Re: [TLS] About encrypting SNI

[Alyssa Rowan <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 16/04/2014 17:54, Sniffen, Brian wrote:

>> The idea is that the same key would be used for hello encryption
>> for all domains served by the same IP addresses.
> Oh, I see.  But the US government customers want a key to a NIST
> scheme generated with Dual_EC, and the notional non-government
> entities want anything but that.

Let them have a parallel cryptosystem, then? We can put a cryptosystem
ID in the DNS record (as I just see, while replying, that Andy has
suggested). That also provides scope for agility.

I'm not sure approval (or otherwise) from any government in particular
should stifle developments in this WG, especially in today's climate.

Perhaps NIST would consider adopting our work, when it is finished.
After everything that's happened, even being mindful of the general
effect they have on the market, I think you can understand that the
other way around is far less palatable.

- -- 
/akr
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJTTr6IAAoJEOyEjtkWi2t6ADAP/ig1EfGreOm4qb8G9FZEC61i
1EKq7Q1vjFVy6o5rWSbGbHR5tYEZWkjy+3/x8wCpzH+GUQewn8KFMJZbW7TMCTQr
DL8jaT/ZipU5XzQSpflYuICCsqqAAHKHPMX74Fwfn1zs63N21GYTn/+wr/Ls1jKU
D/O9yksZjwhbx8H1IOGpk7Ht6vofFZoFvV1cGFtVTNukNnuwDQ0kqk/lYJlBtl/v
WIptOnP+fgceoXYN0OeRVTK0nH8AofxwcSXLVtPDd+/xk5h1j/6UhKr0VcQZyvaO
T2WizIq9zuhaNWCNWf6NoKmFFoDve2FgKJRxXeOEpMS+6w71PiasKseRe0pCVpN3
XQBcoYsPeE+KN7OhnSnRIGbezLgDQM7ALIeW2AgM+u2hMi8JeYwZC1lGdoWOkQv9
xSoCX70tf3el/cSARkM+vBXy2FZDNRxPdTcVptHg7tJunick9rvJPYG6eIrZ4rZM
EiRmqtnyNlX9I/SHHbEvcD2iwTaEi4hbRLsSp9UJZdmB+6KGGqhIeewD6hNwHuRw
ODw0L7CJd6KshOwaKQEMpje+6AkwRTffLSiU0rl1eFsrdmCkyVpG9cvKEdPi9Pn3
ObNRUcwu1/2CRRWPduahZcwhYLxleS+6es695YLCdWkJaDzdlHrHvgxCz94O337+
YcESjuil0Y8CxNNOoie+
=+Dff
-----END PGP SIGNATURE-----