - https://datatracker.ietf.org/doc/draft-campling-ech-deployment-considerations/ <https://datatracker.ietf.org/doc/draft-campling-ech-deployment-considerations/>
> 
> To provide slides, submit ppt or pdf to hotrfc@ietf.org <mailto:hotrfc@ietf.org> no later than Saturday, 2023-07-22, 2400 UTC.
> 
> 
> 
> -- 
> Hotrfc mailing list
> Hotrfc@ietf.org
> https://www.ietf.org/mailman/listinfo/hotrfc