Re: [TLS] About encrypting SNI

On Tue, Apr 15, 2014 at 6:56 AM, Salz, Rich <rsalz@akamai.com> wrote:

> > So if you're hosting like tumblr, you can do yoavnir.tumblr.com and
> richsalz.tumblr.com and have a *.tumblr.com certificate.
>
> Yes, I know.  It would mean that aaa.privacy.org and kkk.privacy.orgwould be under the same DNS name.  You could mitigate that by having a
> CNAME entry.
>
> My question is about the security, not the discoverability (or vanity, if
> you will).

Rich,

I'm not sure I completely understand your proposal, so let me try to
restate it:

1. Privacy.org would host aaa.privacy.org, bbb.privacy.org, ...
zzz.privacy.org
and have a cert for *.privacy.org

2. This allows the user to avoid revealing his target server as long as it
is
matches *.privacy.org *and* he has some mechanism for suppressing SNI.

3. If the user wants to have www.zzz.org virtually hosted, he needs a CNAME
that points from www.zzz.org -> zzz.privacy.org.

Do I have this right?

-Ekr

         /r$
>
> --
> Principal Security Engineer
> Akamai Technology
> Cambridge, MA
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>