Subject: Re: [TLS] Encryption of TLS 1.3 content type

From: Alfredo Pironti <[email-masked]>
Date: Fri, 8 Aug 2014 12:25:51 +0200

I guess the benefit of encrypting the content type and hiding the message
length are easier to appreciate when both features are deployed together.
Yet, such features can be designed somewhat independently.

I believe TLS holds an amenable place in the network stack where these
traffic analysis countermeasures can be implemented. But, I stress, the
application remains responsible for the privacy policy, and hence how these
TLS features are used.

For example, Tor abandoned doing authentication via TLS renegotiation*
because, among other reasons, "TLS renegotiation to become rarer and rarer
in the wild, making our own use stand out more" [2].
If TLS could be used to disguise, both in content type and in traffic
shape, a renegotiation as normal application data, projects like Tor may
benefit from it.

* see "v2 handshake" vs "v3 handshake" in [1]
[1]
https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=tor-spec.txt
[2]
https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/176-revising-handshake.txt

---

From: [email-masked] (Martin Rex)
Date: Fri, 8 Aug 2014 15:01:01 +0200 (CEST)

> shape, a renegotiation as normal application data, projects like Tor may

What you may have missed in the discussion: this is not about changing
the presence, availability and visibility of renegotiation in TLSv1.2,
TLSv1.1 and TLSv1.0, but exclusively about the visibility of the
ContentInfo in a future TLSv1.3 _which_has_Renegotiation_removed_.

-Martin

---

From: Alfredo Pironti <[email-masked]>
Date: Fri, 8 Aug 2014 15:10:11 +0200

> ContentInfo in a future TLSv1.3 _which_has_Renegotiation_removed_.

My understanding was that some form of re-keying or client-authentication
may be provided instead. In the latter case, similar reasoning would apply.

If the content type was encrypted, one could use different application data
content type values to multiplex several application streams over one TLS
connection.

Alfredo