Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[Ralf Skyper Kaiser <[e-mail]>]

Hi,

Martin, you are right that SNI is currently implemented and transmitted in
clear.
This was however not the primary design goal but rather a choice of
convenience
and lack of better/easier ideas. The primary design goal for SNI was to
allow
multi-homing HTTPS servers on the same IP (so that apache can select the
correct x509 certificate for whatever site the client requested). There is
no
practical or security benefit  or transmitting SNI in clear.

Sean, your argument "but DNS leaks infos as well, and the attacker can do
reverse
lookups, ..." etc are valid but shall not prevent us from fixing these
problems one by
one. DNS will support confidentiality. Reverse lookups do not work on
multi-homed
SSL servers [you only get 1 host name back but not 1,000 domains hosted on
that
host], .. etc etc).


I hear you loud and clear that a more work on other protocols (including
DNS) has to
done to prevent leaking of domain names. I agree.

Let's start with TLS and SNI.


regards,

ralf




On Tue, Nov 12, 2013 at 2:34 AM, Sean Leonard <[e-mail]> wrote:

> On 11/11/2013 4:55 PM, Martin Rex wrote:
>
>> Ralf Skyper Kaiser wrote:
>>
>>  SNI can be transmitted encrypted and should be transmitted encrypted (see
>>> recent plenary sessions at IETF88).
>>>
>> What you seem to want to do is not SNI, but something else.
>>
>>
>>  Martin, with your argument why should we fix anything at all in any
>>> product
>>> or design?
>>>
>> Don't fix it if it ain't broken.  SNI is not broken.
>>
>>
>>  The proposed solution FIXES passive pervasive surveillance in TLS 1.3.
>>>
>> [...]
>>
>>  Let's make pervasive passive surveillance harder.
>>>
>> To me, this is self-illusion.  Why should NSA look at SNI at all?
>>
>
> Okay so here's the thing. A passive observer of the network can probably
> figure out that a particular TLS connection is intended for a particular
> hostname.
>
> The client and server IP addresses are in the clear. No question.
>
> To figure out the server's IP address from its hostname, the client must
> do a DNS lookup. This will be in the clear. Even if a particular client
> doesn't go over the (surveiled) public Internet to do the DNS lookup (due
> to local DNS server caching), for any nontrivial amount of connections, the
> DNS record will float through the public Internet in the clear at some
> point.
>
> Thus an eavesdropper can easily correlate the reverse lookup, IP address
> -> hostname(s), in a minimal amount of time.
>
> So, the fact that SNI is in the clear, is not really leaking additional
> information that a passive (but consistent and pervasive) eavesdropper
> would have figured out in the first place.
>
> Unless of course you are using SNI to stuff in side-channel information
> (i.e., something other than a hostname)...but then you are not obeying the
> SNI protocol in the first place.
>
> FWIW, I would prefer that all metadata (whether SNI or otherwise) not be
> in the clear. But as Martin Rex said, it being in the clear is not fatal to
> security.
>
> -Sean
>
>
>
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls
>
>