Re: [TLS] New Version for draft-segers-tls-cert-validation-ext

2022-08-25 Thread Ashley Kopman
Rob, Thank you for your explanation. Although our use case is aviation, our goal is to write this draft so that it can be used by other domains. Since this group has the experts in TLS, any suggestions on the technical approach is extremely useful. As far as approval, it is our hope that this

Re: [TLS] New Version for draft-segers-tls-cert-validation-ext

2022-08-25 Thread Rob Sayre
On Thu, Aug 25, 2022 at 5:43 AM Ashley Kopman wrote: > As far as approval, it is our hope that this can become an IETF standard. > Aviation for a long time has relied on custom one-off solutions and is > trying to use standardized solutions. ICAO has agreed to move forward with > this approach co

Re: [TLS] ECH not protect SNI

2022-08-25 Thread Viktor Dukhovni
On Thu, Aug 25, 2022 at 05:12:43PM -0400, Ben Schwartz wrote: > > Here is my another undisclosed ambition, a PSI free Internet. > > I think you would be better off starting with DANE (RFC 7671), rather than > ECH. If you're willing to accept DNSSEC as a requirement, all sorts of > strange things

Re: [TLS] ECH not protect SNI

2022-08-25 Thread 涛叔
Hi, Ben > On Aug 26, 2022, at 05:12, Ben Schwartz > wrote: > > I think you would be better off starting with DANE (RFC 7671), rather than > ECH. If you're willing to accept DNSSEC as a requirement, all sorts of > strange things become possible. For example, with DANE-EE and the SPKI > sele