Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Roman's last comments #46

Merged
merged 2 commits into from
Oct 7, 2019
Merged

Roman's last comments #46

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6b3b38d
Merge pull request #11 from tlswg/master
huitema Sep 24, 2019
db6571b
Minimal set of change to address late comments from Roman.
huitema Sep 28, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions draft-ietf-tls-sni-encryption.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,9 @@ a TLS-level solution, the most popular approach to SNI privacy for web
services is HTTP-level fronting, which we discuss in (#httpfronting).

This document does not present the design of a solution, but
provides guidelines for evaluating proposed solutions.
provides guidelines for evaluating proposed solutions. (The review of
HTTP-level solutionsin (#httpfronting) is not an endorsement of these
solutions.)
The need for related work on the encryption of the Application Layer
Protocol Negotiation (ALPN) parameters of TLS is discussed in
(#hiding-alpn).
Expand Down Expand Up @@ -157,7 +159,7 @@ of this draft. They include:
sites for which inspection would intrude on the privacy of employees.

The SNI is probably also included in the general collection of metadata
by pervasive surveillance actors, for example to identify services
by pervasive surveillance actors [@?RFC7258], for example to identify services
used by surveillance targets.

## SNI encryption timeliness {#sniwhyencryptnow}
Expand Down Expand Up @@ -496,8 +498,9 @@ In particular, the requirement to not stick out presented in
(#snireqdontstickout) may have to be lifted, especially
for proposed solutions that could quickly reach large scale deployments.

Replacing clear text SNI transmission by an encrypted variant will also
thwart MITM interferences that are sometimes described as legitimate.
Replacing clear text SNI transmission by an encrypted variant will break
or reduce the efficacy of the operational practices and techniques
implemented in middle-boxes as described in (#snileak).
As explained in (#end-to-end), alternative solutions will have to
be developed.

Expand Down