Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Christopher Wood
On 22 Mar 2020, at 16:10, Martin Thomson wrote: On Mon, Mar 23, 2020, at 03:54, Christopher Wood wrote: I propose we remove this requirement and add an explicit signal in SH that says whether or not ECHO was negotiated. Here's a spitball signaling option that might not stick out: Client send

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Martin Thomson
On Mon, Mar 23, 2020, at 03:54, Christopher Wood wrote: > I propose we remove this requirement and add an explicit signal in SH > that says whether or not ECHO was negotiated. Here's a spitball signaling option that might not stick out: Client sends (in the ECHO) a random value, N, with 32(?) <

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Christian Huitema
On 3/22/2020 3:23 PM, Stephen Farrell wrote: > Hiya, > > I was wondering what I wanted to say about this, until... > > On 22/03/2020 22:16, Eric Rescorla wrote: >> I think we should relax this requirement. It's turning out to be hard >> enough to design ECHO as-is. >> >> If/when we get ECHO fully

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Stephen Farrell
Hiya, I was wondering what I wanted to say about this, until... On 22/03/2020 22:16, Eric Rescorla wrote: > I think we should relax this requirement. It's turning out to be hard > enough to design ECHO as-is. > > If/when we get ECHO fully designed and widely deployed, we can then try to > find

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Eric Rescorla
I think we should relax this requirement. It's turning out to be hard enough to design ECHO as-is. If/when we get ECHO fully designed and widely deployed, we can then try to find designs which use the same basic design but are more stealthy. Trying to fix everything at once makes the best the ene

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Eric Rescorla
On Sun, Mar 22, 2020 at 2:49 PM Jonathan Hoyland wrote: > I'm worried that it'll be too tempting for orgs and Governments to just > drop sessions which have negotiated ECHO. > Well, those orgs will also be able to block encrypted DNS, without which ECHO is useless. We don't have an answer for th

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Jonathan Hoyland
I'm worried that it'll be too tempting for orgs and Governments to just drop sessions which have negotiated ECHO. Even if we had wide scale deployment of GREASE, if a third-party can allow GREASE but block successful ECHO handshakes then all the effort we've expended will be wasted. Does the probi

Re: [TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Christian Huitema
On 3/22/2020 9:54 AM, Christopher Wood wrote: > One of the original motivating requirements for ECHO (then ENSI) was > "do not stick > out" [1]. This complicates the current ECHO design, as clients must > trial decrypt > the first encrypted handshake message to determine whether a server > used th

[TLS] Dropping "do not stick out" from ECHO

2020-03-22 Thread Christopher Wood
One of the original motivating requirements for ECHO (then ENSI) was "do not stick out" [1]. This complicates the current ECHO design, as clients must trial decrypt the first encrypted handshake message to determine whether a server used the inner or outer ClientHello for a given connection. It'

[TLS] Weekly github digest (TLS Working Group Drafts)

2020-03-22 Thread Repository Activity Summary Bot
Issues -- * tlswg/tls-subcerts (+1/-0/💬0) 1 issues created: - Add RSA signing oracle concerns to security considerations (by grittygrease) https://github.com/tlswg/tls-subcerts/issues/59 Pull requests - * tlswg/draft-ietf-tls-esni (+1/-2/💬14) 1 pull requests submitted