Re: [TLS] About encrypting SNI

[Andy Lutomirski <[e-mail]>]

On Wed, May 14, 2014 at 8:25 AM, Stephen Farrell
<[e-mail]> wrote:
>
>
> On 14/05/14 16:13, Salz, Rich wrote:
>>> Load balancers and redirectors will need to terminate TLS in order
>>> to redirect the traffic to the proper host.
>>
>> Which we know have been interdicted by various national security
>> adversaries.
>
> True. However, there's also tempora as well, so there may be
> benefits even if not all adversaries are countered. I'm not
> saying we have a good enough way to do that yet, but increasing
> the costs to the adversary and forcing what was covert to be
> more overt is part of the game too. Something that only worked
> against passive things like tempora could in principle be
> worthwhile if it forced the adversary to have to get their
> stuff into the CDN/data-center. If we could do better that'd
> be great. If we can only counter a tempora-like attack and
> the costs for doing so are quite high then there would be a
> case to be made for living with tempora perhaps, but I'd
> rather not myself.

My argument is that the cost of countering attacks that don't involve
compromising an endpoint should be quite low if done sensibly, and I
think that this type of protection could be quite valuable.

I agree that having the client cache some kind of public key will be a
mess and might not offer any protection, but I don't think that's
necessary.

If done right, exactly the same protocol change could also counter
active attacks based on forging certificates.

--Andy