Re: [TLS] Encrypting record headers: practical for TLS 1.3 after all?

[Bill Cox <[e-mail]>]

Thanks for the detailed description of why we might want to obfuscate TLS
record lengths.  From a security point of view, the only potential attack
vector this might create is that the attacker will know in many cases the
plain text of the first 5 bytes.  A weakness in the stream cipher might be
more easily exploited in this case.  IIUC, we feel pretty good about the
latest AEAD ciphers, and guessing the clear text of many bytes in the
record already is not too hard.  Is that right?  So, from my fairly
uninformed point of view, this seems like a reasonable upgrade.

I have one concern.  These same boxes that hide record lengths by merging
and breaking up packets arbitrarily likely would deliver the packets not
well aligned to record boundaries.  Is this already the case?  If these
boxes currently inspect packets when breaking them up to split packets
along record boundaries, encrypting the lengths will defeat this efficiency
hack.  We might cause an increase in network latency in this case.  Do any
of the routers out there currently use the record length field when
splitting up packets?

Bill