On Wed, Dec 02, 2015 at 05:53:40PM +0000, Jacob Appelbaum wrote: > > I think that is false. One could easily use the "cleartext" SNI field > and insert an encrypted value. A hash of the name would be a simple > example but not a secure example, of course.
Furthermore, SNIs have name type, so even the server_name extension itself could be extended. The length field is 16-bit too... -Ilari _______________________________________________ TLS mailing list TLS@ietf.org https://www.ietf.org/mailman/listinfo/tls
