Encrypted SNI

A1f8ed12fefd7759ef8838e62ee409a6?s=47 kazuho
June 11, 2019

Encrypted SNI

A1f8ed12fefd7759ef8838e62ee409a6?s=128

kazuho

June 11, 2019
Tweet

Transcript

  1. &ODSZQUFE4/* ,B[VIP0LV +VO

  2.  • MFBEEFWFMPQFSPG – )0 )551   – QJDPUMT

    5-4 – RVJDMZ 26*$ • BVUIPSPG – 3'$r &BSMZ)JOUTGPS)551 – ESBGUJFUGUMTFTOJ ˡ UIJT – ESBGULB[VIPRVJDBVUIFOUJDBUFEIBOETIBLF 8IPBN*
  3.  • *&5'5-48(XPSLJOHJUFN • BVUIPST – &SJD3FTDPSMB FLS!SUGNDPN – ,B[VIP0LV

    LB[VIPPLV!HNBJMDPN – /JDL4VMMJWBO OJDL!DMPVEGMBSFDPN – $ISJTUPQIFS"8PPE DBXPPE!BQQMFDPN ESBGUJFUGUMTFTOJ
  4.  • 4FSWFS/BNF*OEJDBUJPO – QBSUPG$MJFOU)FMMP – VTFECZUIFTFSWFSUPTFMFDU • LFZBMHPSJUIN •

    TFSWFSDFSUJGJDBUF 8IBUJT4/* ClientHello (w. pubkey) ServerHello (w. pubkey) EncryptedExtensions ServerCertificate Finished App. Data (server only) (ClientCertificate) Finished Application Data Client Server plaintext encrypted (unauthenticated) encrypted (authenticated)
  5.  8IZFODSZQU4/*

  6.  • 3'$ – l1FSWBTJWFNPOJUPSJOHJTBUFDIOJDBMBUUBDL UIBUTIPVMECFNJUJHBUFEJOUIFEFTJHOPG *&5'QSPUPDPMT XIFSFQPTTJCMFz • 3'$

    – l5IF*"#VSHFTQSPUPDPMEFTJHOFSTUPEFTJHO GPSDPOGJEFOUJBMPQFSBUJPOCZEFGBVMU8F TUSPOHMZFODPVSBHFEFWFMPQFSTUPJODMVEF FODSZQUJPOJOUIFJSJNQMFNFOUBUJPOTBOEUP NBLFUIFNFODSZQUFECZEFGBVMUz 3BUJPOBMF
  7.  • %/4SFTPMVUJPO • 4/* • TFSWFSDFSUJGJDBUF • TFSWFS*1BEESFTT •

    USBGGJDBOBMZTJT 4PVSDFTPGTFSWFSJEFOUJUZMFBLBHF
  8.  • %/4SFTPMVUJPO %P5%P) • 4/* ˡ UIJT • TFSWFSDFSUJGJDBUF

    5-4 • TFSWFS*1BEESFTT NBTTTDBMFNVMUJUFOBODZ • USBGGJDBOBMZTJT 4PVSDFTPGTFSWFSJEFOUJUZMFBLBHF
  9.  ESBGUJFUGUMTFTOJ

  10.  • r ESBGULB[VIPQSPUFDUFETOJ • r ESBGUSFTDPSMBUMTFTOJ • r ESBGUJFUGUMTFTOJ

     • r ESBGUJFUGUMTFTOJ • r ESBGUJFUGUMTFTOJ )JTUPSZ
  11.  • VTF%/4UPEJTUSJCVUFQVCMJDLFZ • UIBUJTVTFEGPSFODSZQUJOHUIF4/* ,FZJEFB

  12.  )PXJUXPSLT example.com A? example.com ESNI? example.com A=192.0.2.1 example.com ESNI=pubkey

    ClientHello {ESNI=encrypt("example.com")} DoH recursor HTTPS server DNS authoritative server
  13.  TUSVDU\ VJOU WFSTJPO VJOU DIFDLTVN<> PQBRVF QVCMJD@OBNF? QMBJOUFYU4/*WBMVF ,FZ4IBSF&OUSZ

    LFZT? QVCMJDLFZT $JQIFS4VJUF DJQIFS@TVJUFT? VJOU QBEEFE@MFOHUI VJOU OPU@CFGPSF VJOU OPU@BGUFS &YUFOTJPO FYUFOTJPOT? ^&4/*,FZT FYBNQFOFU*/&4/*FTOJLFZT JOCJOBSZ &4/*SFDPSE
  14.  • TPUIBUJUDBOCFTNBMM • EPXOTJEFBUUBDLFSDBOTQPPG – CVUBOBUUBDLFSDBOBMTPTQPPGUIF*1 BEESFTTPGFYBNQMFDPN • BDDFTTUPUIFBEESFTTSFWFBMTUIF4/*

    • UPSFQISBTF &4/* – JNQSPWFTQSJWBDZXIFO%/4JTIFBMUIZ – EPFTOPUXPSTFOUIFTFDVSJUZXIFOVOEFS BUUBDL &4/*SFDPSEJTOPUTJHOFE
  15.  • #PSJOH44- • $MPVEGMBSF • .P[JMMB'JSFGPY • QJDPUMT *NQMFNFOUFECZ

  16.  3FDFOUMZBEEFEGFBUVSFT

  17.  • 8IBUIBQQFOTXIFOUIF&4/*LFZ EJTUSJCVUFEVTJOH%/4BOEUIFLFZPO UIFTFSWFSCFDPNFTPVUPGTZOD • 3FDPWFSZJTCFUUFSUIBOIBSEGBJM – MFUUIFTFSWFSSFQMBDFUIF&4/*LFZVTFECZ UIFDMJFOU

    *NQSPWF&4/*SPCVTUOFTT
  18.  • )PXJUXPSLT – QVCMJDOBNFBOEQVCMJDLFZJO&4/*3FDPSE – DMJFOUPGGFSTQMBJOUFYU4/* QVCMJDOBNF  BOE&4/*

    FODSZQUFEOBNF – XIFOTFSWFSSFDFJWFTBDPSSVQU&4/* JU • GJOJTIFTUIF5-4IBOETIBLFBTlQVCMJDOBNFz • TFOETBOVQEBUFE&4/*LFZ – DMJFOUSFDPOOFDUTVTJOHUIFVQEBUFE&4/* LFZ *NQSPWF&4/*SPCVTUOFTT
  19.  • 5IFJTTVF – BXFCTJUFDBOVTFNVMUJQMF$%/T – FWFSZ$%/XJMMIBWFEJGGFSFOU&4/*LFZT – XIBUIBQQFOTJGDMJFOUPCUBJOT"SFDPSEGPS $%/"

    BOE&4/*SFDPSEGPS$%/# • QVCMJDOBNFDBOOPUGJYUIFJTTVF CFDBVTFQVCMJD OBNFXJMMCFEJGGFSFOUGPSFBDI$%/&4/* SFDPSE l$PNCJOFE3FDPSEzFYUFOTJPO
  20.  • 4PMVUJPO – DSFBUFBGBUSFDPSE DPOUBJOJOHCPUI&4/* LFZTBOE *1BEESFTTFT l$PNCJOFE3FDPSEzFYUFOTJPO

  21.  5IF*OUFSOFUJTGPSFOEVTFST

  22.  • QSJWBDZJTUPQMFWFMQSJPSJUZ • MFTTlJNQMJDJUTJHOBMzFYQPTFEUPOFUXPSL – FODSZQUFE%/4USBGGJD – FODSZQUFE4/* –

    FODSZQUFEUSBOTQPSU 26*$ • lFYQMJDJUTJHOBMzSFRVJSFTTUBOEBSEJ[BUJPO – 26*$TQJOCJU 5IF*OUFSOFUJTGPSFOEVTFST
  23.  • 3'$ • 3'$ • ESBGUJFUGUMT • ESBGUOPUUJOHIBNGPSUIFVTFST 3FGFSFODFT