Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Note timing side channels #559

Merged
merged 2 commits into from
Oct 12, 2023
Merged

Note timing side channels #559

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78d9bbf
Note timing side channels
chris-wood Oct 9, 2023
a2b72a8
Update draft-ietf-tls-esni.md
chris-wood Oct 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions draft-ietf-tls-esni.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1186,6 +1186,8 @@ a compliant ECH application MUST implement the following HPKE cipher suite:

# Security Considerations

This section contains security considerations for ECH.

## Security and Privacy Goals {#goals}

ECH considers two types of attackers: passive and active. Passive attackers can
Expand Down Expand Up @@ -1305,14 +1307,22 @@ send context-specific values in ClientHelloOuter.
Values which are independent of the true server name, or other information the
client wishes to protect, MAY be included in ClientHelloOuter. If they match
the corresponding ClientHelloInner, they MAY be compressed as described in
{{encoding-inner}}. However, note the payload length reveals information about
which extensions are compressed, so inner extensions which only sometimes match
the corresponding outer extension SHOULD NOT be compressed.
{{encoding-inner}}. However, note that the payload length reveals information
about which extensions are compressed, so inner extensions which only sometimes
match the corresponding outer extension SHOULD NOT be compressed.

Clients MAY include additional extensions in ClientHelloOuter to avoid
signaling unusual behavior to passive observers, provided the choice of value
and value itself are not sensitive. See {{dont-stick-out}}.

## Inner ClientHello {#inner-clienthello}

Values which depend on the contents of ClientHelloInner, such as the
true server name, can influence how client-facing servers process this message.
In particular, timing side channels can reveal information about the contents
of ClientHelloInner. Implementations should take such side channels into
consideration when reasoning about the privacy properties that ECH provides.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://www.rfc-editor.org/rfc/rfc6919.html#section-2 ;-)

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I don't have a suggestion and am not requesting a change. Just amused.)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heh, yeah. I mostly just copied boilerplate language we use in Privacy Pass. 🤷


## Related Privacy Leaks

ECH requires encrypted DNS to be an effective privacy protection mechanism.
Expand Down
Loading