search

tlswg / draft-ietf-tls-esni

TLS Encrypted Client Hello
https://tlswg.github.io/draft-ietf-tls-esni/#go.draft-ietf-tls-esni.html
Other
231 stars 56 forks source link

Recommend greasing PSK? #606

Closed ekr closed 4 months ago

ekr commented 4 months ago

In Watson Ladd's review, he asks:

Should we use RFC 2119 language for the server as well? Right now we only say what the client must do when the server violates the rules.

We do recommend greasing ECH. My sense is that this is on the bubble and we could leave it as-is, but I could be persuaded otherwise.

@davidben @dennisjackson @martinthomson

martinthomson commented 4 months ago

I just checked with NSS and we overwrite the outer values for PSK (identities and binders) with random data. That seems fairly simple to do and it makes the handshake choice harder to distinguish.

Note that we do not hide the length, which might be an issue for identity, but we're already exposed to the length leakage, so fixed-length identities are best in any case.

ekr commented 4 months ago

So that's a vote for "grease"?

martinthomson commented 4 months ago

Yeah, I'm happy with it.

dennisjackson commented 4 months ago

👍