MIME-Version: 1.0
From: Eric Rescorla <ekr@rtfm.com>
Date: Mon, 2 Jul 2018 16:39:14 -0700
Message-ID: <CABcZeBMR=5QQjSS68H2mQoyG1cHVa5+Z_5SH0Md07kTBVSr3Sw@mail.gmail.com>
To: "<tls@ietf.org>" <tls@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000fcbc6905700cb652"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/vc_gm-Wqpg5e15Ws_7OuqOZudB4>
Subject: [TLS] DNS-based Encrypted SNI
Precedence: list

--000000000000fcbc6905700cb652
Content-Type: text/plain; charset="UTF-8"

Hi folks,

I just submitted:

  https://tools.ietf.org/html/draft-rescorla-tls-esni-00

This draft describes a DNS-based approach to doing encrypted SNI.

Previously, we had thought this wouldn't work because only sites that
were particularly vulnerable would do it, and so the use of ESNI marks
you out. The idea behind this draft is that there are a lot of sites
which are hosted by -- and whose DNS is run by -- a large provider,
and that provider can shift many if not all of its sites to ESNI at
once, thus removing the "standing out" issue and making a DNS-based
approach practical.

I am working on an implementation for NSS/Firefox and I know some
others are working on their own implementations, so hopefully we can
do some interop in Montreal.

This is at a pretty early stage, so comments, questions, defect
reports welcome.

-Ekr

--000000000000fcbc6905700cb652
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi folks,<br><br>I just submitted:<br><br>=C2=A0 <a href=
=3D"https://tools.ietf.org/html/draft-rescorla-tls-esni-00">https://tools.i=
etf.org/html/draft-rescorla-tls-esni-00</a><br><br>This draft describes a D=
NS-based approach to doing encrypted SNI.<br><br>Previously, we had thought=
 this wouldn&#39;t work because only sites that<br>were particularly vulner=
able would do it, and so the use of ESNI marks<br>you out. The idea behind =
this draft is that there are a lot of sites<br>which are hosted by -- and w=
hose DNS is run by -- a large provider,<br>and that provider can shift many=
 if not all of its sites to ESNI at<br>once, thus removing the &quot;standi=
ng out&quot; issue and making a DNS-based<br>approach practical.<br><br>I a=
m working on an implementation for NSS/Firefox and I know some<br>others ar=
e working on their own implementations, so hopefully we can<br>do some inte=
rop in Montreal.<br><br>This is at a pretty early stage, so comments, quest=
ions, defect<br>reports welcome.<br><br>-Ekr<br><br><br><br><br><br><br></d=
iv>

--000000000000fcbc6905700cb652--