Re: [TLS] About encrypting SNI - Traffic Analysis Attacks?

[Michael StJohns <[e-mail]>]

On 5/13/2014 1:53 PM, Daniel Kahn Gillmor wrote:
> y If we don't offer a standard mechanism for protecting the 
> confidentiality of SNI (at least against passive monitors) in upcoming 
> versions of TLS, then the dns-privacy discussion is going to have 
> serious trouble sustaining its work by an analgous "little value 
> unless..." argument. We shouldn't sabotage that work. The TLS WG needs 
> to fix the SNI leak, and DNS confidentiality needs to be addressed by 
> the DNS folks if we want to protect this information against passive 
> eavesdropping. --dkg

One of the things missing from this discussion is whether or not 
encrypting the SNI is sufficiently resistant to traffic analysis 
techniques to make it worthwhile:  E.g.  A trivial attack is where there 
are a 100 web sites at a particular IP address, but only one of them has 
a name that is 28 characters in length and that's the one eavesdroppers 
care about.  A non trivial attack is where the web sites can be 
characterized via their patterns of traffic (a web page with 28 items, 
of which 16 are pictures with known fixed lengths).

Random padding can mitigate some of this (but will require some changes 
to TLS) and random reordering of HTTP requests can also help a bit 
(mostly a client side change), but transaction based protocols like HTTP 
(e.g. most of the time I'm pretty sure that the client is sending some 
sort of GET even if I don't know exactly what its asking for) tend to 
reveal the underlying patterns, even if the actual data is protected.

Mike