Subject: [Secdispatch] Introducing MASQUE

From: David Schinazi <[email-masked]>
Date: Mon, 18 Mar 2019 12:26:28 -0700

Hi secdispatch,

I'd like to share a draft I've recently uploaded:
https://tools.ietf.org/html/draft-schinazi-masque-00

It introduces MASQUE, a protocol for obfuscating a VPN server inside an
HTTP/3 (or HTTP/2) web server. The proposal is pretty new so we'd love to
hear some opinions about how effectively it meets its security goals (or,
alternatively: how poorly it runs its own crypto).

We'll be presenting the draft in Prague - at secdispatch to review the
security aspects and in tsv-area to look into the transport impact.

Thanks,
David

---

From: Töma Gavrichenkov <[email-masked]>
Date: Mon, 18 Mar 2019 23:23:06 +0100

Interesting!

My instant suggestion is to dedicate some effort to allow the performance
issues of the VPN server to be observed by the HTTP frontend (after
decryption obviously). Otherwise you may have the same issue we have now
with Websockets: if a targeted app layer DDoS brings a WS server down, it's
almost non-traceable in the HTTP access log.

Aiming for that should be complicated but would allow for better DDoS
resilience, which would be valuable for those individuals hosting HTTP/2-3
servers you're targeting.

--
Töma

---

From: David Schinazi <[email-masked]>
Date: Tue, 19 Mar 2019 10:34:02 -0700

Thanks Töma. I agree with you - I'll add some text as implementor guidance.

David