Re: [Hotrfc] HotRFC: ECH Deployment Considerations

[Arnaud Taddei <[e-mail]>]

Thank you both Andrew and Liz, I will certainly be very happy to present.

From: Liz Flynn <[e-mail]>
Date: Sunday, 23 July 2023 at 10:52
To: Andrew Campling <[e-mail]>
Cc: [e-mail] <[e-mail]>, Arnaud Taddei <[e-mail]>
Subject: Re: [Hotrfc] HotRFC: ECH Deployment Considerations
Hi Andrew,

Thank you! I’m updating your abstract now and uploading the slides.

See you tonight!

Liz Flynn
Project Manager / IETF
[e-mail]<mailto:[e-mail]>




On Jul 22, 2023, at 1:59 PM, Andrew Campling <[e-mail]<mailto:[e-mail]>> wrote:

Hi
I’ve attched slides for our slot at the HotRFC session tomorrow and have also tidied up the abstract a little as I did th eoriginal on an overnight flight to hit the deadline whilst trying not to annoy my neighbours.

Andrew



Talk title: ECH Deployment Considerations

Presenter, Affiliation, and whether you'll be presenting in person or remotely
Andrew Campling, 419 Consulting and Arnaud Taddei, Broadcom, both in-person

Short topic abstract (topics should be IETF- or IRTF-related in some way)

We are working on a document that is intended to inform the community about the impact of the deployment of the proposed Encrypted Client Hello (ECH) standard that encrypts Server Name Indication (SNI) and other data.  Data encapsulated by ECH (ie data included in the encrypted ClientHelloInner) is of legitimate interest to on-path security actors including those providing inline malware detection, parental controls, content filtering to prevent access to malware and other risky traffic, mandatory security controls etc.



The current draft of the document already includes observations on current use cases for SNI data in a variety of contexts.  It highlights how the use of that data is important to the operators of both public and private networks and shows how the loss of access to SNI data will cause difficulties in the provision of a range of services to end-users, including the potential weakening of cybersecurity defences.  Some mitigations are identified that may be useful for inclusion by those considering the adoption of support for ECH in their software.

What you're looking for (education, collaborators, implementers, etc.)
We are looking for the involvement of additional collaborators to augment the contributions that we have already and are continuing to gather, especially from the end-user and opsec communities.

Coordinates to learn more, contact those involved, participate in existing mailing lists and scheduled meetings, and/or relevant formal or side meetings.
Andrew Campling and Arnaud Taddei will be on site in San Francisco all week and can also be reached [e-mail]<mailto:[e-mail]> and [e-mail]<mailto:[e-mail]> respectively.


Any relevant drafts or helpful resources you'd like collaborators to look at
Datatracker -  https://datatracker.ietf.org/doc/draft-campling-ech-deployment-considerations/<https://www.google.com/url?q=https://datatracker.ietf.org/doc/draft-campling-ech-deployment-considerations/&source=gmail-imap&ust=1690739549000000&usg=AOvVaw2lfhKH1wbKfpIrTsrrJsMk>
GitHub - https://github.com/echdeploy/draft-ech-deployment-considerations<https://www.google.com/url?q=https://github.com/echdeploy/draft-ech-deployment-considerations&source=gmail-imap&ust=1690739549000000&usg=AOvVaw2LDnAe4sEYyHNxcqBZx9s5>


<Encrypted Client Hello Deployment Considerations Hot RFC, 23-07-23.pdf>--
Hotrfc mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/hotrfc<https://www.google.com/url?q=https://www.ietf.org/mailman/listinfo/hotrfc&source=gmail-imap&ust=1690739549000000&usg=AOvVaw0cwu7Ujji-d7mVd16Q10Lx>


-- 
This electronic communication and the information and any files transmitted 
with it, or attached to it, are confidential and are intended solely for 
the use of the individual or entity to whom it is addressed and may contain 
information that is confidential, legally privileged, protected by privacy 
laws, or otherwise restricted from disclosure to anyone else. If you are 
not the intended recipient or the person responsible for delivering the 
e-mail to the intended recipient, you are hereby notified that any use, 
copying, distributing, dissemination, forwarding, printing, or copying of 
this e-mail is strictly prohibited. If you received this e-mail in error, 
please return the e-mail to the sender, delete it from your computer, and 
destroy any printed copy of it.