Issues and Requirements for Server Name Identification (SNI) Encryption in TLS

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 13
Abstract: This document describes the general problem of encrypting the Server Name Identification (SNI) TLS parameter. The proposed solutions hide a hidden service behind a fronting service, only disclosing the SNI of the fronting service to external observers. This document lists known attacks against SNI encryption, discusses the current "HTTP co-tenancy" solution, and presents requirements for future TLS-layer solutions. In practice, it may well be that no solution can meet every requirement and that practical solutions will have to make some compromises.
Publication Date: 2020-07-01
Status Note: Informational
DOI: 10.17487/RFC8744
Link: https://doi.org/10.17487/RFC8744
Author(s): Christian Huitema

Latest version of IETF RFC 8744

Document Versions — IETF RFC 8744

▶ IETF RFC 8744 (2020-07-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Bibliographic Reference(s)

10.1515-popets-2015-0009 — DOMFRONT EXTERNAL
IETF.draft-ietf-httpbis-http2-secondary-certs-06 — I-D.ietf-httpbis-http2-secondary-certs EXTERNAL
IETF.draft-ietf-quic-tls-29 — I-D.ietf-quic-tls EXTERNAL
IETF.draft-ietf-tls-dtls13-38 — I-D.ietf-tls-dtls13 EXTERNAL
IETF RFC 2246 [Superseded*]
IETF RFC 3207 [Active*]
IETF RFC 3546 [Superseded*]
IETF RFC 4346 [Superseded*]
IETF RFC 4366 [Superseded*]
IETF RFC 5246 [Superseded*]
IETF RFC 6066 [Active*]
IETF RFC 7258 [Active*]
IETF RFC 7540 [Superseded*]
IETF RFC 7590 [Active*]
IETF RFC 7858 [Active*]
IETF RFC 8314 [Active*]
IETF RFC 8336 [Active*]
IETF RFC 8404 [Active*]
IETF RFC 8446 [Superseded*]
IETF RFC 8484 [Active*]

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC8744.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 8744, Issues and Requirements for Server Name Identification (SNI) Encryption in TLS. Available at https://doi.org/10.17487/RFC8744

Snippet:

IETF RFC 8744, Issues and Requirements for Server Name Identification (SNI) Encryption in TLS. Available at https://doi.org/10.17487/RFC8744

HTML (ISO 690 compliant)

Preview:

IETF RFC 8744, Issues and Requirements for Server Name Identification (SNI) Encryption in TLS. Available at https://doi.org/10.17487/RFC8744

Snippet:

<span class="citation"><cite>IETF RFC 8744</cite>, Issues and Requirements for Server Name Identification (SNI) Encryption in TLS. Available at <a href="https://doi.org/10.17487/RFC8744" target="_blank" rel="noopener">https://doi.org/10.17487/RFC8744</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 8744, Issues and Requirements for Server Name Identification (SNI) Encryption in TLS
doi: 10.17487/RFC8744
url: https://doi.org/10.17487/RFC8744

Snippet:

<li>
<cite id="bib-rfc8744">IETF RFC 8744</cite>, Issues and Requirements for Server Name Identification (SNI) Encryption in TLS
<span class="doi">10.17487/RFC8744</span>
</li>

Referenced By

IETF RFC 9076 [Active*]
IETF RFC 9849 [Active*]