Re: [TLS] ESNIKeys over complex

[David Fifield <[e-mail]>]

On Sat, Dec 08, 2018 at 06:38:30PM +0200, Ilari Liusvaara wrote:
> While thinking about the previous, I ran into some issues with the
> split mode. Firstly, if the fronting server does not encrypt the
> client_hello when transmitting it to backend server, passive attack
> can match incoming connections with backend servers. This reduces
> anonymity set to a single backend server (a lot smaller set).
> 
> And secondly, even if server encrypts the client_hello, but does not
> use a tunnel to backend, if server does not have client hello replay
> filtering (and such filtering is hard on typical fronting servers),
> replay attacks and some very simple traffic analysis can discover the
> backend server (again reducing the anonymity set by a lot).
> 
> This means that the fronting server should have an encrypted tunnel
> with the backend server (and there is likely double encryption).

I see--you're thinking of an observer who can see "both sides" of a
connection: the link between the Client and the Client-Facing Server,
and the link between the Client-Facing Server and the Backend Server.
I agree: such an observer could, through timing analysis, deanonymize
client connections (i.e., tell which Backend Server the Client is
accessing, as if it were accessing directly and not through the
Client-Facing Server). I suppose to really defend against a global
observer, you would need some kind of mixnet.

It looks like a little bug in the draft. I've checked just now and I
don't see that it says exactly *where* the observer is. I had assumed
that the observer only sees the Client–Server link (in Shared Mode) or
the link between Client and Client-Facing Server (in Split Mode).

I don't understand your point about replay and encrypting the Client
Hello. An observer doesn't need to see the contents of the Client Hello
to identify a Backend Server--the destination IP address is enough. I
don't see what specific attack you have in mind using replay, but it
seems to me that even an encrypted tunnel is insufficient. Unless the
encrypted tunnel additionally obfuscates packet sizes and timing, an
observer can correlate e.g. burst sizes and match incoming flows to
outgoing flows, in the manner of website fingerprinting.