Encrypted SNI

Transcript

1. &ODSZQUFE4/*
   ,B[VIP0LV
   +VO
   

   View Slide

2. 
   • MFBEEFWFMPQFSPG
   – )0 )551
   
   – QJDPUMT 5-4
   
   – RVJDMZ 26*$
   
   • BVUIPSPG
   – 3'$r &BSMZ)JOUTGPS)551
   – ESBGUJFUGUMTFTOJ ˡ UIJT
   – ESBGULB[VIPRVJDBVUIFOUJDBUFEIBOETIBLF
   8IPBN*
   

   View Slide

3. 
   • *&5'5-48(XPSLJOHJUFN
   • BVUIPST
   – &SJD3FTDPSMB FLS!SUGNDPN
   
   – ,B[VIP0LV LB[VIPPLV!HNBJMDPN
   
   – /JDL4VMMJWBO OJDL!DMPVEGMBSFDPN
   
   – $ISJTUPQIFS"8PPE DBXPPE!BQQMFDPN
   
   ESBGUJFUGUMTFTOJ
   

   View Slide

4. 
   • 4FSWFS/BNF*OEJDBUJPO
   – QBSUPG$MJFOU)FMMP
   – VTFECZUIFTFSWFSUPTFMFDU
   • LFZBMHPSJUIN
   • TFSWFSDFSUJGJDBUF
   8IBUJT4/*
   ClientHello (w. pubkey)
   ServerHello (w. pubkey)
   EncryptedExtensions
   ServerCertificate
   Finished
   App. Data (server only)
   (ClientCertificate)
   Finished
   Application Data
   Client Server
   plaintext
   encrypted
   (unauthenticated)
   encrypted
   (authenticated)
   

   View Slide

5. 
   8IZFODSZQU4/*
   

   View Slide

6. 
   • 3'$
   – l1FSWBTJWFNPOJUPSJOHJTBUFDIOJDBMBUUBDL
   UIBUTIPVMECFNJUJHBUFEJOUIFEFTJHOPG
   *&5'QSPUPDPMT XIFSFQPTTJCMFz
   • 3'$
   – l5IF*"#VSHFTQSPUPDPMEFTJHOFSTUPEFTJHO
   GPSDPOGJEFOUJBMPQFSBUJPOCZEFGBVMU8F
   TUSPOHMZFODPVSBHFEFWFMPQFSTUPJODMVEF
   FODSZQUJPOJOUIFJSJNQMFNFOUBUJPOTBOEUP
   NBLFUIFNFODSZQUFECZEFGBVMUz
   3BUJPOBMF
   

   View Slide

7. 
   • %/4SFTPMVUJPO
   • 4/*
   • TFSWFSDFSUJGJDBUF
   • TFSWFS*1BEESFTT
   • USBGGJDBOBMZTJT
   4PVSDFTPGTFSWFSJEFOUJUZMFBLBHF
   

   View Slide

8. 
   • %/4SFTPMVUJPO %P5%P)
   • 4/* ˡ UIJT
   • TFSWFSDFSUJGJDBUF 5-4
   • TFSWFS*1BEESFTT NBTTTDBMFNVMUJUFOBODZ
   • USBGGJDBOBMZTJT
   4PVSDFTPGTFSWFSJEFOUJUZMFBLBHF
   

   View Slide

9. 
   ESBGUJFUGUMTFTOJ
   

   View Slide

10. 
    • r ESBGULB[VIPQSPUFDUFETOJ
    
    • r ESBGUSFTDPSMBUMTFTOJ
    • r ESBGUJFUGUMTFTOJ
    • r ESBGUJFUGUMTFTOJ
    • r ESBGUJFUGUMTFTOJ
    )JTUPSZ
    

    View Slide

11. 
    • VTF%/4UPEJTUSJCVUFQVCMJDLFZ
    • UIBUJTVTFEGPSFODSZQUJOHUIF4/*
    ,FZJEFB
    

    View Slide

12. 
    )PXJUXPSLT
    example.com A?
    example.com ESNI?
    example.com A=192.0.2.1
    example.com ESNI=pubkey
    ClientHello {ESNI=encrypt("example.com")}
    DoH recursor
    HTTPS server
    DNS authoritative
    server
    

    View Slide

13. 
    TUSVDU\
    VJOU WFSTJPO
    VJOU DIFDLTVN>
    PQBRVF QVCMJD@OBNF? QMBJOUFYU4/*WBMVF
    ,FZ4IBSF&OUSZ LFZT? QVCMJDLFZT
    $JQIFS4VJUF DJQIFS@TVJUFT?
    VJOU QBEEFE@MFOHUI
    VJOU OPU@CFGPSF
    VJOU OPU@BGUFS
    &YUFOTJPO FYUFOTJPOT?
    ^&4/*,FZT
    FYBNQFOFU*/&4/*FTOJLFZT JOCJOBSZ
    &4/*SFDPSE
    

    View Slide

14. 
    • TPUIBUJUDBOCFTNBMM
    • EPXOTJEFBUUBDLFSDBOTQPPG
    – CVUBOBUUBDLFSDBOBMTPTQPPGUIF*1
    BEESFTTPGFYBNQMFDPN
    • BDDFTTUPUIFBEESFTTSFWFBMTUIF4/*
    • UPSFQISBTF &4/*
    – JNQSPWFTQSJWBDZXIFO%/4JTIFBMUIZ
    – EPFTOPUXPSTFOUIFTFDVSJUZXIFOVOEFS
    BUUBDL
    &4/*SFDPSEJTOPUTJHOFE
    

    View Slide

15. 
    • #PSJOH44-
    • $MPVEGMBSF
    • .P[JMMB'JSFGPY
    • QJDPUMT
    *NQMFNFOUFECZ
    

    View Slide

16. 
    3FDFOUMZBEEFEGFBUVSFT
    

    View Slide

17. 
    • 8IBUIBQQFOTXIFOUIF&4/*LFZ
    EJTUSJCVUFEVTJOH%/4BOEUIFLFZPO
    UIFTFSWFSCFDPNFTPVUPGTZOD
    • 3FDPWFSZJTCFUUFSUIBOIBSEGBJM
    – MFUUIFTFSWFSSFQMBDFUIF&4/*LFZVTFECZ
    UIFDMJFOU
    *NQSPWF&4/*SPCVTUOFTT
    

    View Slide

18. 
    • )PXJUXPSLT
    – QVCMJDOBNFBOEQVCMJDLFZJO&4/*3FDPSE
    – DMJFOUPGGFSTQMBJOUFYU4/* QVCMJDOBNF
    
    BOE&4/* FODSZQUFEOBNF
    
    – XIFOTFSWFSSFDFJWFTBDPSSVQU&4/* JU
    • GJOJTIFTUIF5-4IBOETIBLFBTlQVCMJDOBNFz
    • TFOETBOVQEBUFE&4/*LFZ
    – DMJFOUSFDPOOFDUTVTJOHUIFVQEBUFE&4/*
    LFZ
    *NQSPWF&4/*SPCVTUOFTT
    

    View Slide

19. 
    • 5IFJTTVF
    – BXFCTJUFDBOVTFNVMUJQMF$%/T
    – FWFSZ$%/XJMMIBWFEJGGFSFOU&4/*LFZT
    – XIBUIBQQFOTJGDMJFOUPCUBJOT"SFDPSEGPS
    $%/" BOE&4/*SFDPSEGPS$%/#
    • QVCMJDOBNFDBOOPUGJYUIFJTTVF CFDBVTFQVCMJD
    OBNFXJMMCFEJGGFSFOUGPSFBDI$%/&4/*
    SFDPSE
    l$PNCJOFE3FDPSEzFYUFOTJPO
    

    View Slide

20. 
    • 4PMVUJPO
    – DSFBUFBGBUSFDPSE DPOUBJOJOHCPUI&4/*
    LFZTBOE *1BEESFTTFT
    l$PNCJOFE3FDPSEzFYUFOTJPO
    

    View Slide

21. 
    5IF*OUFSOFUJTGPSFOEVTFST
    

    View Slide

22. 
    • QSJWBDZJTUPQMFWFMQSJPSJUZ
    • MFTTlJNQMJDJUTJHOBMzFYQPTFEUPOFUXPSL
    – FODSZQUFE%/4USBGGJD
    – FODSZQUFE4/*
    – FODSZQUFEUSBOTQPSU 26*$
    
    • lFYQMJDJUTJHOBMzSFRVJSFTTUBOEBSEJ[BUJPO
    – 26*$TQJOCJU
    5IF*OUFSOFUJTGPSFOEVTFST
    

    View Slide

23. 
    • 3'$
    • 3'$
    • ESBGUJFUGUMT
    • ESBGUOPUUJOHIBNGPSUIFVTFST
    3FGFSFODFT
    

    View Slide