IETF Logo Mail Archive

Re: [TLS] ECH-10 interop test server

Rob Sayre <sayrer@gmail.com> Fri, 28 May 2021 18:36 UTC

Return-Path: <sayrer@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B89253A316B for <tls@ietfa.amsl.com>; Fri, 28 May 2021 11:36:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.096
X-Spam-Level:
X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LhM3o_4kpzLx for <tls@ietfa.amsl.com>; Fri, 28 May 2021 11:36:04 -0700 (PDT)
Received: from mail-il1-x12e.google.com (mail-il1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E1AD3A3160 for <tls@ietf.org>; Fri, 28 May 2021 11:36:04 -0700 (PDT)
Received: by mail-il1-x12e.google.com with SMTP id u3so4130593ilv.8 for <tls@ietf.org>; Fri, 28 May 2021 11:36:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=gkfb106mU7Z/UJmOm6QdU6kev8h35A+R5iSfrX6WX4s=; b=Yeg5MXq+UZNcfnJDllki7yjTQgBOh37j6S3UFlJkrBn/qtbJFLhlQIrlkMsfD5rjfh 1lKH1x3NQankG/W7tXYY8bP5J8IS86OoWjO+Wx83lzVeQK12Hnl97bk8TZFBLXbq0guF XidQhcXM7jtR9x+UyrDeBMgn9NmKImqmaMmw601WB2AbWDO6bB+hpFJ6C7pP/H2VFs9i K4A7bNbW/MMzFnp9jT/BlwLOePQPs7gnIS2oUYK7F98nNOhe1ZDF+ikjdwKeL/y/7H3D b6qTBp5sCWrdr8FgtwKluJvUw763Dwdb5c4ZtmylfDB6YFvOj9qxGNsVKkQ3yO7Stb7P QlNw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=gkfb106mU7Z/UJmOm6QdU6kev8h35A+R5iSfrX6WX4s=; b=eirLZXPdxsI2eSTO4Sk5Oe7DD+LSH5QwD2dFsbl65gk6s44uAO/eMFTp8oQat5Rymc fwf3LSbXKxDtWE0s1AMxHTiwi6LK7KifRIL8xRodFCukleUpihp932RB2k8HwahZTsO9 ygoKyWAiJYpTj3fIjcFmmXB5Rgt+LrpR4eKf2gjgNsFnVidKdDvNSRHZ70HjDd4Rufb/ BCPQprfCGfheGOzIA3/Nn4KelaYoh0rIaayXu9od0D8VJXYg3w/mZ5LRr2yd7iJ/N/Tl V0q3xuu6IEc3lAU/l82Q0RXBqqoQpmZHuZOF5RBIoFu2exTq35cvGiwXOrQZzwKOnWVw ca9Q==
X-Gm-Message-State: AOAM5301vBbMiOVwFx6yqhwCfxpiR1j7jG76TJeZLPuvfmjJoZXE0VH7 9ZDrLg+lkS4EY9bLVe1/kPFlxSj69s/4xy+QvnE=
X-Google-Smtp-Source: ABdhPJyp4S4EFoWMeY8eXeE6C4knhrIAPmyj0EQx2tl8wyp4IqTEI+l7yDFm8Bpa8u5irfMaN1rJ+VX8bJ2OHGUmFvg=
X-Received: by 2002:a05:6e02:e42:: with SMTP id l2mr8044891ilk.189.1622226959690; Fri, 28 May 2021 11:35:59 -0700 (PDT)
MIME-Version: 1.0
References: <CAG2Zi23mtGwmpNSvUigOdph8y05MvWV_uGm8H0W=vbRFdZ6euw@mail.gmail.com>
In-Reply-To: <CAG2Zi23mtGwmpNSvUigOdph8y05MvWV_uGm8H0W=vbRFdZ6euw@mail.gmail.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Fri, 28 May 2021 11:35:48 -0700
Message-ID: <CAChr6Sz4AxU7zu0nX8MM485bfBiNTS4Z-No80AEMHO56fNBkyA@mail.gmail.com>
To: Christopher Patton <cpatton=40cloudflare.com@dmarc.ietf.org>
Cc: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000ad704805c36825a0"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/UExEBV_llysPeCOCo_erOmKhbys>
Subject: Re: [TLS] ECH-10 interop test server
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 28 May 2021 18:36:09 -0000

On Mon, Apr 5, 2021 at 10:02 AM Christopher Patton <cpatton=
40cloudflare.com@dmarc.ietf.org> wrote:

> Hi list, just FYI that Cloudflare's test server is upgrading to
> draft-ietf-tls-esni-10 this morning. It should finish rolling out in a few
> hours. Note that we've dropped support for draft-ietf-tls-esni-09.
>
> The endpoint is https://crypto.cloudflare.com. You'll also find our ECH
> config in the HTTPS resource record.
>

I've gotten a Rustls client to interoperate with this server, but I had
some trouble triggering HRR, since Rustls always sends a key-exchange group
in TLS 1.3. I managed to hack up a ClientHello and handshake with no
initial key-exchange group, but perhaps it could be easier.

It might be nice to have this server reject secp384r1 and offer X25519 in
an HRR, or something like that.

thanks,
Rob

v2.19.0 | Report a Bug | By Email