Subject: Re: [TLS] Final nail in the coffin for cleartext SNI/ALPN in TLS 1.3

From: Juho Vähä-Herttua <[email-masked]>
Date: Tue, 12 Nov 2013 21:57:04 +0200

> On 12.11.2013, at 20.33, [email-masked] (Martin Rex) wrote:
> 
> Juho Vähä-Herttua wrote:
>> 
>> What makes me sad is
>> the knowledge that SNI is leaking the hostname and makes those
>> connections trivial to block, even though I haven't come across
>> SNI based blocking yet.
> 
> There is _no_ requirement for the TLS client to send SNI at all.

Of course not, but many servers require it in practice.

> In the normal mode of operation of TLS, the server name that the client
> announces through SNI is the name that the client will match against
> the server's certificate.  So blocking based on the names in the
> server's certificate would work for current SSLv3->TLSv1.2, even
> when the client does not send SNI.

That is true, I assumed if there's a common shared secret for encrypting SNI in place, it could also be used for encrypting the certificate.

> One of the problems with making a "solution" part of the official
> standard is that, if anything, the tools in use by the relevant authorities
> will be able to deal with the "standard" at the time when it becomes usable
> in the installed base (if that happens at all).

I guess the question is about how transparently they can do that. If a TLS handshake fails halfway is a bit different than failing after ClientHello. Failing after ClientHello can be interpreted as server simply not accepting the parameters.

> Homegrown/unofficial workarounds tend to work better and longer.

Naturally, but it's not impossible to make official protocols secure enough to at least detect eavesdropping, even if it would be impossible to prevent.

However, I don't see how encrypting SNI and certificate would be possible without an extra round-trip, and that might be too expensive even considering the benefits. The current 4-way handshake combined with 3-way handshake of TCP is already a bit much. So I'm not completely supporting the encryption, even though it would be a really nice option if it was widely supported.

Juho

---

From: [email-masked] (Martin Rex)
Date: Wed, 13 Nov 2013 01:29:23 +0100 (CET)

Juho Vähä-Herttua wrote:
> 
> [email-masked] (Martin Rex) wrote:
> > 
> > Juho Vähä-Herttua wrote:
> >> 
> >> What makes me sad is

The number of servers that require SNI seems to be somewhere between
marginal and negligible.

SChannel in Windows XP doesn't support SNI, and the global market
share of Windows XP is still significant:
  http://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0

(and may be the reason why MSIE 8 is still the most common version in use)

Sometimes, IT departments even deploy Windows 7 in a fashion that
even Win7 MSIE/SChannel will not send SNI.  I'm sure they would be
swamped with support calls if that would cause noticable usability issues.

> That is true, I assumed if there's a common shared secret for encrypting
> SNI in place, it could also be used for encrypting the certificate.

There are currently two other activities in the IETF with respect to
the server certificate: DANE, where the Server cert (hash) ends up
in DNS(SEC), and Certificate Transparency, where the Server's certificate
ends up on a signed public record.

And what about the Server certificate revocation checking through OCSP?

I assume that the primary reason for the NSA/GCHQ and spooky friends to
"collect it all" is the prevalent lack of "crypto hygiene" in pretty
much all network protocols and in common user behaviour,
except for some stuff that is run entirely through TOR.

You're leaking the information, that you're trying to hide here with great
effort, in so many other places, that they're going to laugh at you.

They may not be able to (or not care for) connecting the dots between
terrorist plots, but they likely can and do connect the dots between
IP addresses and hostnames of servers for stuff that doesn't go through TOR.

-Martin