[Secdispatch] Requesting dispatch of Oblivious HTTP

[Martin Thomson <[e-mail]>]

Hi,

Those familiar with oblivious DNS in its various forms [1][2] probably won't really need any introduction here.

This proposes a design that uses HPKE [3] and a proxy to provide a general framework for privacy for sensitive HTTP requests.  DNS is one fairly obvious application of this, but there are other applications that might benefit from this.  A generic framework will enable those applications.

The primary draft is:

https://www.ietf.org/archive/id/draft-thomson-http-oblivious-00.html

This draft describes the framework, plus how to encapsulate requests and responses using HPKE and the format of the server key configuration that clients need.

A supplementary draft describes a simple binary encoding for HTTP requests:

https://www.ietf.org/archive/id/draft-thomson-http-binary-message-00.html

The request here is to discuss what to do with this work.  Assuming this isn't dispatched before the next meeting, that includes a request for agenda time to continue or resolve that discussion.

In doing so, we might need to consider how this interacts with existing work in other groups, HTTP, ADD, and DPRIVE in particular.  I'll be sending notes to a few groups shortly advising them of this discussion and inviting them to offer input.

Cheers,
Martin


[1] https://dl.acm.org/doi/abs/10.1145/3340301.3341128
[2] https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh
[3] https://tools.ietf.org/html/draft-irtf-cfrg-hpke-07#appendix-A.1