IETF Logo Mail Archive

Re: [TLS] About encrypting SNI

Daniel Kahn Gillmor <dkg@fifthhorseman.net> Tue, 13 May 2014 17:54 UTC

Return-Path: <dkg@fifthhorseman.net>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3A9F1A0101 for <tls@ietfa.amsl.com>; Tue, 13 May 2014 10:54:07 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hy5bL27GaMD5 for <tls@ietfa.amsl.com>; Tue, 13 May 2014 10:54:05 -0700 (PDT)
Received: from che.mayfirst.org (che.mayfirst.org [209.234.253.108]) by ietfa.amsl.com (Postfix) with ESMTP id 86BAE1A0116 for <tls@ietf.org>; Tue, 13 May 2014 10:54:05 -0700 (PDT)
Received: from [10.70.10.127] (unknown [38.109.115.130]) by che.mayfirst.org (Postfix) with ESMTPSA id 705EBF984; Tue, 13 May 2014 13:53:56 -0400 (EDT)
Message-ID: <53725C34.8060105@fifthhorseman.net>
Date: Tue, 13 May 2014 13:53:56 -0400
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Icedove/24.5.0
MIME-Version: 1.0
To: "Salz, Rich" <rsalz@akamai.com>, Erik Nygren <erik+ietf@nygren.org>, Andy Lutomirski <luto@amacapital.net>
References: <2A0EFB9C05D0164E98F19BB0AF3708C7120A04ED40@USMBX1.msg.corp.akamai.com> <534C3D5A.3020406@fifthhorseman.net> <474FAE5F-DE7D-4140-931E-409325168487@akamai.com> <D2CB0B72-A548-414C-A926-A9AA45B962DA@gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C7120B490162@USMBX1.msg.corp.akamai.com> <CACsn0cmusUc3Rsb2Wof+dn0PEg3P0bPC3ZdJ75b9kkZ5LDGu_A@mail.gmail.com> <534DB18A.4060408@mit.edu> <CABcZeBOJ7k8Hb9QqCAxJ_uev9g_cb4j361dp7ANvnhOOKsT7NA@mail.gmail.com> <CA+cU71kFo6EihTVUrRRtBYEHbZwCa9nZo-awt4Sub2qXcKHC7g@mail.gmail.com> <CAK3OfOi1x9huaazwcO=d72mfOFuV_RyXnfHmFRduhhbJE2miYw@mail.gmail.com> <CALCETrWukS2QJSb01n7OpXD2iaK43OhZr4E8YZyJ6JaorCdBKw@mail.gmail.com> <CAKC-DJjgFrAmxkC-MsmL+-uRWpN_mDPGkV_g-6DhbVH+69EQEQ@mail.gmail.com> <2A0EFB9C05D0164E98F19BB0AF3708C7130ABEA050@USMBX1.msg.corp.akamai.com>
In-Reply-To: <2A0EFB9C05D0164E98F19BB0AF3708C7130ABEA050@USMBX1.msg.corp.akamai.com>
X-Enigmail-Version: 1.6+git0.20140323
Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="aOGUwxLveFju13X3EAUC2APXuao1V1MH7"
Archived-At: http://mailarchive.ietf.org/arch/msg/tls/Dfnyfxo6_A9h5YyGBIPUdmomu4Q
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] About encrypting SNI
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 13 May 2014 17:54:08 -0000

On 05/13/2014 09:07 AM, Salz, Rich wrote:
>>  Especially given that there's little value in encrypting SNI with[out] encrypting/securing DNS, associating the two has some nice mutually-motivating properties.
> The “[out]” is the important missing part, I think.

yes, indeed :)  But that's what the dns-privacy discussion is about.

  https://www.ietf.org/mailman/listinfo/dns-privacy

If we don't offer a standard mechanism for protecting the
confidentiality of SNI (at least against passive monitors) in upcoming
versions of TLS, then the dns-privacy discussion is going to have
serious trouble sustaining its work by an analgous "little value
unless..." argument.  We shouldn't sabotage that work.

The TLS WG needs to fix the SNI leak, and DNS confidentiality needs to
be addressed by the DNS folks if we want to protect this information
against passive eavesdropping.

	--dkg

v2.23.0 | Report a Bug | By Email