Re: [TLS] In support of encrypting SNI

[Marsh Ray <[e-mail]>]

From: Stephen Farrell
http://www.ietf.org/mail-archive/web/tls/current/msg08722.html
> A workable SNI encryption scheme is of course what we'd like, 
> and would blow the above out of the water, but if we don't find
> a workable SNI encryption scheme now, there might be reasons
> to think about the structure above and there are definite
> reasons to think about tempora as an attack.

Dan Blah writes:
> Many of the discussions and subsequent decisions that move forward 
> here are incredibly important to OTF's work. As such, I wanted to toss 
> in our support for the coming version of TLS 1.3 to "Encrypt as much 
> of the handshake as possible". This should include all of the metadata 
> and TLS-layer routing information. We think by default is important 
> for those threatened users we work closely with.

From: Nikos Mavrogiannopoulos
> The best would be for TLS 1.3 not to bump the protocol version number.
> It could masquerade as TLS 1.2 and use extensions to negotiate any new
> functionality. That way it wouldn't have any interoperability issues
> (if we ignore for a moment the client hello size issues).

Apologies to those who have heard this before, but I lose stuff in the volume.

A couple of years back I made a detailed proposal precisely for encrypting
"as much of the handshake as possible" (including SNI) using
TLS 1.0-compatible extensions:

http://tools.ietf.org/id/draft-ray-tls-encrypted-handshake-00.txt
   This specification defines a Transport Layer Security (TLS) extension
   which allows endpoints to negotiate the use of encryption with
   forward secrecy at the beginning of the handshake.  Two levels of
   functionality are defined.  Implementations are free to support one
   or both levels, with the first level incurring no additional
   computational or round-trip overhead.  The TLS cryptographic
   calculations are unchanged.

The Introduction section describes my then-current thinking on the
topic. The ensuing list discussion felt productive:
http://www.ietf.org/mail-archive/web/tls/current/msg08722.html

- Marsh
---------------
Boilerplate disclaimers apply.