Re: [TLS] draft-rescorla-tls13-new-flows-01 - Thoughts post-meeting

[Michael StJohns <[e-mail]>]

On 3/16/2014 5:31 PM, Erik Nygren wrote:
> Pros helping the passive anti-privacy attacker:  they also have server 
> IP address to constrain the problem space by, plus TLS 1.2 SNIs so if 
> there are a 100k hostnames behind the middlebox then that's their 
> search space.
>
> Pros helping the DDoS attacker: they can just send random hash+opaque 
> values.  The middle box needs to then calculate the hash for all of 
> the hostnames (eg, perhaps 100k in the same scenario above).

I don't disagree with any of your points (but there's always a tradeoff 
between DOS protections and negotiation protections), but I wanted to 
focus on the 100K.

The question is - if the SNI is encrypted from the client to the end 
system, how do the end systems communicate with the middle box to pass 
on their key info and keep it up to date - not on a per-box 100K basis, 
but on a 100K times the number of connections per box?

I think what we're getting to is that if we have a system where there is 
a middle box, then neither of these approaches makes a lot of sense for 
the scale you're talking about?

Mike