4 ms·

This makes a lot of sense. Slightly stupid question but maybe you know the exact reason: could we apply symmetric encryption only after Alice has determined th

• tialaramex 3y ago
  If the message from Bob, proving his identity, was sent in the clear, we're needlessly telling people that Alice is talking to Bob. In fact earlier TLS versions did send the certificates in the clear which is a lesser version of this problem, TLS 1.3 no longer does that, everything after "Hello" is encrypted. IETF Best Common Practice 188 (RFC 7258) "Pervasive Monitoring is an Attack" says that for Internet Protocols we should assume that surveillance is inherently an atttack on the Internet and pro-actively defeat it by designing protocols not to leak information unnecessarily. Now, in this specific case, the Hello message from Alice likely has SNI (Server Name Indication) so probably Alice is saying "Hi Bob" at the start in the clear, but (a) Not necessarily, in some cases this won't happen, so no need to tell us it's Bob later (b) There is ongoing work to fix that, Encrypted Client Hello, which will leverage DNS to give Alice keys she can use to make it harder to know, so there's no reason to make it worse.