[TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[Ralf Skyper Kaiser <[e-mail]>]

Hi,

Thank you for the helpful TLS WG meeting yesterday at
the IETF88 and to the WG for the excellent work on
TLS.


No consensus was reached on ‘Reduced RT handshake with
privacy”.


Some thoughts why SNI (host name) and ALPN should be
transmitted encrypted and not in clear.


1. Meta-data is important. Meta-data tells a lot about a person.
Meta-data can get a user killed or worse. Transmitting the host-name
(meta-data) in clear in TLS is not good (as in ‘not good because it
can get you killed’ and there is no alternative for the user – unless
the user is a tech-wizard.).


2. What is the message to the user? TLS is secure – well, kind’a.
TLS secures some things but that you read freedom4gays.com,
secure.washingtonpost.com or myfavoritepoliticalparty.com is
leaked – but we still call it secure???


3. Governments just love filtering by site. (Block secure.twitter.com
but not blub.com) Same goes for filtering by application (ALPN).
Transmitting this information in clear plays into the hands of the
adversary.



There are other ways how an adversary can extract the same meta-data.
This should not deter us from fixing it in TLS. Maybe we will find a
solution for the other problems as well (like confidential DNS).


Fixing this in TLS increases the cost of surveillance. This is the goal.


An adversary can no longer use passive surveillance to extract SNI/ALPN.
The adversary is forced to do detectable active surveillance to get the
meta-data).


Those who give up security for a little bit of performance neither
deserve security nor performance.



Regards,



Ralf