Re: [TLS] ESNI padding the Certificate message

On Thu, Dec 13, 2018 at 7:28 AM Viktor Dukhovni <ietf-dane@dukhovni.org>
wrote:

> > On Dec 13, 2018, at 8:10 AM, Stephen Farrell <stephen.farrell@cs.tcd.ie>
> wrote:
> >
> > Was just adding code for this and I noticed that the draft says
> > a server: "SHOULD pad the Certificate message, via padding at
> > the record layer, such that its length equals the size of the
> > largest possible Certificate (message) covered by the same ESNI
> > key."
>
> "Largest possible" is not always a knowable target.  One often does
> not know anything about the sizes of the other potential certificate
> chains in advance of serving such a chain.

You already need some of this information in order to specify the largest
possible SNI (so you can pad to it), so I don't think this is prohibitive.

Far more sensible would
> be to add random padding whose size is commensurate with the size of
> the certificate message.
>

> I would generate a random nibble, and count the first $k$
> non-zero bits.  Then $1 + k$ times add independently
> random([0, N/2]) bytes of padding to an $N$ byte message,
> giving an additional $~N$ bytes on average, but occasionally
> up to $2.5N$ additional bytes.
>

Random padding does poorly with repeated trials. So, for instance,
if I get to observe a large number of requests from the same client
to the same server, you can gradually infer the length of the cert
chain.

-Ekr

> --
>         Viktor.
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>