Re: [TLS] ESNI and Multi-CDN

[Ilari Liusvaara <[e-mail]>]

On Tue, Dec 18, 2018 at 12:29:56PM -0500, Ben Schwartz wrote:
> I'd like to propose a solution to the ESNI + Multi-CDN problem (which has
> been discussed a lot on this list already).  My suggestion is that we
> define the ESNI DNS record format as optionally including "stapled" A/AAAA
> records.
> 
> Server operators would have the option to publish an ESNI record that only
> contains an ESNIKeys structure (like the current TXT record), or to publish
> an ESNI record that also includes IPv4 and/or IPv6 addresses.  (A
> Sufficiently Advanced authoritative DNS server would generate such records
> automatically.)  This kind of address stapling would only be required of
> CDN operators who want to support multi-CDN deployments.
> 
> Clients would issue A, AAAA, and ESNI queries in parallel (as with the
> current TXT record).  If an ESNI record exists, and it contains IP
> addresses, the client discards the results of the A or AAAA query.

I do not think this will work:

- The CDNs need control of ESNIkeys
- If you hand them this control, you can hand over address control at
  the same time.
- Now you are in HTTP service discovery territory.

I am not saying that HTTP service discovery is undesirable (it is one
of those perennial topics that are not seemingly bad ideas but never
seem to get done).


Conversely, if one had HTTP service discovery, almost everything about
the CDN problems with ESNI would be solved instantly (what is not
solved by the same-owner rule).


-Ilari