Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[[e-mail] (Martin Rex)]

Juho Vähä-Herttua wrote:
> 
> [e-mail] (Martin Rex) wrote:
> > 
> > Juho Vähä-Herttua wrote:
> >> 
> >> What makes me sad is
> >> the knowledge that SNI is leaking the hostname and makes those
> >> connections trivial to block, even though I haven't come across
> >> SNI based blocking yet.
> > 
> > There is _no_ requirement for the TLS client to send SNI at all.
> 
> Of course not, but many servers require it in practice.

The number of servers that require SNI seems to be somewhere between
marginal and negligible.

SChannel in Windows XP doesn't support SNI, and the global market
share of Windows XP is still significant:
  http://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0

(and may be the reason why MSIE 8 is still the most common version in use)

Sometimes, IT departments even deploy Windows 7 in a fashion that
even Win7 MSIE/SChannel will not send SNI.  I'm sure they would be
swamped with support calls if that would cause noticable usability issues.


> 
> > In the normal mode of operation of TLS, the server name that the client
> > announces through SNI is the name that the client will match against
> > the server's certificate.  So blocking based on the names in the
> > server's certificate would work for current SSLv3->TLSv1.2, even
> > when the client does not send SNI.
> 
> That is true, I assumed if there's a common shared secret for encrypting
> SNI in place, it could also be used for encrypting the certificate.

There are currently two other activities in the IETF with respect to
the server certificate: DANE, where the Server cert (hash) ends up
in DNS(SEC), and Certificate Transparency, where the Server's certificate
ends up on a signed public record.

And what about the Server certificate revocation checking through OCSP?


I assume that the primary reason for the NSA/GCHQ and spooky friends to
"collect it all" is the prevalent lack of "crypto hygiene" in pretty
much all network protocols and in common user behaviour,
except for some stuff that is run entirely through TOR.

You're leaking the information, that you're trying to hide here with great
effort, in so many other places, that they're going to laugh at you.

They may not be able to (or not care for) connecting the dots between
terrorist plots, but they likely can and do connect the dots between
IP addresses and hostnames of servers for stuff that doesn't go through TOR.


-Martin