Re: [TLS] About encrypting SNI

[Brian Sniffen <[e-mail]>]

Eric Rescorla <[e-mail]> writes:

> On Mon, Apr 14, 2014 at 7:51 AM, Russ Housley <[e-mail]>
> wrote:
>
>     
>     > I think Rich Salz has outlined very compelling reasons not to
>     support SNI.
>     
>     
>     While I might quibble with a detail here or there, I do agree with
>     the conclusion. If you need to protect SNI, then TOR or to a
>     lesser extent TLS-in-TLS can be used.
>
> I'm not sure that this addresses the requests I have heard for SNI
> encryption which is to conceal the sites people are going to by
> default rather than as a special case for the privacy conscious.

It sounds like the information about who is visiting which sites will
leak to a passive adversary either from DNS, or from unencrypted SNI, or
from which server IP address is used---as long as servers have different
opinions about crypto.  And as long as the Fed-compliant sites have NIST
crypto and the "subversive" sites avoid NISt crypto, they'll have to be
on different addresses.

A design to preserve anonymity-style privacy from even purely passive
adversaries can't fit into the TLS layer---or else Tor wouldn't have so
hard a problem.

-Brian

-- 
Brian Sniffen
Information Security
Akamai Technologies