Re: [TLS] About encrypting SNI

[Erik Nygren <[e-mail]>]

On Thu, Apr 17, 2014 at 1:00 PM, Martin Thomson <[e-mail]>wrote:

> On 17 April 2014 08:05, Erik Nygren <[e-mail]> wrote:
> > 4) Send a long byte-string key label which allows the server to pack in
> > enough information to allow it to be time-variant (eg, a timestamp plus
> an
> > encrypted version of the timestamp and more detailed routing information)
>
> Isn't that what draft-ekr-tls-new-flows effectively proposes?
>

Exactly, hence my proposal to include that in a DNS Service Binding
record.
The concern raised was that this could be used by a passive attacker
to further identify the hostname the client was connecting to.
By preference would be to take this approach but provide some guidance
on a way to help raise the bar.  For example, constructing this label with
something like:

    { timestamp, label_key_vers , AES(label_key, timestamp ||
SNI_routing_identifier || handshake_keyversion ) }

would reduce some of these attacks over just having a static value in the
label (which might
degenerate down to something with a static 1:1 identifier with the SNI
which would some of the
point of encrypting the SNI in the first place).

          Erik