Re: [TLS] About encrypting SNI

["Sniffen, Brian" <[e-mail]>]

On Apr 14, 2014, at 3:56 PM, Daniel Kahn Gillmor <[e-mail]> wrote:

>> encrypting SNI requires us to either have a single long-lived keypair for all customers, or require an extra RTT for clients to fetch an EDH key, perhaps still shared, but hopefully more secure. The latter is particularly off-putting since customers paying for a "faster, better" end-user experience are now at a disadvantage. Some in this community might not deploy TLS 1.3 to avoid the "retry penalty." This would be a shame.
> 
> The discussion of possible handshake flows suggests that the extra RTT
> does not need to be in every handshake; several proposals for
> "semi-static" DHE keys have been put forward already, and
> second-connections need not have the extra RTT.
> 
> Depending on how we define the mechanism, the initial SNI-protecting DHE
> key could even be per-IP address, rather than per-domain, which would
> allow further reductions in RTT for sites hosted on large farms with a
> few public-facing IP addresses.

More narrowly to that point:

We are in a historically rare position of having one suite of generally-agreed good crypto: ECDHE, ECDSA*, AES, SHA2.  That hasn't been true most days since the creation of SSL; we've wondered about export vs. not, 3DES vs RC4, DSA vs RSA, and so on.  We're probably going to end up in that conflicted and confused world again, in which reasonable people can disagree about their cipher suite choices.  Encrypted SNI means that every site on an address must agree on certain parts of their cipher suite.

In a world where I'd like to operate a backwards-compatible site for vehicle firmware upgrades, prominent social media sites, and mobile app back-ends off of one address, that means I'm stuck!  I expect to see that around ECDSA (required by governments) vs. Ed25519 (required by those frightened by governments), AES (for GCM to computers > 1 kg) vs. ChaCha (for Poly1305-AEAD to computers < 1 kg), and similar.  

I don’t see a path to low-RTT protection of the host identity that doesn’t require all hosts in an identity-group to share their cryptographic politics on many dimensions.  And at that point, I can’t tell whether you’re talking to HRW or AI, but if you’re doing it from Tibet, you’re dead anyway.

-Brian

* With carefully chosen nonces