Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

On Thu, Nov 7, 2013 at 8:32 AM, Ralf Skyper Kaiser <skyper@thc.org> wrote:
> Hi,
>
> Thank you for the helpful TLS WG meeting yesterday at
> the IETF88 and to the WG for the excellent work on
> TLS.
>
>
> No consensus was reached on ‘Reduced RT handshake with
> privacy”.
>
>
> Some thoughts why SNI (host name) and ALPN should be
> transmitted encrypted and not in clear.
>
>
> 1. Meta-data is important. Meta-data tells a lot about a person.
> Meta-data can get a user killed or worse. Transmitting the host-name
> (meta-data) in clear in TLS is not good (as in ‘not good because it
> can get you killed’ and there is no alternative for the user – unless
> the user is a tech-wizard.).
They can use Tor. They need to anyway: reverse DNS lookups are not
rocket science.
>
>
> 2. What is the message to the user? TLS is secure – well, kind’a.
> TLS secures some things but that you read freedom4gays.com,
> secure.washingtonpost.com or myfavoritepoliticalparty.com is
> leaked – but we still call it secure???
This is as secure as sending a sealed envelope through the mail.
>
>
> 3. Governments just love filtering by site. (Block secure.twitter.com
> but not blub.com). Same goes for filtering by application (ALPN).
> Transmitting this information in clear plays into the hands of the
> adversary.
>
>
>
> There are other ways how an adversary can extract the same meta-data.
> This should not deter us from fixing it in TLS. Maybe we will find a
> solution for the other problems as well (like confidential DNS).
No, the other problem is you connect to the server and ask it to show
you a page,
and learn what the server is. The sole exception is multihosting,
which is getting
less common for various reasons.
>
> Fixing this in TLS increases the cost of surveillance. This is the goal.
>
>
> An adversary can no longer use passive surveillance to extract SNI/ALPN.
> The adversary is forced to do detectable active surveillance to get the
> meta-data).
>
>
> Those who give up security for a little bit of performance neither
> deserve security nor performance.
>
>
>
> Regards,
>
>
>
> Ralf
>
>
>
> _______________________________________________
> TLS mailing list
> TLS@ietf.org
> https://www.ietf.org/mailman/listinfo/tls
>


-- 
"Those who would give up Essential Liberty to purchase a little
Temporary Safety deserve neither  Liberty nor Safety."
-- Benjamin Franklin