[TLS] Port number and ALPN of ECH client facing servers
Christian Huitema <huitema@huitema.net> Sat, 07 June 2025 00:32 UTC
Return-Path: <huitema@huitema.net>
X-Original-To: tls@mail2.ietf.org
Delivered-To: tls@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id C8D5D31FC905 for <tls@mail2.ietf.org>; Fri, 6 Jun 2025 17:32:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: 1.637
X-Spam-Level: *
X-Spam-Status: No, score=1.637 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_SBL_CSS=3.335, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=neutral reason="invalid (public key: not available)" header.d=mfg.outbound
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 03QoqrVtzWZL for <tls@mail2.ietf.org>; Fri, 6 Jun 2025 17:32:56 -0700 (PDT)
Received: from semfq02.mfg.siteprotect.com (semfq02.mfg.siteprotect.com [64.26.60.183]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id B913F31FC900 for <tls@ietf.org>; Fri, 6 Jun 2025 17:32:56 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mfg.outbound; s=default; h=Content-Transfer-Encoding:Content-Type:Subject: From:To:MIME-Version:Date:Message-ID:reply-to:sender:cc:bcc:in-reply-to: references; bh=AY2k93SU29mBb5UULbgUcpmc+2X+dZRTVbLdziqMClE=; b=mf4wCmtHtj5TkE mOTpfEqABvIKIpPqyZsVW7Fqk1jqj7iOL7e1w8aF6MdKjlwVFv5PadPytuzNgj8pQqVQcKdGR2Hnj nSSBegydi8BlSJ0lrcha00t+oG+XgWbImgzF4QbtctYtabyWce/HyI0KM5C/fhcYzgrJ7HBiSquJe Vr5NupFm6vcbH1CPX0mWifUrtlLEckIRvqSYM53EAiCiqQIBf02KD/7vVybpMtfSidSFS9foSHLcK rtFT45+obj0LnsRuY6LWWZBrX72yHy9MicqZtk30RawWizBXokVcVh+GNu9ITWJG6zPnXPWWesuLy 2M/M5DYTU3818csQZJVQ==;
Received: from smtpauth01.mfg.siteprotect.com ([64.26.60.150]) by se02.mfg.siteprotect.com with esmtp (Exim 4.94.2) (envelope-from <huitema@huitema.net>) id 1uNhUV-0008GL-2j for tls@ietf.org; Fri, 06 Jun 2025 20:32:56 -0400
Received: from [192.168.1.105] (unknown [172.56.170.224]) (Authenticated sender: huitema@huitema.net) by smtpauth01.mfg.siteprotect.com (Postfix) with ESMTPSA id 4bDfKf2pPsz9hypvw for <tls@ietf.org>; Fri, 6 Jun 2025 20:32:54 -0400 (EDT)
Message-ID: <cd762457-4949-4b1d-8cb2-c46ecc9700c6@huitema.net>
Date: Fri, 06 Jun 2025 17:32:52 -0700
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Content-Language: en-US
To: IETF TLS <tls@ietf.org>
From: Christian Huitema <huitema@huitema.net>
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: 7bit
Authentication-Results: mfg.siteprotect.com; auth=pass smtp.auth=huitema@huitema.net
X-Originating-IP: 64.26.60.150
X-SpamExperts-Domain: mfg.outbound
X-SpamExperts-Username: 64.26.60.150/31
Authentication-Results: mfg.siteprotect.com; auth=pass smtp.auth=64.26.60.150/31@mfg.outbound
X-SpamExperts-Outgoing-Class: ham
X-SpamExperts-Outgoing-Evidence: Combined (0.23)
X-Recommended-Action: accept
X-Filter-ID: 9kzQTOBWQUFZTohSKvQbgI7ZDo5ubYELi59AwcWUnuW/Jkf5Vq0awUlJv/DjghtMM430KM7XrJt5 qED+9DiRbCu2SmbhJN1U9FKs8X3+Nt127hcteP1p0NVNV47moiZtUnZMMMyaNBeO+OvFQHUlG4JL M0i5ZAms0EHrvcCaVIOK/n5J0l3cyA0MSk/0detEGnT3EFAinyrilm9zau/FuzkQt9Nb4Ml7QXdk EetczWAP7aaIPrIjDj59Wk4xpVNfeB7itP8hgjDRserKv4bhb5ad32FAu+dBavD9Yzm05DvEMzer JfQa9UAYKsgEV8p+MUJTS2Jsxpkx+IHIsDarm2U3gyy0nlbakKK22WPBaizjKzb+JrnOTbl8FYp7 CIWjverajYy2yB71RZy29b9HL7yliuqXZvH3i216cQum166j+BL4PYVgvaXSXb1cxfXFRLmyQwGi ZJgVfk+eiqgtnWPB2Pnz+d7EeiljkeJKEJfZMVbZgPGqS8l2ok9OMWikKE3RLxdi5fkNsznYwdy0 7QDk5nWIiIcthdTaotkIarTZarYidkZBdHCCngOK96nKBJLYTZxh22meX7HFA+oP+UkljMUfkLWG wPUTaYSg5fuff8pZ9ure3k2YtJj4Q8Z77zI1++1qWejV4LNLMkeJB/PL5iPvQRzmz90IZuQ4C9hv ErJPxTr2+cEgMmrfx8+vzepMD18pWvPAXDv7RDt/l2e1zBEkKiVQ0aE0FiIR2w962eyjD/ojqy2d 24gPlDivEIs7JSKPM7dlswCooIwYj8NYKH7x10XTVw7o43BiNkcdP9it2XBBpoaNtsAhTpG+GaDF aL1VHVb2R36ZHVYVvpBF2Go97pAM3YVDJPKoeb5Ld23x+iTlqjhoRStXw1wwXPWlFdaGOH191uXj gjQN/ScE/a1TDR3jZVUNwgbS33/OB7VPRCJBB4EtYyzWZQw3OUZvyOXN3K5jiUnAbmtqdJ5XWi6y 2EbKXFV1T5HRmNt0B8UHGcAF6mYbrMRbu5qKOy0Easx4X8UO54de5LdF5QT6N0Oj6wTd7aHtHxtG wnTdL/l7LOMu/lmay9KiyHdRAgUkwKOuTLY6l+WVJUfbEcpTWBtXIMd13QjfAnf6U/Y=
X-Report-Abuse-To: spam@se02.mfg.siteprotect.com
X-Complaints-To: abuse@se01.mfg.siteprotect.com
Message-ID-Hash: NJIFT2VP77T4DLYWYWLTHJBJ75LYB3NN
X-Message-ID-Hash: NJIFT2VP77T4DLYWYWLTHJBJ75LYB3NN
X-MailFrom: huitema@huitema.net
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-tls.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [TLS] Port number and ALPN of ECH client facing servers
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls/waar3yamsfY433SovlrLWdq9MYU>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Owner: <mailto:tls-owner@ietf.org>
List-Post: <mailto:tls@ietf.org>
List-Subscribe: <mailto:tls-join@ietf.org>
List-Unsubscribe: <mailto:tls-leave@ietf.org>
I am implementing the ECH draft, and there is something a little unclear. Suppose a backend server "backend.example.com" implementing the application protocol "example" (i.e., not H3). Before connecting, the client looks up the corresponding SVCB record, and finds an ECH parameter stating that the public server is "facing.example.com". How exactly is the client going to find the ALPN used to connect to "facing.example.com"? What about the port number? Yes, the client could do a DNS lookup to find details about "facing.example.com", but should that request be for the SVCB record corresponding to the "example" service, or for the HTTPS record corresponding to H3? Obviously, the practical answer is "connect to `facing.example.com` port number to 443 setting the outer ALPN to H3." But is that the right answer? -- Christian Huitema
- [TLS] Port number and ALPN of ECH client facing s… Christian Huitema
- [TLS] Re: Port number and ALPN of ECH client faci… Raghu Saxena
- [TLS] Re: Port number and ALPN of ECH client faci… Christian Huitema
- [TLS] Re: Port number and ALPN of ECH client faci… Martin Thomson
- [TLS] Re: Port number and ALPN of ECH client faci… Christian Huitema
- [TLS] Re: Port number and ALPN of ECH client faci… Ben Schwartz
- [TLS] Re: Port number and ALPN of ECH client faci… Stephen Farrell