Re: [TLS] Encrypting record headers: practical for TLS 1.3 after all?

[Yoav Nir <[e-mail]>]

> On 2 Dec 2015, at 3:24 AM, Peter Gutmann <[e-mail]> wrote:
> 
> 
> 1. Define a threat model.  What are we supposed to be defending against?
> 
>   (Note: The Inside-Out Threat Model, "this is the defence, anything that it
>   prevents is what we're defending against", is not a threat model).
> 

Fine. I’ll take a stab at it. But different people are concerned with different threats. So I’ll divide this into three layers of concern, because I think they build one on top of the other:

Concern Layer #1: I would like a passive observer to not be able to know the exact size of requests and responses in my stream as that could identify the resource name and content. Obvious example is from HTTPS. At this layer I’m fine about “them” (for whatever “them” I’m concerned about) knowing that I am browsing Wikipedia, but I don’t want them to know which article.

Concern Layer #2: I would like a passive observer to not be able to know how many requests I am making to the server at a given time. At this level I’m concerned that just the number of requests may leak something about what I am looking at. So if I’m looking at one of only 12 Wikipedia pages that have exactly 27 images it severely narrows down the list of what I’m looking for. 

Concern Layer #3: I would like a passive observer to not be able to know whether I am sending requests and getting responses at all. Obviously they can know that I have an HTTPS connection with en.wikipedia.org, but they should have no idea whether this connection is idle or downloading tons of content. 

I could add a fourth layer where I don’t want the observer to know whether or not I am looking at Wikipedia at all, but that is not something that I believe the TLS working group can do. This is more in-line with what Jacob is doing.

Yoav