Re: [Secdispatch] Request for a slot in the agenda of secdispatch on the 26th

Document: draft-taddei-ech4ent-introduction-00.txt

Hi Arnaud,

This seems to be largely a critique of ECH, so as far as SECDISPATCH
goes, the answer is that this should go to TLS. With that said, I
believe most of the points that you are raising were already
considered when we decided to do ECH, so I wouldn't expect this to
change the trajectory of the WG. You could, of course, also make these
as Last Call comments. I don't think this needs an agenda slot at
SECDISPATCH.

As far as the substance goes, I would make two points.

First, I think there is perhaps a disconnect about the way that ECH is
likely to be deployed, especially in Enterprise
environments. Specifically:

1. Because ECH depends on DNS, if clients us the Enterprise DNS,
   then that server can simply strip the ECH records from
   DNS responses. I believe this applies to non-Firefox browsers,
   as they use the DHCP-advertised resolver.

2. Although ECH is not yet widely deployed in clients, I would
   expect it to be configurable via enterprise policies. You
   mention intercepting proxies a number of times in S 3.5,
   but enabling those proxies requires control of the endpoint,
   which should be sufficient to disable ECH.

My point here is that in both cases the Enterprise has the opportunity
to disable ECH, so there shouldn't be any real impact. Of course,
this doesn't apply to BYOD, but the solution there is to actually
get management of the device--at least enough to disable ECH.

Second, in cases where the client is untrustworthy, then SNI cannot be
trusted, even if it is in the clear. The client can put an innocuous
SNI in the ClientHello. The same applies to the server certificate
because the client and server don't need to comply with RFCs 2818 or
6125. If what you are worried about is malware connecting to C&C, then
SNI is insufficient.  It's true that SNI is useful for compliant
clients and servers, however, for instance if you want to prevent
people from browsing specific sites.

-Ekr

On Mon, Jul 11, 2022 at 8:33 PM Arnaud Taddei <arnaud.taddei=
40broadcom.com@dmarc.ietf.org> wrote:

> Dear all, I would like to request a slot in the agenda of secdispatch on
> the 26th at IETF114 to present the I-D
> draft-taddei-ech4ent-introduction-00.txt
>
> I came back to IETF113 after an air gap of 2 years, so I am certainly very
> rusty but I could do some investigations since March and I would like the
> chance to share some ideas regarding ECH in the context of Enterprises and
> Organizations
>
> I will be there remotely
>
> Thank you for your consideration
>
>
>
> This electronic communication and the information and any files
> transmitted with it, or attached to it, are confidential and are intended
> solely for the use of the individual or entity to whom it is addressed and
> may contain information that is confidential, legally privileged, protected
> by privacy laws, or otherwise restricted from disclosure to anyone else. If
> you are not the intended recipient or the person responsible for delivering
> the e-mail to the intended recipient, you are hereby notified that any use,
> copying, distributing, dissemination, forwarding, printing, or copying of
> this e-mail is strictly prohibited. If you received this e-mail in error,
> please return the e-mail to the sender, delete it from your computer, and
> destroy any printed copy of it.
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch
>