Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

[Juho Vähä-Herttua <[e-mail]>]

> On 12.11.2013, at 20.33, [e-mail] (Martin Rex) wrote:
> 
> Juho Vähä-Herttua wrote:
>> 
>> What makes me sad is
>> the knowledge that SNI is leaking the hostname and makes those
>> connections trivial to block, even though I haven't come across
>> SNI based blocking yet.
> 
> There is _no_ requirement for the TLS client to send SNI at all.

Of course not, but many servers require it in practice.

> In the normal mode of operation of TLS, the server name that the client
> announces through SNI is the name that the client will match against
> the server's certificate.  So blocking based on the names in the
> server's certificate would work for current SSLv3->TLSv1.2, even
> when the client does not send SNI.

That is true, I assumed if there's a common shared secret for encrypting SNI in place, it could also be used for encrypting the certificate.

> One of the problems with making a "solution" part of the official
> standard is that, if anything, the tools in use by the relevant authorities
> will be able to deal with the "standard" at the time when it becomes usable
> in the installed base (if that happens at all).

I guess the question is about how transparently they can do that. If a TLS handshake fails halfway is a bit different than failing after ClientHello. Failing after ClientHello can be interpreted as server simply not accepting the parameters.

> Homegrown/unofficial workarounds tend to work better and longer.

Naturally, but it's not impossible to make official protocols secure enough to at least detect eavesdropping, even if it would be impossible to prevent.

However, I don't see how encrypting SNI and certificate would be possible without an extra round-trip, and that might be too expensive even considering the benefits. The current 4-way handshake combined with 3-way handshake of TCP is already a bit much. So I'm not completely supporting the encryption, even though it would be a really nice option if it was widely supported.


Juho