Re: [hrpc] "Paul Vixie and Peter Lowe on Why DoH is Politically Motivated"

[Eric Rescorla <[e-mail]>]

On Mon, Nov 15, 2021 at 10:09 AM Vittorio Bertola <
[e-mail]> wrote:
> Not really - DoT is a protocol designed to operate in the clear and
> to be easily detected and controlled, while DoH was designed with
> the explicit objective of masquerading the traffic within other
> HTTPS exchanges and make it impossible to block or even detect the
> communication.

I don't think responding to the broader points you are making is
likely to get us anywhere productive, but I did want to respond
to your comparison of DoH and DoT, which I don't think is really
that accurate.

The usual reasoning here is that it's hard to filter DoH because
it shares the same ALPN and port number with HTTPS, whereas
DoT does not. However, this is misleading in several respects.

However, at present, it is generally possible to filter DoH because
DoH and ordinary HTTPS are usually on different hosts and therefore
you can use SNI. It's true that it's possible to co-host DoH in such a
way that it is indistinguishable from non-DoH HTTPS traffic, but it is
*also* possible to co-host DoT and HTTPS in this way, provided that
(1) you use a non-standard port and (2) you use ECH. The point here is
that either DoH or DoT can be run in a way that makes it hard to filter
if that's what you're trying to do.

-Ekr