The ECH proposal for Encrypted SNI is almost ready, but for a very small debate. The original proposal was using trial description to distinguish between ECH aware responses to the encrypted inner Client-Hello from non ECH aware response to the "cover" outer CH. This is problematic in the QUIC use case. The latest proposal is to embed a "hint" in 8 bytes of the Server Random. The proposal was for ECH-aware servers to use eight bytes of a hash of the inner Client Random as a hint. Analysis shows that this enables two attacks:
1) If the Client Hello is replayed, the same hint will be present in the response to the original CH and to the response to the copy, providing observers with a clear indication that ECH was used. 2) If the Client Hello is intercepted by an MITM attacker, the attacker can rewrite the server's response before presenting it to the client. The attacker formats its own Server Hello that reuses the Server Random from the original server response, but use its own key share, etc. The hint will cause the ECH aware client to create an handshake key using the inner CH. In a QUIC set up, the MITM attacker can easily detect that, before even transmitting the server's certificate. Thus, the MITM attacker can detect usage of ECH. We have a simple proposal that solves the replay attack: set the hint as a hash of both the inner Client Random and the "non-hint" bytes of the Server Random. That's clearly a good idea, but it does not solve the active MITM attack. Solving that requires tying the hint with the handshake key derived by the original server, for example by hashing the inner Client Random, the "non-hint" bytes of the Server Random, and the server key share. That's harder to implement, so the question is about cost and opportunity. This all relates to how much ECH is "sticking out". The current stance is that a passive attacker cannot distinguish between a client using ECH to access a hidden SNI and a client merely greasing the ECH extension. The observation is that there may be many potential active attacks, especially if the server shares its ESNI/ECH configuration publicly. If there are many such attacks, and if defense of the hint against MITM is hard to implement, implementing the defense might make the code more fragile, with little actual gain. But I am not convinced by that argument, because it smells a lot like "the other side of the boat is leaking too, why should I plug this particular leak?" And so, at Chris Wood's request, I am sending this message to the list. -- Christian Huitema _______________________________________________ TLS mailing list [email protected] https://www.ietf.org/mailman/listinfo/tls
