IETF Logo Mail Archive

Re: [TLS] Encrypted SNI

Ryan Sleevi <ryan-ietftls@sleevi.com> Fri, 02 June 2017 12:03 UTC

Return-Path: <ryan-ietftls@sleevi.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DDF38129AE5; Fri, 2 Jun 2017 05:03:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.299
X-Spam-Level:
X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-2.8, RCVD_IN_SORBS_SPAM=0.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sleevi.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BVECmNVNq4t3; Fri, 2 Jun 2017 05:03:43 -0700 (PDT)
Received: from homiemail-a103.g.dreamhost.com (sub4.mail.dreamhost.com [69.163.253.135]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC7BA127010; Fri, 2 Jun 2017 05:03:43 -0700 (PDT)
Received: from homiemail-a103.g.dreamhost.com (localhost [127.0.0.1]) by homiemail-a103.g.dreamhost.com (Postfix) with ESMTP id 1108130002B29; Fri, 2 Jun 2017 05:03:43 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sleevi.com; h=mime-version :in-reply-to:references:from:date:message-id:subject:to:cc :content-type; s=sleevi.com; bh=z5wOxWdcM2WW6ehzlopwH3TKPUE=; b= KSzYs//NxuPRvFxE5j6oVQyznvgW3HbUEzLzSu4qigYAl/tJC27bG+vNZNcFEySE 6XocPLWSC0230ej6uZ+oQ4/GJe/B3GzsQKtKnZowIwaAyoy5BSqph1yRNgqj4iby zjQPzGz/WfwhEkMy6/XlWrq8uv9xHUtlxAjpKRVrT0A=
Received: from mail-wm0-f44.google.com (mail-wm0-f44.google.com [74.125.82.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: ryan@sleevi.com) by homiemail-a103.g.dreamhost.com (Postfix) with ESMTPSA id CC14830002B25; Fri, 2 Jun 2017 05:03:42 -0700 (PDT)
Received: by mail-wm0-f44.google.com with SMTP id 7so23308116wmo.1; Fri, 02 Jun 2017 05:03:42 -0700 (PDT)
X-Gm-Message-State: AODbwcDHz8jIVsSKRUbsw5KIsfsNXpgISxbL4e8j1BGBzDD5AmcDnolD grefahvpjG0d7ORoxovLhOva+Xv8rw==
X-Received: by 10.223.171.24 with SMTP id q24mr226538wrc.89.1496405021261; Fri, 02 Jun 2017 05:03:41 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.223.128.164 with HTTP; Fri, 2 Jun 2017 05:03:40 -0700 (PDT)
In-Reply-To: <20170602103151.GC12522@faui40p.informatik.uni-erlangen.de>
References: <CAHbuEH4Bwr13T-cBFvLmUmn6KRzuNf1su6VTeJguyssk6S2z3g@mail.gmail.com> <4d2f195a-c61b-4abb-9b33-bc36773775cd@cisco.com> <20170602084300.GB12522@faui40p.informatik.uni-erlangen.de> <CAL02cgS+eym_=TNupJo0f0qAFgZc14rXNfO=VdGzRX28jXVqkQ@mail.gmail.com> <20170602103151.GC12522@faui40p.informatik.uni-erlangen.de>
From: Ryan Sleevi <ryan-ietftls@sleevi.com>
Date: Fri, 02 Jun 2017 08:03:40 -0400
X-Gmail-Original-Message-ID: <CAErg=HG8NFmuX7NUR3tLXbstzj2Spgc_dyh6b5DZqCFh73dt=Q@mail.gmail.com>
Message-ID: <CAErg=HG8NFmuX7NUR3tLXbstzj2Spgc_dyh6b5DZqCFh73dt=Q@mail.gmail.com>
To: Toerless Eckert <tte@cs.fau.de>
Cc: Richard Barnes <rlb@ipv.sx>, "ops-dir@ietf.org" <ops-dir@ietf.org>, "<tls@ietf.org>" <tls@ietf.org>, Benoit Claise <bclaise@cisco.com>, "sec-ads@ietf.org" <sec-ads@ietf.org>, "ops-ads@ietf.org" <ops-ads@ietf.org>, ops-chairs@ietf.org
Content-Type: multipart/alternative; boundary="94eb2c1b54d4bb89540550f8f14a"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/TGBK4zEHIkR3IhhC4lQbmDgRep8>
Subject: Re: [TLS] Encrypted SNI
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 02 Jun 2017 12:03:45 -0000

On Fri, Jun 2, 2017 at 6:31 AM, Toerless Eckert <tte@cs.fau.de> wrote:

> On Fri, Jun 02, 2017 at 01:16:01PM +0300, Richard Barnes wrote:
> > Operators trying to do this by inspecting TLS (and not decrypting) are
> > going to have a bad time anyway.  With HTTP/2 connection coalescing, even
> > if they can see the certificate, the actual HTTP request could be for any
> > name in the certificate.  So there's nothing really gained by exposing
> the
> > certificate.
>
> If a web service hoster does not provide any useful demultiplexer then it
> can of course not
> expect not to get blacklisted across services. Is it not already common
> practice to assign
> separate certificates to separate "web customers" ?
>

No. It's typically the opposite.

v2.23.0 | Report a Bug | By Email