> On Oct 23, 2017, at 1:00 PM, Christian Huitema <[email protected]> wrote:
>
> As Viktor says, the easy way for STS is to avoid the "multiplexed
> server" scenario. In fact, that's a pretty natural use of MX records.
> The MX record for "some-personal-server.com" would point to
> "mta.example.net", the SNI would be "mta.example.net", and the IP
> address in the IP header would be that of "mta.example.net". The SNI
> does not introduce a privacy leak in that scenario.
In practice it would add a leak, because, for example, Microsoft has
a wildcard cert for *.mail.protection.outlook.com, and each hosted
domain has:
example.com. IN MX 0 example-com.mail.protection.outlook.com
So while there is just one default certificate serving each of the
millions of hosted domains, the SNI would leak the exact name of
each domain.
--
Viktor.
nist.gov. IN MX 0 nist-gov.mail.protection.outlook.com.
nist-gov.mail.protection.outlook.com. IN A 23.103.198.10
nist-gov.mail.protection.outlook.com. IN A 23.103.198.42
nist-gov.mail.protection.outlook.com. IN AAAA 2a01:111:f400:7d01::10
nist-gov.mail.protection.outlook.com. IN AAAA 2a01:111:f400:7d02::10
nist-gov.mail.protection.outlook.com[23.103.198.10]
TLS = TLSv1.2 with ECDHE-RSA-AES256CBC-SHA384
name = mail.protection.outlook.com
name = *.mail.eo.outlook.com
name = *.mail.protection.outlook.com
name = mail.messaging.microsoft.com
name = outlook.com
depth = 0
Issuer CommonName = Microsoft IT SSL SHA2
Issuer Organization = Microsoft Corporation
notBefore = 2016-08-30T16:33:37Z
notAfter = 2018-04-30T16:33:37Z
Subject CommonName = mail.protection.outlook.com
Subject Organization = Microsoft Corporation
depth = 1
Issuer CommonName = Baltimore CyberTrust Root
Issuer Organization = Baltimore
notBefore = 2014-05-07T17:04:09Z
notAfter = 2018-05-07T17:03:30Z
Subject CommonName = Microsoft IT SSL SHA2
Subject Organization = Microsoft Corporation
_______________________________________________
Uta mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/uta
