Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[Ralf Skyper Kaiser <[e-mail]>]

Hi,

On Tue, Nov 12, 2013 at 2:13 PM, Phillip Hallam-Baker <[e-mail]>wrote:

>
>
>
> On Fri, Nov 8, 2013 at 1:42 PM, Ralf Skyper Kaiser <[e-mail]> wrote:
>
>> Hi,
>>
>> absolutely. Encrypted SNI in TLS 1.3 will be received by server prior to
>> selecting a certificate.
>>
>> ALPN could be encrypted as well (same reason, same solution).
>>
>> regards,
>>
>> ralf
>>
>
> What am I missing here, how do you turn on encryption before the client
> sees the encryption credential.
>
>
The certificate does not contain the encryption credentials.
The certificate can be transmitted after encryption has started.

- server/client: negotiate credentials (not certificate), start encryption
- client: send SNI, ...
- server: send certificate, ...
- authenticate (HMAC over all data that has been send and received during
handshake).

(This is incomplete. Please refer to the protocol-flow that Eric showed at
the IETF88 TLS WG gathering.)



>
>
> As for economic issues 'not being a consideration', if the group does not
> make TLS 1.3 viable commercially then either nobody will use it or the
> commercial providers will fork. We have already had two forks in PKIX
> because people refused to consider practicality over ideology.
>

absolutely. The believe is that Tansport-Layer-Security (encrypted SNI)
will be more widely adapted than Transport-Layer-Kind-Of-Security
(cleartext SNI leakage). Surely for those Atheist in Saudi Arabia or the
Alan Turing's in Britain it would be bad to have the SNI leaked....


>
> Multihosting is not becoming less common, it is becoming more so. We
> cannot burn one IPv4 address per session. And if we did the mapping of
> domain to IP address would become 1:1 and the name would leak anyway.
>

correct. That's why we have SNI (encrypted or not. both serve this purpose).


>
> Modern multihosting is dynamic. The provider has no idea which machine a
> site is going to pop up on and it can change from day to day. Any scheme
> that required all certs to be issued by the same provider is going to be
> unacceptable.
>

I agree.

regards,

ralf