Draft: draft-rescorla-tls-esni

Commentary: Replace " It only affects connection routing , server certificate selection , and client certificate verification . " with " It may affect connection routing , server certificate selection , and client certificate verification . " 
 It is relative to " This design has no impact on application layer protocol negotiation . " , so " only " is more explicit . 
 This was fixed in and I forgot to close .
Paragraph (version A):
A list of extensions that the client can take into consideration
when generating a Client Hello message.  The format is defined in
I-D.ietf-tls-tls13; Section 4.2.  The purpose of the field is to
provide room for additional features in the future; this document
does not define any extension.
Paragraph (version B):
A list of extensions that the client can take into consideration
when generating a Client Hello message.  The format is defined in
RFC8446; Section 4.2.  The purpose of the field is to provide room
for additional features in the future; this document does not
define any extension.
Paragraph (version B):
The KeyShareEntry carrying the client's public ephemeral key
shared used to derive the ESNI key.
Paragraph (version A):
The server is committing to support every group in the ESNIKeys
list (see below for server behavior).
Paragraph (version B):
In order to send an encrypted SNI, the client MUST first select one
of the server ESNIKeyShareEntry values and generate an (EC)DHE share
in the matching group.  This share will then be sent to the server in
the EncryptedSNI extension and used to derive the SNI encryption key.
It does not affect the (EC)DHE shared secret used in the TLS key
schedule.
Paragraph (version B):
where ESNIContents is as specified below and Hash is the hash
function associated with the HKDF instantiation.
Paragraph (version B):
Including ClientHello.KeyShareClientHello in the AAD of AEAD-Encrypt
binds the EncryptedSNI value to the ClientHello and prevents cut-and-
paste attacks.
Paragraph (version A):
If more than one KeyShareEntry has been provided, or if that
share's group does not match that for the SNI encryption key, it
MUST abort the connection with an "illegal_parameter" alert.
Paragraph (version B):
If the EncryptedSNI.key_share group does not match one in the
ESNIKeys.keys, it MUST abort the connection with an
"illegal_parameter" alert.
Paragraph (version A):
If DNS is misconfigured so that a client receives ESNI keys for a
server which is not prepared to receive ESNI, then the server will
ignore the "encrypted_server_name" extension, as required by I-
D.ietf-tls-tls13; Section 4.1.2.  If the servers does not require
SNI, it will complete the handshake with its default certificate.
Most likely, this will cause a certificate name mismatch and thus
handshake failure.  Clients SHOULD not fall back to cleartext SNI,
because that allows a network attacker to disclose the SNI.  They MAY
attempt to use another server from the DNS results, if one is
provided.
Paragraph (version B):
If DNS is misconfigured so that a client receives ESNI keys for a
server which is not prepared to receive ESNI, then the server will
ignore the "encrypted_server_name" extension, as required by RFC8446;
Section 4.1.2.  If the servers does not require SNI, it will complete
the handshake with its default certificate.  Most likely, this will
cause a certificate name mismatch and thus handshake failure.
Clients SHOULD NOT fall back to cleartext SNI, because that allows a
network attacker to disclose the SNI.  They MAY attempt to use
another server from the DNS results, if one is provided.
Paragraph (version A):
This design has no impact on application layer protocol negotiation.
It only affects connection routing, server certificate selection, and
client certificate verification.  Thus, it is compatible with
multiple protocols.
Paragraph (version B):
This design has no impact on application layer protocol negotiation.
It may affect connection routing, server certificate selection, and
client certificate verification.  Thus, it is compatible with
multiple protocols.
Paragraph (version A):
IANA is requested to Create an entry, encrypted_server_name(0xffce),
in the existing registry for ExtensionType (defined in I-D.ietf-tls-
tls13), with "TLS 1.3" column values being set to "CH", and
"Recommended" column being set to "Yes".
Paragraph (version B):
IANA is requested to Create an entry, encrypted_server_name(0xffce),
in the existing registry for ExtensionType (defined in RFC8446), with
"TLS 1.3" column values being set to "CH", and "Recommended" column
being set to "Yes".