Re: [TLS] About encrypting SNI

[Eric Rescorla <[e-mail]>]

On Mon, Apr 14, 2014 at 7:51 AM, Russ Housley <[e-mail]> wrote:

>
> > I think Rich Salz has outlined very compelling reasons not to support
> SNI.
>
> While I might quibble with a detail here or there, I do agree with the
> conclusion.  If you need to protect SNI, then TOR or to a lesser extent
> TLS-in-TLS can be used.
>

I'm not sure that this addresses the requests I have heard for SNI
encryption which is to conceal the sites people are going to by default
rather than as a special case for the privacy conscious. Hopefully
some of the people who have asked for this (e.g., dkg) will weigh in
but as I understand it, the concern is that if the only people who
attempt to conceal the site being connected to are the privacy
conscious, then that's a signal that those connections are worth
monitoring.

It's certainly the case that there are some additional changes that
would be required to make concealing SNI worth doing
(principally encrypted name resolution, but also a clear model
for how to do traffic padding and other things), but conversely
if we don't change TLS to permit concealing the SNI, then we
won't get as much value from encrypted DNS.

I'm not saying that either of these are slam dunk arguments, but
I wanted to make sure they were on the table.

-Ekr