Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[Yoav Nir <[e-mail]>]

On Nov 12, 2013, at 12:06 PM, Ralf Skyper Kaiser <[e-mail]>
 wrote:

> Hi,
> 
> Martin, you are right that SNI is currently implemented and transmitted in clear.
> This was however not the primary design goal but rather a choice of convenience
> and lack of better/easier ideas. The primary design goal for SNI was to allow
> multi-homing HTTPS servers on the same IP (so that apache can select the
> correct x509 certificate for whatever site the client requested). There is no
> practical or security benefit  or transmitting SNI in clear. 

There is a design I've seen at a site some years ago. I don't know how popular this is, but at least there's a non-empty set of servers doing this.

They have multiple servers within the datacenter and a reverse proxy. All server names resolve to the address of the reverse proxy. For each connection, it reads the ClientHello and extracts the SNI, and then forwards the ClientHello (and the rest of the connection) to the appropriate server. In no SNI, there is a default server (which is where most of the traffic is going anyways)

With encrypted SNI it would have to actually terminate the TLS rather than just look at the ClientHello.

Yoav