Re: [TLS] draft-rescorla-tls13-new-flows-01 - Thoughts post-meeting

[Michael StJohns <[e-mail]>]

On 3/16/2014 2:12 PM, Watson Ladd wrote:
> On Sun, Mar 16, 2014 at 10:21 AM, Michael StJohns
> <[e-mail]> wrote:
>> During the TLS meeting EKR talked about encrypting most of the protocol
>> negotiation, and noted that the primary use case for that was the SNI.
>> Someone else noted, that the SNI was often used as routing information by
>> distributor boxes and might be problematic to encrypt.  Further discussion
>> ensued (http://www.ietf.org/proceedings/89/minutes/minutes-89-tls) leading
>> to a hum on protecting the SNI that was pretty much down the center of
>> do/don't.
>>
>> After thinking about it for a bit - how about simply hashing the data in the
>> SNI? Ideally calculated with a prefix of a random value that's also sent
>> along in the SNI so the same hash isn't sent over and over?
> >From time to time, people have a privacy issue like NSEC. Someone
> comes along and says
> "I know! we'll use hashing." and we get NSEC3.
NSEC3 was not a privacy issue item, it was a database walking item.

>
> Do you know how many SHA256 calls per second off-the-shelf commercial
> ASICs can do? It's about 155 million per second per dollar.


Ok - let's inject a little bit of financial analysis.

Two questions:

1) What's the cost of making the first attack (not the delta, but the 
minimum cost to an attacker to build something to do what you're talking 
about, PLUS the cost of actually acquiring the data on the wire)?

2) What's the value of the first piece of data to the specific attacker?


My point is that unless there is specific value to the attacker, and 
that value is greater than the cost to the attacker of making the 
attack, then the attack won't happen.

Two further questions:

3) What, exactly, is the value of the privacy of the query data to the 
querier and how much does that value degrade over time once the query 
has been made?

4)  Just how much can be spent on protection before the protection costs 
exceed the value of the data?

and two further questions.

5) Are the anticipated attacks general (shot gun) or targeted?

6) If targeted, does encryption provide sufficient protection or could 
the data be gotten for similar costs via other attacks?


It was clear from the WG meeting that there wasn't consensus to add 
encryption across the board - whether from a disagreement on need or 
whether the mechanism EKR proposed was the way to go or possibly 
something else.  That said, if this is about trying to protect against 
well funded attackers, encryption in not a panacea.  If this is about a 
casual eavesdropper, then maybe a simpler solution is reasonable.


>
> Do you know how many hostnames there are? Well, theoretically many,
> but most are made human-readable: the entropy is much lower than the
> length and alphabet would suggest.
>
> The attacker can determine which name is being contacted with a few
> weeks of calculation.

Weeks?  Oh - you're worried about a shotgun and national actor approach, 
rather than the typical attacker. OK.

In any event, there are any number of ways to increase an attackers work 
factor substantially without increasing the work factor for someone that 
already knows the small set of answers.  Think of it as a DNS arms race 
and we win if we make them spend more than they get back in value.  You 
used 155m hashes per dollar - so if we increase the work factor to say 
500m hashes to find a name, then it costs $3 per query to resolve to the 
names. How many connections per day are there?

Later, Mike

> Once it has the hostnames,
> figuring out what is going on is quick. This already exists in the
> form of the nsec3walker tool.
>
> Sincerely,
> Watson Ladd
>
>