Skip to content

Commit

Permalink
Improve ECH phraseology (@chris-wood)
Browse files Browse the repository at this point in the history
Co-authored-by: Christopher Wood <[email protected]>
  • Loading branch information
bemasc and chris-wood authored Mar 8, 2023
1 parent 22f9513 commit df905e8
Showing 1 changed file with 5 additions and 3 deletions.
8 changes: 5 additions & 3 deletions draft-sbn-dnsop-svcb-ech.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: Bootstrapping Encrypted ClientHello with DNS Service Bindings
title: Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings
abbrev: ECH in SVCB
docname: draft-sbn-dnsop-svcb-ech-latest
date: {DATE}
Expand Down Expand Up @@ -32,15 +32,15 @@ author:

--- abstract

To use Encrypted ClientHello the client needs to learn a public key for the server before it attempts a connection. This specification provides a suitable mechanism for conveying this public key and related information via DNS, using a SVCB or HTTPS record.
To use TLS Encrypted ClientHello (ECH) the client needs to learn the ECH configuration for a server before it attempts a connection to the server. This specification provides a mechanism for conveying the ECH configuration information via DNS, using a SVCB or HTTPS record.

--- middle

# Overview

The Service Bindings framework {{!SVCB=I-D.ietf-dnsop-svcb-https}} allows server operators to publish a detailed description of their service in the Domain Name System {{!RFC1034}} using SVCB or HTTPS records. Each SVCB record describes a single "alternative endpoint", and contains a collection of "SvcParams" that can be extended with new kinds of information that may be of interest to a client. Clients can use the SvcParams to improve the privacy, security, and performance of their connection to this endpoint.

This specification defines a new SvcParam to enable the use of Encrypted ClientHello {{!ECH=I-D.ietf-tls-esni}} in TLS-based protocols. This SvcParam can be used in SVCB, HTTPS or any future SVCB-compatible DNS records, and is intended to serve as the primary bootstrap mechanism for ECH.
This specification defines a new SvcParam to enable the use of TLS Encrypted ClientHello {{!ECH=I-D.ietf-tls-esni}} in TLS-based protocols. This SvcParam can be used in SVCB, HTTPS or any future SVCB-compatible DNS records, and is intended to serve as the primary bootstrap mechanism for ECH.

# SvcParam for ECH configuration {#ech-param}

Expand All @@ -54,6 +54,8 @@ When publishing a record containing an "ech" parameter, the publisher MUST ensur

# Client behavior {#ech-client-behavior}

This section describes client behavior in using ECH configurations provided in SVCB or HTTPS records.

## Disabling fallback

The SVCB-optional client behavior specified in ({{Section 3 of !SVCB}}) permits clients to fall back to a direct connection if all SVCB options fail. This behavior is not suitable for ECH, because fallback would negate the privacy benefits of ECH. Accordingly, ECH-capable SVCB-optional clients MUST switch to SVCB-reliant connection establishment if SVCB resolution succeeded (as defined in {{Section 3 of !SVCB}}) and all alternative endpoints have an "ech" SvcParam.
Expand Down

0 comments on commit df905e8

Please sign in to comment.