[TLS] Mail regarding draft-ietf-tls-esni

2018-11-26 Thread Nick Lamb
In section 7.1 the -02 draft says: Clearly, DNSSEC (if the client validates and hard fails) is a defense against this form of attack, but DoH/DPRIVE are also defenses against DNS attacks by attackers on the local network, which is a common case where SNI. Where SNI what? I'd be tempt

Re: [TLS] Mail regarding draft-ietf-tls-esni

2018-11-26 Thread Stephen Farrell
On 25/11/2018 17:18, Nick Lamb wrote: > In section 7.1 the -02 draft says: > >Clearly, DNSSEC (if the client validates and hard fails) is a defense >against this form of attack, but DoH/DPRIVE are also defenses against >DNS attacks by attackers on the local network, which is a common

Re: [TLS] Mail regarding draft-ietf-tls-esni

2018-11-26 Thread Eric Rescorla
On Mon, Nov 26, 2018 at 1:36 PM Nick Lamb wrote: > In section 7.1 the -02 draft says: > >Clearly, DNSSEC (if the client validates and hard fails) is a defense >against this form of attack, but DoH/DPRIVE are also defenses against >DNS attacks by attackers on the local network, which i

Re: [TLS] Mail regarding draft-ietf-tls-esni

2018-11-26 Thread Eric Rescorla
On Mon, Nov 26, 2018 at 2:08 PM Stephen Farrell wrote: > > > On 25/11/2018 17:18, Nick Lamb wrote: > > In section 7.1 the -02 draft says: > > > >Clearly, DNSSEC (if the client validates and hard fails) is a defense > >against this form of attack, but DoH/DPRIVE are also defenses against >