Re: [TLS] Encrypting ALPN and other unused extensions

[[e-mail] (Martin Rex)]

Michael D'Errico wrote:
> Watson Ladd wrote:
> > 
> > Some extensions aren't used by the TLS layer, like ALPN.
> 
> ALPN is used by the TLS layer.  The requested protocol is
> one of several inputs to a server's certificate selection
> algorithm, along with the SNI.

I agree that the information is conveyed within the TLS protocol,
so the TLS stack may need to be able to pass this information
between TLS stack an application, but there is no need that the
TLS stack uses this information for anything.

With TLS extension SNI, the server side TLS stack might even completely
ignore the information, i.e. not implement it.

A Hosting provider could set up an SNI-aware load balancer and
dispatch/NAT incoming TLS sessions in opaque fashion to individual
TLS servers, and the individual server can just ignore the contents
of TLS extension SNI (or may not even implement it), and virtual
hosting would still work just fine.  There would be no server name
confirmantion in ServerHello extensions, but that is a quite
irrelevant part of TLS extension SNI.


-Martin