IETF Logo Mail Archive

Re: [OPSEC] Operational Security Considerations and Encrypted Client Hello

Andrew Campling <andrew.campling@419.consulting> Tue, 28 March 2023 04:37 UTC

Return-Path: <andrew.campling@419.consulting>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4918FC151557 for <opsec@ietfa.amsl.com>; Mon, 27 Mar 2023 21:37:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.117
X-Spam-Level:
X-Spam-Status: No, score=-1.117 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_NEUTRAL=0.779, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=netorgft5189650.onmicrosoft.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L31t8e0O4Je1 for <opsec@ietfa.amsl.com>; Mon, 27 Mar 2023 21:37:08 -0700 (PDT)
Received: from GBR01-LO2-obe.outbound.protection.outlook.com (mail-lo2gbr01on060f.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe15::60f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FE32C422705 for <opsec@ietf.org>; Mon, 27 Mar 2023 21:35:55 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DdWq/oj1RnaofmuQYH/NzJnJNTpwMfOM7qYi8YX1M9/Pmh2idZzuJLHo5ieioNu/Ebkzb7P0t/WIj27VZRaoho0iqmuA6nvngkat/8xtbwZRBHzYIkPQw54h494k/PdEvvrkkgbTrc57WB090OxEj4zETsh9CJr7CZ+PjWvOqBqos7h6BI606g8VpTkCbuCIjOT16mZVZVeaoLRNOz+auQO86BI+XSg8D8ndMdJcZJ+UHQ6ucobX4LV2b6q/+E5o0ee7JD3uBsSIOsticZuINTSEGeEvHBqJGHlNHmufurapOZ702c4cLegjuvghHo46NbeikkDxXIEfaTMK5xsTbw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cPYWqTct8P0YH8eQoLFJjlc5ohHL5F+FVWsn4rBzc/4=; b=Pkbz7Sfs4jfKsIcBEK4VNltiWMSy2tTSZEddW4eAOsWo+W7ni0DmqmSw5qGopNtMA2CmFUaiFJc+zsQ+otGWnfY2C38KSmqy/S5J21qq/taxaAG/bDaSY5MehR3TSVLtOs5J5Y9F1/YFM3QxxQAYVk2+WRsJpBOwiOKuOIsKkYMdV9iFYfzRA8JWPUXpnm43+caV1wHuDoLQFLb8W6VcvuxcDvzDiMcyvQcw1CbndH4KBH2t/8p0BI6ifNvGucplpbxm87LxNGn1s+cl9RS6fkrn1wHs9+e22uZFWyc0hhm3niZkLKZ+u7eJ6/p1QBSZxjtvjai10L+zZ3/TAiqUhQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=419.consulting; dmarc=pass action=none header.from=419.consulting; dkim=pass header.d=419.consulting; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NETORGFT5189650.onmicrosoft.com; s=selector1-NETORGFT5189650-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=cPYWqTct8P0YH8eQoLFJjlc5ohHL5F+FVWsn4rBzc/4=; b=Y5YNdeEhx4xU+3hbx1M57qi25AQmnDrmLTTtO8/okVrwJSlM4spnnJgIuRsw/IOJa4aKBCvuzDXQSPl6rI3ly/kibH7DGYQCkfGB7h0qZIZ+VV6WPMJtlIruR5GgWDdyzlk0QKdKn2slW+L0Tx7paWPOhzvZxLMzvfWgrlpeLgg=
Received: from LO2P265MB5160.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:253::13) by LNXP265MB2522.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:134::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6222.29; Tue, 28 Mar 2023 04:35:49 +0000
Received: from LO2P265MB5160.GBRP265.PROD.OUTLOOK.COM ([fe80::37fd:66c9:8b5c:3988]) by LO2P265MB5160.GBRP265.PROD.OUTLOOK.COM ([fe80::37fd:66c9:8b5c:3988%4]) with mapi id 15.20.6222.030; Tue, 28 Mar 2023 04:35:49 +0000
From: Andrew Campling <andrew.campling@419.consulting>
To: "opsec@ietf.org" <opsec@ietf.org>
CC: Arnaud Taddei <arnaud.taddei@broadcom.com>, Warren Kumari <warren@kumari.net>
Thread-Topic: [OPSEC] Operational Security Considerations and Encrypted Client Hello
Thread-Index: AdlCz8Exwj57s8YcQViYTBEc2ziV4AOc39CAA/rF9vA=
Date: Tue, 28 Mar 2023 04:35:49 +0000
Message-ID: <LO2P265MB51607552E05427E52B059635C2889@LO2P265MB5160.GBRP265.PROD.OUTLOOK.COM>
References: <CWXP265MB51533022E8400931CDF545C4C2A19@CWXP265MB5153.GBRP265.PROD.OUTLOOK.COM> <CAHw9_iL_GEvSLeY1a9z=GcSOhBJFv6zKrQLqYDRzb2Gpc1jBbA@mail.gmail.com>
In-Reply-To: <CAHw9_iL_GEvSLeY1a9z=GcSOhBJFv6zKrQLqYDRzb2Gpc1jBbA@mail.gmail.com>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=419.consulting;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: LO2P265MB5160:EE_|LNXP265MB2522:EE_
x-ms-office365-filtering-correlation-id: 5d3855be-8e53-4d68-7be8-08db2f45e83e
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: nneWfws3nDglswnQsEBRWskztUJmvdIcu098tRkwH3CbHNTFB3HfDGjXYsCEZo3k3A1qZWJupKYPT34tB/W0v6yu+beZtmCUMCmtWIM10Z5ZC+2FfTxpPbJPEyv9gPR1qUS9b49p47eq7FU1UicSSN7U0TCjHHY5NcRp5De0Ci6TePqniAOgETtvRREhoGMqBQzjsLR5W8n0WDk3B1A7sJ0aTXkGvgcfcIlcpOF5ENc7I8Ah2AczPUDo8NOWFLmyIP/PYiNAofd+OHlGJKCdQpf/MCgXgYJDHUeenhp9Nv3gQtHWuJ+gvt9UHX4AClbUtV4wNJYaZLgiNyz/gQh6GBBDcLOZ5c+AFwS2L9g0lq4p0J6kGDxSKwOnlP4+FDGoIuRxURpZBJ/z6Y2MF6QxNiPo+LMHhHCSWlTw0vIFSHORxTG+rHMrzDZASUD4nLSOu+OGrlgPbPOAKc24fugK9KX6HIE7x/sc0nEHITdsIPmQPEkPgzt+zbAas3h1SK/0JZUDeDDITZpoPWLlvIn7B51OtQkNaBUn6tDLiAC59KNWXkAS/IHK+YJNRwUMG6feT/WHHJSpJ43yLusrUL7Eg+KZ1U/0qfT5cb4yqGK6g5vVdRhY28jHJj/m9c+Sodxu
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:LO2P265MB5160.GBRP265.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230028)(396003)(346002)(366004)(136003)(376002)(39830400003)(451199021)(166002)(83380400001)(41300700001)(44832011)(52536014)(86362001)(33656002)(5660300002)(38100700002)(8936002)(122000001)(66446008)(54906003)(966005)(478600001)(7696005)(71200400001)(76116006)(8676002)(66946007)(66556008)(64756008)(2906002)(6916009)(66476007)(4326008)(38070700005)(53546011)(55016003)(6506007)(15650500001)(9686003)(316002)(186003)(26005)(46492015); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: 4BVTVHxfiYvV95hdhhz3FtprIeRRyrLYnnbUImgHMnFLxAIvcA3yinPhfOC+WfnBASzZFTxEVcNTl/9jZks8k7u8kg4XFq/Hmz4q1wux7azDrr6MbfaxZfUY7NWNMiOgXRNVJDHiM5RmmJOHiYFah4HSxKzHMlbSN/lavrY1DBUpulpSi1/K5H6P42v+2vgQJXXnGPv5zeVRaTmdMgxNsM2TjaN+iw0B1qm90hFJMNScpxKYXIeekUWN7FIdccMtIQWMzuSl/wUBwAwZeB6DV6Z19h43ILn/FOumrPhHGa4+cuuA+1U9WU1dXrMEW8vd0kVjtD60H3UHcdl0yDeYTRlDzmrTlI9KMstxK8fLNukH3X0j0In2WdL0mK32u4UELpNScJ3WKf+wX4hezdvInYzelO/UlI/35JkXdMPjr8BOlcpJ1H2TlXwGM5VdJSWPk4SNwQDGQ8IDld4tzcoX1C/tD2clSkPPAeCG+hvGoggJK3aWi7PcAzW/jLW7orInP663W96wZFpE1PMHGuHSVQtrLpVtFnEsmKRQnc8dZgCr9m016WMfzSEcSnz01DdL2jxl/rzEv9daaWKXuDe+U+s08Oj6SD4dU1ItLYoin+NG9FwXMkwjA5DSAtPteFZnelE/TAfSUv6Lctd1ZYha6rBCP2fDbezoaH4toJkiZPWkDCtZJMeSWiTA6BQHIvHObs9P06xxygD2LB6bw0fS456VsXo8bj5TdcFKtClmm8fnyI7i2pmaL15k5bZZkJyNNRX53uE2pbxMI6Tyqd6ZtpYgjaNohwdkRnAOragOON2GM6x9+ww9TpacPAaflsmbhVWuVCfLrjsZv3HNlsUtH9574xqJtwnnm+sayoXOS1Adgv1NC8o4pj7vAZ66nIj+x+jkMfgkpDDiLcvyT/QPHiGQ6BGodnfrcg86wnamYcdDxfghjd3/xrgaSibd33r0Ncv/yrq/eJyZI/e77+16eE+IrfzsxpHcKTZe0ho0CjvLWiF2Yxn1X+9hhDvnyTEg6GXQ/jWCskZbxGMTzWy8EWxUkdhDqEJ5PlHw0xAyD5vDKLov87ItBSMjtuBtC0keh3D+4NhpSc2Mc69l4MmMX5ikT34Pa8YLWYhcOi23MWzEV+wuEhTgi+ks0VkhF/acB8LHePbmbPBzVmMuG/5JNZ0S9Vhe1lP/u5QdQJfqW4EkpVgSQOUfK/d6n1LakRB4IvAc421c8PZMZXIKQ6LOWRC8RC1NWSky9gPLClmUp8fixDzaS0EfG88dJYNx5f0bHkPuTyEsQNxeObYdGUvpMcsA0qM26dZ3etzdzI6wNlbtyUcDoBOfaaH/SPIlOuB4Vh+2n6kUlXRIyEPofIv4opkns9O6uMAAD0955BUHhPDexEzAg3jv2kZmtXZxQJKXBAeJfaepY6Vgtx6cK+it82w26t+8xRAmdyIN9t/eLPz/QTH13tNUnLgJUcWoEQvJ6rVOto782wtHi5+d/H5k4fZL1J9ee2cxVVa0g0iMYuNqjPCfBGkfzGKD6bAzn2scIQRFrbgRQMFu9fB6cWJwWdGmBJF1R7q/sLjLSAyjJaaB/oBuZFQ7+mk5ZEQfC5nWmXazcg2T+oWryEh9wZEzVQ==
Content-Type: multipart/alternative; boundary="_000_LO2P265MB51607552E05427E52B059635C2889LO2P265MB5160GBRP_"
MIME-Version: 1.0
X-OriginatorOrg: 419.consulting
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB5160.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 5d3855be-8e53-4d68-7be8-08db2f45e83e
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2023 04:35:49.8192 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 9c2ced3e-7522-4755-87dc-f983abc66ec3
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 5XBji9I1heQX7CX4rObcc97fXkapq5DlJoNifMpaKU4kEQCyq0HBJMbrso234bEsZ3hxpaFoJ4btFlODvBv2dLqEF5zwFZkRRHzeiml16Hw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LNXP265MB2522
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/03U2oLyeojZ9zaTWXkrSR5ZN50A>
Subject: Re: [OPSEC] Operational Security Considerations and Encrypted Client Hello
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 Mar 2023 04:37:12 -0000

Hi Opsec WG
We’re looking forward to talking about the operational considerations of Encrypted Client Hello at the working group meeting on Thursday.  In the meantime, you may be interested to note that we have just updated the I-D to version -05, which is accessible at https://datatracker.ietf.org/doc/draft-campling-ech-deployment-considerations/.

Andrew

From: Warren Kumari <warren@kumari.net>
Sent: 07 March 2023 22:22
To: Andrew Campling <andrew.campling@419.consulting>
Cc: opsec@ietf.org
Subject: Re: [OPSEC] Operational Security Considerations and Encrypted Client Hello

Hello WG!

I'd encourage the WG to review this document - it's relatively short, and is an easy read.

ECH is likely to be a fairly active topic in the IETF, and has significant Opsec implications. The document is on the OpSec agenda, and so having read it before the meeting will be really helpful..

W



On Fri, Feb 17, 2023 at 8:15 AM, Andrew Campling <andrew.campling@419.consulting<mailto:andrew.campling@419.consulting>> wrote:
Hi Opsec wg
You may be aware that some of us have been looking at the potential impact of the deployment of Encrypted Client Hello (ECH), an extension to TLS1.3+.  We are continuing to develop the draft, which is accessible at https://datatracker.ietf.org/doc/draft-campling-ech-deployment-considerations/.  You will note that many of the issues that we have identified relate to various aspects of operational security in a variety of contexts.

We have been encouraged to share the draft with the Opsec working group to see if there is interest in the topic within the group, hence this post.  I and at least one of my co-authors will be present in Yokohama for the IETF 116 meeting and will be happy to present the highlights of the draft if time is available on the wg agenda.


Andrew

_______________________________________________
OPSEC mailing list
OPSEC@ietf.org<mailto:OPSEC@ietf.org>
https://www.ietf.org/mailman/listinfo/opsec

v2.23.0 | Report a Bug | By Email