Re: [TLS] New Draft: Using DNS to set the SNI explicitly

[Ben Schwartz <[e-mail]>]

Thanks for the feedback everyone!  I've incorporated your suggestions and
made a new version:
https://tools.ietf.org/html/draft-schwartz-dns-sni-01

Diff:
https://www.ietf.org/rfcdiff?url1=draft-schwartz-dns-sni-00&url2=draft-schwartz-dns-sni-01

On Tue, Feb 7, 2017 at 11:12 AM, Ben Schwartz <[e-mail]> wrote:

> Hi TLS,
>
> Like a lot of people here, I'm very interested in ways to reduce the
> leakage of users' destinations in the ClientHello's cleartext SNI.  It
> seems like the past and current proposals to fix the leak are pretty
> difficult, involving a lot of careful cryptography and changes to clients
> and servers.
>
> While we're trying to figure that out, I think there's a simple trick that
> could help a lot: just let domain owners tell users an alternate SNI in a
> DNS entry.
>
> Here's the full draft:
> https://tools.ietf.org/html/draft-schwartz-dns-sni-00
>
> If you just want to glance at it, I recommend Figure 2.
>
> Please read and critique!  This is a starting point; the contents will
> change based on your input.
>
> Thanks,
> Ben Schwartz
>