As mentioned in #560, there's slightly different language when referencing anonymity sets. Specifically, the Introduction mentions that co-located servers with consistent externally visible TLS configurations form an anonymity set. The Security and Privacy Goals section states that The set of hosts which share the same ECHConfig and TLS configuration is referred to as the anonymity set. To me there's a subtle difference here in that I understand the externally visible TLS configurations is meant to apply to all externally observable behavior, but my impression when just seeing ECHConfig and TLS configuration is that these are referring to user-provided TLS configurations which don't encompass all externally observable behavior.
One way to fix this is simply to make the phrasing consistent, but I think it would be even nicer to have the term anonymity set clearly defined in a single, easily accessible location since it's central to the precise guarantees ECH aims to provide. Maybe it could be explicitly defined in the Conventions and Definitions section? Given a canonical definition, further usages of the anonymity set could just refer to that definition.
Maybe other significant terms like Client-Facing Server could also be defined in a similar location too?
As mentioned in #560, there's slightly different language when referencing anonymity sets. Specifically, the Introduction mentions that co-located servers with
consistent externally visible TLS configurationsform an anonymity set. The Security and Privacy Goals section states thatThe set of hosts which share the same ECHConfig and TLS configuration is referred to as the anonymity set. To me there's a subtle difference here in that I understand theexternally visible TLS configurationsis meant to apply to all externally observable behavior, but my impression when just seeingECHConfig and TLS configurationis that these are referring to user-provided TLS configurations which don't encompass all externally observable behavior.One way to fix this is simply to make the phrasing consistent, but I think it would be even nicer to have the term
anonymity setclearly defined in a single, easily accessible location since it's central to the precise guarantees ECH aims to provide. Maybe it could be explicitly defined in the Conventions and Definitions section? Given a canonical definition, further usages of the anonymity set could just refer to that definition.Maybe other significant terms like Client-Facing Server could also be defined in a similar location too?