Re: [TLS] About encrypting SNI - Traffic Analysis Attacks?

[Stephen Farrell <[e-mail]>]

Hiya,

Just some thoughts on this... no hats and all that.

On 13/05/14 21:20, Nico Williams wrote:
> HTTP has infinitely extensible headers just for this purpose ;)

HTTP/2.0 is also adding padding, so it could be that a good
solution here for web sites depends on some or all of TLS1.3
and HTTP/2.0 and DNS-priv. That is quite a lot of moving parts,
but if we don't fully examine the SNI part of that story now,
then I can't see it happening again for a long time to be
honest.

I also don't like the "DNS is clear, so why not SNI" argument.
Because that goes on to "if SNI is clear, then why not ALPN?"
And if ALPN, then why not the server cert? Etc. etc. And
then in the end we lose out on lots of chances to counter
traffic analysis. (Not that we know so well how to do that,
but nonetheless...)

If the argument ends up being that nobody wants to implement
SNI encryption, then that's important, but I don't believe we
have a proposal so far that'd allow folks to decide that. (Or
maybe I missed it, I just saw some sketches in mails.) That
does however put the onus on those who would like to see this
done to write down how. If nobody does that, then I'd say
Rich's argument will win by default since he's pointing out
a real difficulty. I think that'd be a pity but doing better
depends on those who want to do better figuring out and
writing down how.

One other thought, maybe more optimistic: could it be that
there might be ways to protect things like SNI used for
routing the 2nd and later times you visit a web site, even
if TLS had to put the DNS name in clear (or close-to) first
time around? If one gets that property via some mechanism
or other, and if the hosts at which there's any point in
trying to hide SNI (those with lots of VirtualHost equivalents)
get lots of non-first time visits maybe even from the same
clients, and if DNS-priv happened, then maybe that'd be a
sufficiently useful answer. I'm not sure, but that's the
kind of analysis that needs to be done by someone interested
in countering traffic analysis. I really hope someone's up
for doing that kind of work.

S.