Re: [TLS] New Draft: Using DNS to set the SNI explicitly

[Ben Schwartz <[e-mail]>]

On Tue, Feb 7, 2017 at 12:13 PM, Salz, Rich <[e-mail]> wrote:

> I read the doc.
>

Thanks!


>   I’m a little dumb, but I think a more expanded ladder diagram for Figure
> 2 would have helped me.
>

OK.  I think I included all the packets.  Is it unclear what each packet
is?  Did I miss some?  Or would like you more explanation about what each
endpoint is "thinking" at each step?


> The basic process is query DNS, get the SNI record value, and use that as
> the SNI value when connecting to the domain, right?
>

Yep, that's the whole idea in one sentence.


> But I’m not sure of the interaction of CNAME entries here.  Do you keep
> the SNI value in the first, or does cname-chasing erase/override the
> initial value?
>

I wasn't intending any special interaction with CNAME, and (therefore) no
CNAME chasing unless someone specifically CNAMEs _443._tcp.foo.example.com.
So yes, you would keep the SNI value at the specified name.  (DNAME would
cause chasing.)  Does that seem reasonable?


> And does this really provide much additional privacy?
>

The examples section says

   A host that serves many subdomains with a single wildcard certificate
   could set the SNI of all subdomains to the same fixed subdomain, in
   order to prevent a passive adversary from learning which subdomain a
   user is accessing.


I think that's a worthwhile benefit that would help real users today.


> Can’t the attacker/repressor also do DNS queries and figure it out?  There
> should probably be some text around that issue.
>

The section on optimizing privacy says:

   If the adversary has full knowledge of the contents of the global DNS
   (a strong adversary), then users of a domain only experience a
   privacy benefit if another domain at the same IP address uses the
   same SNI RDATA.  The privacy benefit increases as more domains share
   the same SNI RDATA and the same IP addresses.


What else would you like to see?