Re: [quicwg/base-drafts] SNI encryption (#795)

[hardie <[e-mail]>]

On Wed, Oct 25, 2017 at 2:39 PM, Mike Bishop <[e-mail]>
wrote:

> Secondary certificates seems like a good way to achieve this for HTTP/*
> over TLS. Put your CERTIFICATE_REQUEST for the real hostname in 0-RTT data.
> A more general possibility would be the "tls1.3" ALPN token, where you
> carry a TLS 1.3 session on Stream 1, with the ClientHello (in 0-RTT data if
> you can) and use of other streams is discouraged or prohibited.
>
> I think that means that the ALPN token can't be used to select the
protocol.  When we get to the point of having multiple protocols, some
subset of which might be present but served by different back end
processes, that could pose a problem.  Would you be okay with
$PROTOCOL.tls1.3 as a pattern?  That can still get you to the point where
the server name is encrypted, even if the protocol is known to anyone able
to observe the ALPN token.

Ted



> —
> You are receiving this because you were mentioned.
> Reply to this email directly, view it on GitHub
> <https://github.com/quicwg/base-drafts/issues/795#issuecomment-339479877>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/ABVb5GJOEkjMNuD9_e8EVqxvrUafm5Hrks5sv6qMgaJpZM4PjfJL>
> .
>


-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/quicwg/base-drafts/issues/795#issuecomment-339496867