Re: [TLS] draft-ietf-tls-esni feedback

Eric Rescorla <ekr@rtfm.com> Mon, 21 October 2019 19:30 UTC

Return-Path: <ekr@rtfm.com>
X-Original-To: tls@ietfa.amsl.com
Delivered-To: tls@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67936120871 for <tls@ietfa.amsl.com>; Mon, 21 Oct 2019 12:30:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 303ylC0xIon3 for <tls@ietfa.amsl.com>; Mon, 21 Oct 2019 12:30:11 -0700 (PDT)
Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D585B120879 for <tls@ietf.org>; Mon, 21 Oct 2019 12:30:03 -0700 (PDT)
Received: by mail-lj1-x229.google.com with SMTP id y3so14606708ljj.6 for <tls@ietf.org>; Mon, 21 Oct 2019 12:30:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=i35l3v54rKQP1s5+Kb8InGfU4nAXdzHSPS6IqEVG9tQ=; b=lJXiGvYpZ4KbTiT1lFE2RSvmABZQPlqVnb3Z2rQgZS+Zexb2BcThCGwm6lJ+huSwxS OsdAMGSbc64icTwWWVzrBs12Nbw4O1RivM1QkWVt29YUak2k7QsHzBAzdr/mPx7av4di Uo98jF4tMo4jpViHjyXWeYWV/QmX7MZizMVdnnhbLg7M2zP4L1BqYqvnquhNjImEc3Lu HVr2c/VYg9Qfl/zl2c4iViBzcauQsOqKMmFNKZQ5D9+QOct7HS3v+fsHALdwPnzHWV7S 7gRqHcirjRTd8tNERksNDUSb5i2KrWPUaSy74rzgQLCajVkxfgaLzeFE9YcwoMXCus6u NKBw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=i35l3v54rKQP1s5+Kb8InGfU4nAXdzHSPS6IqEVG9tQ=; b=Vjdz6Xw4MUCfLFVwUdKe+SqnDPfs4WzWfP9kcpIOtsHnG0GLBZceqDFNENR5muI/7s 44mU8aEsa24P8VqBLSKJ18ob9keeKf7lz9fXSCDpBGAqeBzQMorOlP7F2lPoGxTlPyM5 iOU3p5IspeI/4X/BSpMAW5W4HqaZR6X8Ciw+AHxFtlUMuULuc1swchQ/uN/p2FICWOx0 AUHjxWpSgNqndVKZNqpCGc6EP0ovsJk9IPRpPjxFaY9NEMX0wktbH8TABAlEqw2Jd/eX o/T6twkpgrlPPBW7H3MdIE5k8XGWmkYE9SQpv5fYMoYi38YMXRw7JFsXxJRcWFlJbNtc LJGQ==
X-Gm-Message-State: APjAAAV7XH3yNNoqUEvG/MexjNx5rGTkx8God3hKNu9jC5fIbEBB5M5O 7I8TyEB1CEzIi2U2rCpfb2hInp4QViayN7YHuQwpmA==
X-Google-Smtp-Source: APXvYqyvam21+t6AztShx282uf6wcWKXzp1Umo72alMTXD4+pHztz3XfY08UqTAOaXy3+i5hG46hB74olN6+Sx5SNWQ=
X-Received: by 2002:a2e:3a14:: with SMTP id h20mr15505491lja.29.1571686202083; Mon, 21 Oct 2019 12:30:02 -0700 (PDT)
MIME-Version: 1.0
References: <CAChr6Sw3f7du3JYxfcWSZje1zjDzsRBQyDjob-AvzjWeZzKW7g@mail.gmail.com> <CABcZeBPbw_KOo_ieSqkksYPeLtb9DufBz628oFPYc_Ue4S9iww@mail.gmail.com> <CAChr6SwB+7Jt2TLJSQh3q=Roizdt2=9jCBa9nq8KRxRo=86uZQ@mail.gmail.com> <CABcZeBNBtDK7q175tseEUiCVds=khj4xXYJZRf7GU9VGNDJ_Tg@mail.gmail.com> <CAChr6Sz6xHtFWjOKrLp3sp9MpC-SoU9Sx=vk22ditjShA7B=Kg@mail.gmail.com> <CABcZeBOnE+gyNu7GarAfO0bptoPfzQQ=VKeWLdpJBDM=E4yhzg@mail.gmail.com> <CAChr6SxWE66jPRbnBRtwNSn3L+uNFkoFBbYNOBAkKDN05qotoA@mail.gmail.com> <CABcZeBOy8ogJrmFajxX1pqjqgnE61gE=c3CWz+pp34NWHmGKbw@mail.gmail.com> <03e15760-dfce-cd7b-baea-56ac70d92192@cs.tcd.ie>
In-Reply-To: <03e15760-dfce-cd7b-baea-56ac70d92192@cs.tcd.ie>
From: Eric Rescorla <ekr@rtfm.com>
Date: Mon, 21 Oct 2019 12:29:25 -0700
Message-ID: <CABcZeBMquubsGvt8UssiyFU_ZuQK67rHN_KBXY+iKSNayJFZew@mail.gmail.com>
To: Stephen Farrell <stephen.farrell@cs.tcd.ie>
Cc: Rob Sayre <sayrer@gmail.com>, "TLS@ietf.org" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000c620d0059570b524"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/n_tF4hRaE2i8cLM6N_S2OzF7wOE>
Subject: Re: [TLS] draft-ietf-tls-esni feedback
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls/>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 21 Oct 2019 19:30:13 -0000

On Mon, Oct 21, 2019 at 11:41 AM Stephen Farrell <stephen.farrell@cs.tcd.ie>
wrote:

>
> Hiya,
>
> On 21/10/2019 19:08, Eric Rescorla wrote:
> > No. You want padding to be set to be the longest size that you would send
> > to any origin in the anonymity group, and the server knows this.
>
> In the past, I've argued that this is not necessarily true
> and hence the current padding scheme is not a good plan.
>
> Two main reasons:
>
> - a server may not have visibility of all names that can
> be in certificate SANs
>

The question is not the server, but the operator.


- even if a server does have such visibility at time t, a
> CA re-issuing certs can change the situation during the
> lifetime of one ESNIKeys value
>
> I believe it is not unknown for servers to have a DB
> of TLS server certs/private keys that is queried based
> on the SNI (which could've arrived as ESNI). I don't
> know how common that is.
>
> My guess is that all of the above will lead to everyone
> always using 260 for this value, making it pointless
> and somewhat wasteful.
>

I don't agree that 260 is pointless, though perhaps wasteful.




> I would argue for an algorithmic method of padding and
> to not require servers to include any value in ESNIKeys at
> all. I proposed one such algorithm on the list before.
>

Yes, but I do not believe that it obtained the consensus of the WG.
Obviously, if the chairs call consensus on this point, we will change the
draft.

-Ekr


> Cheers,
> S.
>
> PS: I think 260 is the right max, didn't look it up just
> now but I did some time ago and it seemed correct.
>