Re: [TLS] TLS ECH, how much can the hint stick out?

Mike Bishop <> Thu, 10 September 2020 18:52 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 9C9693A0C3D for <>; Thu, 10 Sep 2020 11:52:03 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 0nPnff34pAVM for <>; Thu, 10 Sep 2020 11:52:01 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 793073A0DF9 for <>; Thu, 10 Sep 2020 11:52:01 -0700 (PDT)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901;; cv=none; b=GJWFNgwQR4QgA/UDHbay2+Xw0BlwGhcJQSwkfj9s2wy6HWW+MulBd+i0S9dvkq3CEoo9EjJJqURsOZMTJuCvnyAprnppnZ6bPwDxuOemXvDAKXS4EZPlbonO/7DbYbaYQDDgvm5SR1xtlZO83Mx3TrURzLEuc2vMr0X08uKtiU8rVfpNziFX3dIuOMpUOZiRRj/pkulUjaaPTyVvRX9ysUTsl7XkImuIVV6cA29HrV9FXIKWNJe9aEqg+UVJiQ1wffzty4d6FyD4SpW5y2Z/fCrV6T0z5hfNww5/xPnKvrr0l5W7KT2J6Ewc/I1y1bPe+HfwVx7beUkJbbzbeD3o0Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed;; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yrrydKgeRZ552SgugcuGBEQiK9GZG8Kqhn6qr4f2OqQ=; b=FX7Noqkuu52MKzXeq1mjSMUuhi9bbBN9VFl2e889HD0p9+BkKD9f90uFk3A4/4q3cWPzFQnKzqzi8AJAlXzhr8gSgCsj5qvvfr0uGzsPFRnbRIqacRBey3CDLwTbDybe3olMyYAcgmN4rSXgIcZkcTuYMAzpuniNMlbRv3IPpOZAuC1ZmMzME4IFHJYVislVlHQRzdqdi3DnfCc69E6UyL/DiGzzdaNlmAtjuXINFZnqCF/vPa9Ut2fVZ6z5VQPUxJ2cv4C5UlaEmDQoPL7TtfbuofPgLnTRxoG5kyC+WWo7ZRM1Z6lobWjpbbjILDwvgpryH37nVMNSWKa9PUPSHw==
ARC-Authentication-Results: i=1; 1; spf=pass; dmarc=pass action=none; dkim=pass; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=selector2-evequefou-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yrrydKgeRZ552SgugcuGBEQiK9GZG8Kqhn6qr4f2OqQ=; b=AfkWVZaApz27RFmprsI7qHGZ8PoJReCyPanYLj910CqGQRQHUppDKXr9CDK88L2mmr6CtXP3h58u29AhMD2h6Az2ivvm9Kj2+en+VEXe85mId0VnXL0PC/45b7mQtTb+FiQ/H0sEEiJ+Pu+zKykXoSQHxV21e8WqK3d3uvUbGaI=
Received: from (2603:10b6:610:8c::8) by (2603:10b6:610:81::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3370.16; Thu, 10 Sep 2020 18:51:59 +0000
Received: from ([fe80::2827:5a3c:11db:7a55]) by ([fe80::2827:5a3c:11db:7a55%4]) with mapi id 15.20.3370.016; Thu, 10 Sep 2020 18:51:59 +0000
From: Mike Bishop <>
To: Christopher Patton <>, Christian Huitema <>
CC: "" <>
Thread-Topic: [TLS] TLS ECH, how much can the hint stick out?
Thread-Index: AQHWhfPKZCd76N1m6EGBOv8Plhva3qlfDioAgAMq5hA=
Date: Thu, 10 Sep 2020 18:51:59 +0000
Message-ID: <>
References: <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
authentication-results:; dkim=none (message not signed) header.d=none;; dmarc=none action=none;
x-originating-ip: []
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 4aab1d2d-1879-49df-8f7d-08d855ba9922
x-ms-traffictypediagnostic: CH2PR22MB1829:
x-microsoft-antispam-prvs: <>
x-ms-oob-tlc-oobclassifiers: OLM:10000;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 7HVB+C3DdOMhGxHaioXEq2vnQcAQumeGuqE5Qo6egw8o26ZIJHaxLV8bue83Ciur9J84NySOoSaRRaLKhTvp35ijxE2nwjM0XM+w4VkSQEY0OFIBnmnMleCodevDcG2qtVY5m36dDjEWioBo8fX59gRz11P9xpeUG5bnwy+MVvtjj4hMEKM/ilSMfA+zjsOulidmrNDwverX9UV7QgKci16mcsYPzsq8pCmv3dt/tKTu8yT0v7s8Pr9aNYguxvU46BgH6sE1Qwu8bY0vJc4w0t+Hn+pOi29FcPOxJ/CrkbOc+4X7JVyhWLUgjYKMrHAr
x-forefront-antispam-report: CIP:; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM;; PTR:; CAT:NONE; SFS:(366004)(396003)(136003)(39830400003)(376002)(346002)(83380400001)(71200400001)(99936003)(33656002)(8676002)(2906002)(76116006)(26005)(7696005)(86362001)(9686003)(110136005)(5660300002)(478600001)(64756008)(6506007)(66946007)(52536014)(53546011)(316002)(55016002)(66556008)(66446008)(66476007)(186003)(4326008)(66616009)(8936002); DIR:OUT; SFP:1102;
x-ms-exchange-antispam-messagedata: m9+6ZukYRJsu47zDtdDlsXFSt/fKbC4AL7BXLPCBDAlRTc4L2C3obwcyc2SGJN6Plq6C7g3LEX5UJ8uT8q4rq3JsFzpSsbKqF+xBwC4af9HZJ/Zvfte9RSWUCk8dsGEAM9ATFP8lxivtdm9L/a66jgl/rayx7ZpibZS+wiqUYdqwzDOTzsLiOoadv+ArAf3KHmLA254yXThbIiakjeot96EFXjWtiOSJfPs/EzlVaApHhYNpvqkJRkKdT5KJiYA3mWMyym6JnmlqmIw3R2emwT6TfbMbGok/3lahUs46uDm6yCmI3Xd8x6ByxDydFeURHnDy0DFSE2Dvmw9U+W7cw6y3bXj1rsWmJ7h2T5G6fSe75d5PguajSpCTHr4z71ljDFERS12PaI2jVXXtwWoan8G8mpdMtYXmGNaf0EU+DpEKBcANmfYZzX04q4eHSjjN07Im+BZqiaFIokP+mtUJPJ7/rNUbdPr56mTnBKcN0WpV9zsfE+03v+gSqj02F/hP3od1fgeOCBTi317nyalfqPNn2iQqh5RgPeluBGBdlJCt0NTof8HXc1AQZznqOQXw617VVw1UBYS+NKUOu+6oZK8MJeROEr4aXxF2ZzNstJi69mH6ZClvb8OWEMOVmkbTeSBgKd11WNYW7p/6ZzpxVA==
x-ms-exchange-transport-forked: True
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg="2.16.840."; boundary="----=_NextPart_000_0104_01D68781.EE44DE30"
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-Network-Message-Id: 4aab1d2d-1879-49df-8f7d-08d855ba9922
X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Sep 2020 18:51:59.3277 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 41eaf50b-882d-47eb-8c4c-0b5b76a9da8f
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 9FkfXLXsbUtvP0jO4HfGeAuOeOs0EmImPCzmkrNyQ/3PdEQCF8hJYnhnOJxK5/S/nZxA+x73TuMNY0H8KuzpQg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR22MB1829
Archived-At: <>
Subject: Re: [TLS] TLS ECH, how much can the hint stick out?
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Thu, 10 Sep 2020 18:52:04 -0000

This is primarily an active attack, but not purely so.  Clearly the MITM is an active attacker, but there are situations in QUIC (and DTLS, I presume) where a ClientHello gets retransmitted.  Depending on server infrastructure, the client might get two different responses.  This isn’t limited to cases where the observer/attacker is the one performing the replay.


So I think we need to decide whether it’s a goal that, given that relatively narrow situation, the observer shouldn’t be able to identify ECH acceptance by comparing two ServerHellos that both respond to the same ClientHello.


From: TLS <> On Behalf Of Christopher Patton
Sent: Tuesday, September 8, 2020 2:23 PM
To: Christian Huitema <>
Subject: Re: [TLS] TLS ECH, how much can the hint stick out?


Hi Christian, Hi list, 


The "don't stick out" property is a steganographic security goal: we want the "real" protocol, i.e. TLS with ECH acceptance, to be indistinguishable from the "cover" protocol, i.e., the handshake pattern in which the client sends a "dummy" ECH extension that is ignored or rejected by the server. This is a property that TLS was never designed to have, but it seems that we need some degree of it in order to deploy ECH. The fundamental question that Christian raises is what is the right threat model for this property.


The "status quo" threat model considers a distinguisher that is strictly passive---it does not interfere with a handshake or probe the server---and that does not know the ECH configuration. This seems (to me, at least) sufficient to account for middleboxes that might ossify on the ECH extension. It also seems achievable, both by the ECH as it is and for the proposed change.


The distinguishing attacks described by Christian are much stronger, in the sense that they involve an active attacker. I don't believe there is any way of implementing ECH---either as it is or with the proposed change---that defeats active attacks in general. In particular---and as Christian points out---an active attacker can probe the server to learn the ECH configuration (via the ECH retry logic), which it can use to easily distinguish the real protocol from the cover protocol. This works regardless of whether the change is adopted.


In my view, achieving don't-stick-out-security against active attackers requires us to revisit the design of ECH altogether. The main difficulty is that client-facing servers publish the ECH configuration in a way that's easily accessible to an active attacker. Keeping the configuration secret may provide a way to achieve security, and some deployments might opt to do this; but the vast majority won't. We might consider adding support for this deployment scenario, but this can (and should, I think) wait for a later draft.


That said, it is worth considering mitigations against known attacks, in particualr (1). I think the suggestion for mitigating (2) adds too much complexity, and if it doesn't fully address the intended threat model (I don't think it does), then we'll likely need to replace it in the future. I think it's better to keep things simple until we fully address the intended threat model.



Chris P.