7 ms·
I'm still pissed off we didn't get encrypted SNI in TLS 1.3 It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.
by aaomidi 9y ago
I'm still pissed off we didn't get encrypted SNI in TLS 1.3
It would've broken so many dpi based censorship systems in countries like Iran, Turkey, and Russia.
- gruez 9y agohow would encrypted SNI work? sure, you can probably do some sort of DHE, but that's vulnerable to MITM, which is why we have certificates to begin with.
- muizelaar 9y agohttps://tools.ietf.org/html/draft-huitema-tls-sni-encryption https://tools.ietf.org/html/draft-huitema-tls-sni-encryption
- deleted 9y ago[deleted]
- arkadiyt 9y agoThere's domain fronting [1] and http/2 certificate frames [2] - they are conceptually similar. [1]: https://www.bamsoftware.com/papers/fronting/ https://www.bamsoftware.com/papers/fronting/ [2]: https://tools.ietf.org/html/draft-bishop-httpbis-http2-additional-certs-05 https://tools.ietf.org/html/draft-bishop-httpbis-http2-addit...
- gruez 9y agoboth of them seem to use the concept of "connect via a fake domain name, then connect to the real domain". i'm not sure how this is scaleable for everyday browsing. you might be able to find the fronting server for wikipedia, but how are you going to find the fronting server for every website you're visiting? this solves the problem of censorship, but not the problem of ISP surveillance.
- the8472 9y agoCouldn't the client send SNI after the DH and then the server authenticate the secret? That way MITM would always be detectable at least.
- ori_b 9y ago> Couldn't the client send SNI after the DH and then the server authenticate the secret? That means you can't use sni to route your request to a different server.
- infogulch 9y agoYes, whatever is serving on that interface will have to terminate TLS. Or somehow pass the session information to the proxied server, or ask the client to reconnect, or do some kind of tls tunneling from the client to the real host. I don't think any of those are unreasonable options.
- bscphil 9y agoWhat if we could have first class SSL certs for IP addresses? You connect to the IP and verify the cert it presents you with your PKI, then switch to the desired host via SNI or some other mechanism after DHE is established. I suspect you could do this without any extra hops but I haven't really thought through how that would work.
- gruez 9y agotls certificates already work out of the box for ip addresses (at least on firefox, see https://1.1.1.1/ https://1.1.1.1/), so that's actually a pretty neat solution.
- ori_b 9y ago> What if we could have first class SSL certs for IP addresses? They're not routable.
- rmwaite 9y agoWhat does this mean?
- ori_b 9y agoWhat's the next hop for a cryptographic hash? With IP addresses, you have a heirarchy: You match on a prefix to find the router to handle the next path, and that one matches on a longer prefix to find the next hop, and so on. That allows you to have routing tables that don't include every single host on the internet. This is what allows efficient routing to happen.
- AlexCoventry 9y ago> you can probably do some sort of DHE Could the browser send a symmetric key encrypted in the public key of the target website, as part of the initial challenge?
- infogulch 9y agoThe point is you don't know what the public key of the target website is. You find out by asking for it, and then you verify it's authenticity by checking the signature. Before you connect all you know is the domain and the keys of CA's you trust.
- AlexCoventry 9y agoAh, right. Thanks.
- hacknat 9y ago> But that’s vulnerable to MITM It is if that’s all you’re trusting, but you get to check the validity of the cert, so someone could MITM a TLS 1.3, but it wouldn’t do them much good as all they would get is a request for a certificate, then the normal TLS certification steps must proceed. Without the certificate private key the rest of the handshake would fail.
- gruez 9y agosure, they're not going to MITM your http connection, but they will be able to MITM your certificate connection, which allows them to discover what site you visited, which is the same problem that SNI has.
- saurik 9y agoThey can do this, but your browser would retroactively notice that it happened and go "holy shit that was bad, you should complain to someone about it". This does not solve for all threat models, but it does avoid the "snoopy ISP".
- vbezhenar 9y agoThere's nothing good about breaking DPI. Instead of blocking a single site you'll end up blocking entire IP address. I'd even suggest an optional extension of HTTPS which allows to put entire URL as unencrypted part of the request. Censorship systems usually block content by individual pages. Currently with HTTPS it's not possible to block individual page, so an entire website is blocked.
- Franciscouzo 9y agoThat would be such a bad idea, lots of websites send data that should be secret on the query parameters.
- jakobdabo 9y agoTLS and HTTP are different things. TLS is being used without HTTP in lots of cases. Besides, even if such extension had existed it would've been easy to write X in TLS header and Y in the HTTP payload to circumvent the ban, like the domain fronting[1] trick currently being used by e.g. Signal. [1] https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting
- aaomidi 9y agoServices like google share IPs amongs their services. If SNI was encrypted, youtube.com could not be blocked unless the entire IP space of google is blocked (which would be very hard to do since nearly everyone relies on gmail).
- vbezhenar 9y agoKazakhstan blocked major part of gmail functionality at one point of time. You couldn't download attachments, images didn't work, may be something else. I think they tried to block blogspot. but shared IP broke gmail. It was broken for months, nobody really cared except people pointlessly ranting on forums. Those, who needed working email, migrated to other providers or used proxy. I'd like to live in the world without censorship but I don't see this happening, so I'd prefer to minimize censorship damage at least.
- jakobdabo 9y agoGetting rid of plaintext SNI won't help much. The domain is there in the certificate itself. There are, of course, some (or maybe many, I don't have statistics) certificates for multiple domains (wildcard and alt. name), but still.
- cesarb 9y ago> The domain is there in the certificate itself. With TLS 1.3, the certificate is in the encrypted portion of the handshake.
- jakobdabo 9y agoThat's nice to hear. I stand corrected, thank you.
- dingaling 9y agoHowever as I understand the protocol the very first step of the TLS 1.3 handshake, the nonce generation, can be MiTMed sufficiently to allow an attacker to determine the target domain. It's only in the next step that server and client do authentication. The attacker can't trivially continue the handshake beyond that point but that might give enough info to log the attempt and terminate the connection.
- MertsA 9y agoOr just connect up a second connection and see what certificate they send back.
- eastdakota 9y agoWe’re working on it.
- chupasaurus 9y agoRussian here. Entries in gov's blacklist of sites should include IP addresses, domain names and optionally URLs. SNI isn't that helpful for ISPs because they could block traffic by IPs rather using DPI (IIRC only one NIR is using it, but for DNS rather than TLS itself).
- aaomidi 9y agoFor sites like google, blocking IPs would meet resistance.
- chupasaurus 9y agoThis situation is covered with a whitelist of IPs and domains (year ago it became official after exploitation of vulnerability in how blacklist register works, before it was on ISPs, Youtube was banned by some ISPs quite a few times), including .google.com, .youtube.com and other Alphabet's domains, *.facebook.com and some others.
- dullgiulio 9y agoSo effectively, if you post something on Blogger it cannot be taken down, because the whole Google would come down with it. Still, encrypting SNI hides quite some information (were you searching, watching youtube, reading blogger, was it image search, maps...?)
- chupasaurus 9y agoRechecked the list, only https://*.youtube.com https://*.youtube.com and (whooping) .google. are inside [0]. [0]: https://storage.googleapis.com/smisc/%D0%A1%D0%BF%D0%B8%D1%81%D0%BE%D0%BA%20%D1%81%D0%B5%D1%82%D0%B5%D0%B2%D1%8B%D1%85%20%D0%B0%D0%B4%D1%80%D0%B5%D1%81%D0%BE%D0%B2.xlsx https://storage.googleapis.com/smisc/%D0%A1%D0%BF%D0%B8%D1%8...
- JetSpiegel 9y agoSNI is just an ugly hack because IPv6 is not deployed widely. You could have a server listen on a subnet and clients randomizing its target IP.
- dullgiulio 9y agoDatacenters today work differently: IPs convey a fuzzy idea of where to find what you are looking for. Server name will be used to route your request internally in the DC. I cannot imagine exposing the IPv6 IPs of single racks: it makes the whole "cloud" thing fall apart.
- QasimK 9y agoIf thats true it’s because of the limitations of IPv4 more than anything else. With a single $5/month machine from Linode you have a /64 IPv6 subnet, that is 2^64 IP addresses just for that one machine.
- MertsA 9y agoYou don't need to. This is no different than how lack of SNI is handled with IPv4, just have multiple static IP addresses on whatever frontend you're using. With IPv6 it's easy to delegate as many IP addresses as you want. The slight problem with this is that it doesn't solve the privacy problem at all as now you just look at the IP address and check which domain it serves.