IETF Logo Mail Archive

Re: [TLS] Encrypting record headers: practical for TLS 1.3 after all?

Jacob Appelbaum <jacob@appelbaum.net> Thu, 03 December 2015 03:49 UTC

Return-Path: <jacob@appelbaum.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB20E1B2C51 for <tls@ietfa.amsl.com>; Wed, 2 Dec 2015 19:49:03 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.278
X-Spam-Level:
X-Spam-Status: No, score=-1.278 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FM_FORGED_GMAIL=0.622] autolearn=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DmqhETtykLNk for <tls@ietfa.amsl.com>; Wed, 2 Dec 2015 19:49:03 -0800 (PST)
Received: from mail-ig0-x22f.google.com (mail-ig0-x22f.google.com [IPv6:2607:f8b0:4001:c05::22f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25E5E1B2C2E for <tls@ietf.org>; Wed, 2 Dec 2015 19:49:03 -0800 (PST)
Received: by igcto18 with SMTP id to18so3398653igc.0 for <tls@ietf.org>; Wed, 02 Dec 2015 19:49:02 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=appelbaum-net.20150623.gappssmtp.com; s=20150623; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=NmsVBEOp41LCixL3L5CYBKvNxraZU0OsdFuJvAl+Osk=; b=zaWnXE8j5Ovcp4pMrpFVdX9Zk4sOGJuo5PKssSU1G+0jHK+isPSlvUS1B7nnw3FGaS 2mJqJz6O26i5XLqMGh1SfzwZYMrv6ROwuoFdMn0ZJbEU0Ed4BGRuHkIysw3x+mwVl429 HRVobjFGg7KhbmDHZijsSS9Z8J9da6GHuliJSIDQEiziDtY71lvKivBPIwapjIMFBk3q qzooah5Epvo+lCKz/wNHezwqT+azTQk7nnwfK6TVj+zxRn3uNsVUdZIs31i7EMP0maJC TGKiHuNzr9CIGO/RlXvKyi1tKX/UNQpLP3HzJd/ZEHWiQR5SwAEQgqLan+Ab2u2RPvlC bQtg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=NmsVBEOp41LCixL3L5CYBKvNxraZU0OsdFuJvAl+Osk=; b=Vw4PX6jSt6vpzlDY3ojicPGmW3SHH7ACEtjiZCzD97Sn8NAz0w9/0+lryjwMBKg3JB 188LwWUtz7qJe/2MBJYWDCiGJHoiZOEjCvw1dwbITBJQyurCdMJIqh3kVdwPrxVvNLzQ zYpb4KpXVpnNt9GmfLHAyElr2C9u+zITXkZi7U6M1PDe+UA5L4oVswoLD6BAyfa5nXDb /2HlyBTvFVnK2FPQWK2+v8jg/ReQcXg4/BwWmf8jbcKqacU4DgiG2RBubN06jba85uSj PyZQWqGnww4RiKHrxuHubpHRItYavWUPnCxXmIcE5pdFKHv27iq/Ltosbdlc0Q974U7B bsUw==
X-Gm-Message-State: ALoCoQmqt7sYcxWfYKyVZb4d34OUtUtXKYs72vCxbWVhc0M5ahXLbsAamA9FH3FuUBF9EmaYlrBX
MIME-Version: 1.0
X-Received: by 10.50.225.1 with SMTP id rg1mr16802335igc.78.1449114542587; Wed, 02 Dec 2015 19:49:02 -0800 (PST)
Received: by 10.79.70.71 with HTTP; Wed, 2 Dec 2015 19:49:02 -0800 (PST)
X-Originating-IP: [46.188.10.23]
In-Reply-To: <60e21928e9174d8ea7eb84b00ad85884@usma1ex-dag1mb1.msg.corp.akamai.com>
References: <CAFggDF3HP5u0YP0UP_HrrZnrTnzc-CD1EG0grZBcb5sB7A2fAA@mail.gmail.com> <20151202160837.6016A1A39B@ld9781.wdf.sap.corp> <CAFggDF0D3Rgav-4xg-11u0igMyMXvAWT+JNt2r1xyQnpvm08Qw@mail.gmail.com> <0ba184c45d44474e961a2aaac82fec0e@usma1ex-dag1mb1.msg.corp.akamai.com> <CAFggDF119jxPSXUAe2E4y_TQds4P3K1eTGM3sZHSa=NoeMOV-A@mail.gmail.com> <1b5cf52ca90e45bd82f5247ca675dead@usma1ex-dag1mb1.msg.corp.akamai.com> <CAFggDF24hhrXS95kONb_N6XHrO+11wFsAkHOpYZ_uu5RvyV+Kg@mail.gmail.com> <60e21928e9174d8ea7eb84b00ad85884@usma1ex-dag1mb1.msg.corp.akamai.com>
Date: Thu, 03 Dec 2015 03:49:02 +0000
Message-ID: <CAFggDF3wehZX9meomiAx0A79qPemmhrBs9c8cqJSqMYiDJ7iUw@mail.gmail.com>
From: Jacob Appelbaum <jacob@appelbaum.net>
To: "Salz, Rich" <rsalz@akamai.com>
Content-Type: text/plain; charset="UTF-8"
Archived-At: <http://mailarchive.ietf.org/arch/msg/tls/7epbdO8l4nVQnqA7m0I0yzdF_LI>
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Encrypting record headers: practical for TLS 1.3 after all?
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 03 Dec 2015 03:49:04 -0000

On 12/3/15, Salz, Rich <rsalz@akamai.com> wrote:
>> It provides protection. Specifically it provides confidentially.
>
> It is far from clear that the privacy gains anything in the form of
> practical protection.  Having looked at it, I'm unconvinced.  And I've been
> a privacy/crypto advocate for a very very long time.
>

I resolve DNS through Tor and so in that case, my TLS connections
often exit over a different circuit. My TLS connection would not
otherwise leak the host I'm requesting if the protocol had a way to
protect that data. It doesn't. The protocol leak is the problem.

All the best,
Jacob

v2.23.0 | Report a Bug | By Email