Re: [TLS] About encrypting SNI

[Andy Lutomirski <[e-mail]>]

On Wed, Apr 16, 2014 at 7:32 AM, Brian Sniffen <[e-mail]> wrote:
>> Furthermore, no offence to Rich, but I suspect if you told him "We'll
>> build the DNS subdomain forwarding, and you can use that or just not
>> encrypted SNI", he will choose not to use it. Maybe I'm wrong, but
>> since he argued against it initially, I'll make the leap.  So making
>> it opt-in seems to be as equivalent to building an optional feature
>> that almost no one will use from the beginning.
>
> Yes: we will not use encrypted SNI.  We can't.  We need to put thousands
> of HTTP hosts with incompatible crypto requirements on each IP address.
> Per-IP keys don't help us very much.

Would a protocol along the lines of my strawman work for you?  I
explicitly did not require that the eventual cipher suite match for
different SNI values.  I even made it possible to for whatever
receives the initial SSL connection to strip the SNI encryption and
hand the connection of to something else, without sharing any
long-term secrets between the machines in question.

--Andy