Re: [TLS] ESNI padding the Certificate message

On 13/12/2018 13:10, Stephen Farrell wrote:
> 
> Hiya,
> 
> Was just adding code for this and I noticed that the draft says
> a server: "SHOULD pad the Certificate message, via padding at
> the record layer, such that its length equals the size of the
> largest possible Certificate (message) covered by the same ESNI
> key."
> 
> I think that ought also mention the CertificateVerify as that
> could also tell you something about the ESNI being used if the
> key lengths in the various certificates differ.
> 
> More specific to openssl though, there isn't really a terribly
> easy way to do such fine-grained padding (that I've found so
> far),

You can set a padding callback using SSL_CTX_set_record_padding_callback() (or
SSL_set_record_padding_callback()). The callback can determine whether it is
padding a handshake message by examining its "type" parameter, and which message
it is by calling SSL_get_state(). From there you should be able to get the
callback to add padding only to the Certificate and/or CertificateVerify
messages as required.

Matt

> so to cover the above, and as there are likely many
> other ways that the ESNI could be exposed, it might be good to
> add that clients and servers could reasonably decide to pad all
> handshake messages or even all records. (That last being what
> is currently easiest with openssl, and hence what I've done
> for now with my proof-of-concept code:-)
> 
> Cheers,
> S.
> 
> 
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
> 