Subject: Re: [Secdispatch] Requesting dispatch of Oblivious HTTP

From: "Martin Thomson" <[email-masked]>
Date: Mon, 22 Feb 2021 10:40:18 +1100

Hey everyone,

After a good amount of discussion (on other lists), Chris and I have updated the oblivious HTTP draft.

The revision includes more text on applicability, replay attack exposure, and privacy considerations.

I was foolish enough not to update the examples, so please forgive that.  A consequence of not building that into the CI setup.  The editors copy should be updated soon.  Incidentally, if you want to try this out, there is a client and server (no proxy, sorry) at <https://github.com/martinthomson/ohttp>.

Cheers,
Martin

On Thu, Jan 28, 2021, at 12:25, Martin Thomson wrote:
> Hi,
> 
> Those familiar with oblivious DNS in its various forms [1][2] probably 
> won't really need any introduction here.
> 
> This proposes a design that uses HPKE [3] and a proxy to provide a 
> general framework for privacy for sensitive HTTP requests.  DNS is one 
> fairly obvious application of this, but there are other applications 
> that might benefit from this.  A generic framework will enable those 
> applications.
> 
> The primary draft is:
> 
> https://www.ietf.org/archive/id/draft-thomson-http-oblivious-00.html
> 
> This draft describes the framework, plus how to encapsulate requests 
> and responses using HPKE and the format of the server key configuration 
> that clients need.
> 
> A supplementary draft describes a simple binary encoding for HTTP requests:
> 
> https://www.ietf.org/archive/id/draft-thomson-http-binary-message-00.html
> 
> The request here is to discuss what to do with this work.  Assuming 
> this isn't dispatched before the next meeting, that includes a request 
> for agenda time to continue or resolve that discussion.
> 
> In doing so, we might need to consider how this interacts with existing 
> work in other groups, HTTP, ADD, and DPRIVE in particular.  I'll be 
> sending notes to a few groups shortly advising them of this discussion 
> and inviting them to offer input.
> 
> Cheers,
> Martin
> 
> 
> [1] https://dl.acm.org/doi/abs/10.1145/3340301.3341128
> [2] https://tools.ietf.org/html/draft-pauly-dprive-oblivious-doh
> [3] https://tools.ietf.org/html/draft-irtf-cfrg-hpke-07#appendix-A.1