4 ms·
Oh gosh that sounds awful. I have to admit I was using "Encrypted SNI" in a general sense, I hadn't looked at the details of ESNI, the proposed solution. In my
by kohtatsu 7y ago
Oh gosh that sounds awful. I have to admit I was using "Encrypted SNI" in a general sense, I hadn't looked at the details of ESNI, the proposed solution. In my head encrypted SNIs was a somewhat straightforward problem to solve but thinking about it more it's a bit tricky. What you describe of ESNI sounds horribly convoluted :(
- toast0 7y agoThe key exchange and identification for encrypted X is always the hard part. For encrypted SNI, keys are expected to be published via DNS, which GFW is happy to disrupt. Once you get a key, you have to send the key identifier in the clear (otherwise, the service doesn't know how to decrypt; unless you want to just do trial decryption with all available keys and hope that doesn't use too much CPU); the key identifier becomes the enforcement target at this point, unless you're on a host that shares ESNI keys among the many sites it hosts and is not acceptable collateral damage.