Subject: [Dots] Using SNI

From: "Jon Shallow" <[email-masked]>
Date: Sat, 30 Dec 2017 11:27:23 -0000

Hi WG,

When providing a DOTS server data channel service in my environment, this
shares the same ip / port which also provides other services (e.g. GUI /
REST server etc.).  Even if the Root Discovery points to another IP and or
port for the actual data channel activity, the TLS exchanges for the Root
Discovery have to correctly work.  I suspect that I am not the only DOTS
vendor who will have this type of requirement of a single IP providing
multiple TLS services.

As DOTS requires mutual authentication, this is a different security
requirement than required by the GUI environment (DOTS requires client cert
to be presented, GUI does not and providing certificates to every GUI client
is not a practical option).

This can be handled by using SNI by using 2 different FQDNs and requiring
the DOTS client to include the DOTS specific FQDN in the TLS Client Hello.
Whether the GUI client does or does not (likely does with modern browsers)
include a SNI FQDN when connecting to the non DOTS FQDN does not really
matter - for DOTS it is recognizing the DOTS specific FQDN and setting up
the TLS as appropriate.

To make sure interoperability between DOTS vendors, I would like to see
something like added to the data channel spec "DOTS clients MUST include the
DOTS server FQDN in the TLS Client Hello packet by using Server Name
Indication (SNI) RFC 3546".

In addition, I think that this would be a good idea as well for the signal
draft - thereby giving DOTS vendors the opportunity to host multiple DOTS
servers (likely to be different security requirements for their different
client) on a single IP / port.

Thoughts / comments?

Regards

Jon