Re: [TLS] SNI from CDN to Origin (was I-D Action: draft-ietf-tls-sni-encryption-08.txt)

Rob Sayre <sayrer@gmail.com> Wed, 09 October 2019 14:20 UTC

Return-Path: <sayrer@gmail.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5726120818 for <tls@ietfa.amsl.com>; Wed, 9 Oct 2019 07:20:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KKyM8YrmAgef for <tls@ietfa.amsl.com>; Wed, 9 Oct 2019 07:20:23 -0700 (PDT)
Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E00D5120220 for <tls@ietf.org>; Wed, 9 Oct 2019 07:20:22 -0700 (PDT)
Received: by mail-io1-xd2e.google.com with SMTP id n197so5291160iod.9 for <tls@ietf.org>; Wed, 09 Oct 2019 07:20:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=biM+gitkhvQIhTTjUFTt6G8ZXZk8/QllBppFKKRK41Q=; b=J6JUDQSTmR3uKh2Cyw+MSzbOxCMUmeUt/rrilgupsrBD006QouVaKman0L8WWOAs5O XwjLWpgxRYzU6uc8qI0PCU59L8TD0LuJ1aJYRqaV2/ZDOWCFuhLs1bDS2h5Ut2S52EX7 g0cE0l+i2ghIZLlSKxfGrAFC+VPKm255rHBMayDIcIx79WM/W4uqHxPKmzti1PZX4o89 WCeoJaQhRamvclIdstTZfY1KMfV4JCAT2oKUi32+qXIHfOnHanOgBCikMPQqHrSnDciC RKnMH8TrNjo1OCKXU6WJXUIXSNFH+6kK5g8C6MhusG2n/1ApT1PspTj/LnWzrIaowTAU haYA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=biM+gitkhvQIhTTjUFTt6G8ZXZk8/QllBppFKKRK41Q=; b=YBA9lVsryPCjCZj17WaIsSN0kz+A6OtJpCkxOOSs7NXco/Ig0RWz/FB03cgRJdWrl0 ojuE4w+9pR5aUPGh7inErJj9WvOid36i9SQY4CpPbC3qFJ6XF4W66OUt4z9CHjfKEzaY 6V3RAXmCXd/GVdSu8S9qQh806ZiLoKxFyupp8CsMKEE3yTnQKTnSAOxFaHhhi2dJHuJW aVlaM/uqS+ZwSrEuDGExARfnFlK5X7mDfO88f88psfZrdn/h+NscmuV3t+YZYrxZqGZX vW2p+DyT/1V+owKuSnr7mC/EXI2LDl51LOOYtUfFS/qd/0GUcDwrvPnI9lbQZnnlzh+q 4qrw==
X-Gm-Message-State: APjAAAWK5EhdqtXpk/9Yapp00psOTUEMkllUUkyObR5z9ix7PkHBf0PV uAeZMqBu3NQ7jb0WLKJ3lVEFdluy5wskLJZ8yG4=
X-Google-Smtp-Source: APXvYqyWQZSoEp8xJQpF9YnWigZ4coWwhVta2u5eEkqKxLMzwIAYqNMgrIBHsWoE+Tz3G0PBOjFOcThwSvKfTUX2Jw0=
X-Received: by 2002:a6b:e910:: with SMTP id u16mr3582596iof.196.1570630821993; Wed, 09 Oct 2019 07:20:21 -0700 (PDT)
MIME-Version: 1.0
References: <157048178892.4743.5417505225884589066@ietfa.amsl.com> <CAChr6Sy9=GbUO19X0vc0Dz7c565iPAj=uWVujLV5P3_QL5_srw@mail.gmail.com> <28C7A74D-5F9D-4E1A-A2D2-155417DA51C0@akamai.com> <CAChr6Szay7j=czCaYhKGp9bHHmZiArU440hSnvNqNaL+hX2wKA@mail.gmail.com> <F932C81B-95E9-4044-B975-9AFCD09CF7FA@akamai.com> <CAChr6Sy=+qt=KYKfXEkWhBBev88-XEcB4tOZLz9cBf76wsUo2g@mail.gmail.com> <80F168B0-7F30-4FDA-BD0F-4C787802F0D5@akamai.com> <CAChr6SyV+qMFs56THZzBxNv5vkQTeBJdG9GtutvVMcyP2CxN7w@mail.gmail.com> <CABcZeBNtv-4=dtrArZwnJHSohrbsrtG53_ynSZdcMp=YeWc9iA@mail.gmail.com> <CAChr6SzCONU2yA87QGNhsx7=5Zn82v1_euBJ-kbRci4vJ32oUw@mail.gmail.com> <83192EC8-6A24-4638-80AC-6D2AF9C68BBB@akamai.com> <CAChr6SwdP7iA=ZYg+xa3Ye-b97sekw6=qwJZu2w0n1ZZC9wG+Q@mail.gmail.com> <E679DBE6-CEC8-486B-A2EA-EEED38D4E4C8@alipay.com> <CAChr6SzRZJ4g=TDwM2jjhp8S_Oyk+kQ0VNEsd3FYV2xVBn-sNw@mail.gmail.com> <8D9F60B9-E507-4465-B761-BAD37B6E1156@alipay.com>
In-Reply-To: <8D9F60B9-E507-4465-B761-BAD37B6E1156@alipay.com>
From: Rob Sayre <sayrer@gmail.com>
Date: Wed, 9 Oct 2019 21:20:10 +0700
Message-ID: <CAChr6SzLn57ak5wgWUyW=wpcG09n1PtsOXVWZ0TBmj+r7TOF2A@mail.gmail.com>
To: Paul Yang <kaishen.yy@alipay.com>
Cc: Rich Salz <rsalz@akamai.com>, "TLS@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000037e38805947afce2"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/WKDgGYlIYgcE1eMx67JNC8W_EGU>
Subject: Re: [TLS] SNI from CDN to Origin (was I-D Action: draft-ietf-tls-sni-encryption-08.txt)
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 09 Oct 2019 14:20:25 -0000

On Wed, Oct 9, 2019 at 9:17 PM Paul Yang <kaishen.yy@alipay.com>; wrote:

>
>
> On Oct 9, 2019, at 9:46 PM, Rob Sayre <sayrer@gmail.com>; wrote:
>
> On Wed, Oct 9, 2019 at 8:43 PM Paul Yang <kaishen.yy@alipay.com>; wrote:
>
>>
>> From my understandings, either IPv4 or IPv6 should have nothing to do
>> with the concept “virtual host”
>>
>
> Hi Paul,
>
> That is correct. However, the scarcity of IPv4 addresses is one major
> factor driving the need for virtual hosts.
>
>
> Yes, that’s right. So even IPv6 addresses are enormous enough to hold
> every domain name, we still can’t assume it’s all used in this way in
> practice. An administrator can always configure the origin server as
> hosting multiple domain names on one IPv6 address. It may not be very
> reasonable for doing so, but it could be done in that way. Actually popular
> web servers as NGINX supports such kind of configurations, for instance.
>
> For TLS protocol, when being used between an IPv6 CDN node and an origin
> server, the SNI still need to be present in ClientHello to address the
> above circumstance; otherwise, the IPv6 origin may fail to choose the right
> host/certificate to finish the handshake.
>

Hello,

I agree that it needs to be possible to include the SNI in ClientHello, but
not required.

thanks,
Rob