4 ms·

Why not just use TLS?

paraboul 7y ago
Because TLS doesn't operate at TCP level. It encrypts the payload carried by it. TCP (and IP) headers (source/dst IP, port, flags, etc..) remain unencrypted. On the other hand, IPsec operates at IP level (which can be tunneled over a clear IP/TCP layer)
paddez 7y ago
TLS is an Application layer protocol, so it's encapsulated within a TCP connection. TCP connections themselves are encapsulated within IP - so if you can masquerade an IP packet, the inner TLS segment won't protect against decisions at that level.
vngzs 7y ago
You can read the SNI without decrypting[0]. You can see it in the ClientHello when I connect to news.ycombinator.com: Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx, Dst: 209.216.230.240 Transmission Control Protocol, Src Port: 64962, Dst Port: 443, Seq: 1, Ack: 1, Len: 517 Transport Layer Security TLSv1.2 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 512 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 508 Version: TLS 1.2 (0x0303) Extension: server_name (len=25) Type: server_name (0) Length: 25 Server Name Indication extension Server Name list length: 23 Server Name Type: host_name (0) Server Name length: 20 Server Name: news.ycombinator.com Extension: padding (len=172) The server name is right there, in the packets, even for TLS! Since the Great Firewall sits between you and the website, it can know the sequence number and send an RST as soon as the connection is initiated. For a less destructive use of this packet introspection, I've been using Istio to inspect ClientHello SNIs to control egress traffic from Kubernetes[1]. The SNI extension is useful, but it can leak some metadata to adversaries. [0]: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication [1]: https://istio.io/docs/tasks/traffic-management/egress/egress-gateway/ https://istio.io/docs/tasks/traffic-management/egress/egress...
- bogomipz 7y ago
  Did you use Tshark for outputting this TLS handshake? I ask because it's so nicely formatted and legible.
  - vngzs 7y ago
    Wireshark -> [select the field you want] -> Right Click -> Copy -> All Visible Items
- MaxBarraclough 7y ago
  But that's SNI's fault specifically. For comparison, SSH doesn't do that (to my knowledge at least), but the attacker can still see the destination IP, and might well be able to map that back to the domain. I agree though that ideally a bad guy intercepting your traffic should not be able to tell where it is headed.

Because TLS doesn't operate at TCP level. It encrypts the payload carried by it. TCP (and IP) headers (source/dst IP, port, flags, etc..) remain unencrypted. On the other hand, IPsec operates at IP level (which can be tunneled over a clear IP/TCP layer)

paddez 7y ago

TLS is an Application layer protocol, so it's encapsulated within a TCP connection. TCP connections themselves are encapsulated within IP - so if you can masquerade an IP packet, the inner TLS segment won't protect against decisions at that level.

vngzs 7y ago

You can read the SNI without decrypting[0]. You can see it in the ClientHello when I connect to news.ycombinator.com: Internet Protocol Version 4, Src: xxx.xxx.xxx.xxx, Dst: 209.216.230.240 Transmission Control Protocol, Src Port: 64962, Dst Port: 443, Seq: 1, Ack: 1, Len: 517 Transport Layer Security TLSv1.2 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 512 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 508 Version: TLS 1.2 (0x0303) Extension: server_name (len=25) Type: server_name (0) Length: 25 Server Name Indication extension Server Name list length: 23 Server Name Type: host_name (0) Server Name length: 20 Server Name: news.ycombinator.com Extension: padding (len=172) The server name is right there, in the packets, even for TLS! Since the Great Firewall sits between you and the website, it can know the sequence number and send an RST as soon as the connection is initiated. For a less destructive use of this packet introspection, I've been using Istio to inspect ClientHello SNIs to control egress traffic from Kubernetes[1]. The SNI extension is useful, but it can leak some metadata to adversaries. [0]: https://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication [1]: https://istio.io/docs/tasks/traffic-management/egress/egress-gateway/ https://istio.io/docs/tasks/traffic-management/egress/egress...

bogomipz 7y ago
Did you use Tshark for outputting this TLS handshake? I ask because it's so nicely formatted and legible.
- vngzs 7y ago
  Wireshark -> [select the field you want] -> Right Click -> Copy -> All Visible Items
MaxBarraclough 7y ago
But that's SNI's fault specifically. For comparison, SSH doesn't do that (to my knowledge at least), but the attacker can still see the destination IP, and might well be able to map that back to the domain. I agree though that ideally a bad guy intercepting your traffic should not be able to tell where it is headed.