Draft: draft-ietf-ohai-ohttp

Commentary: Lots of little things here , but very good , all of them . 
 Many good things !
However, even when IP address tracking is mitigated using one of
these techniques, each request needs to be on a completely new TLS
connection to avoid the connection itself being used to correlate
behavior.  This imposes considerable performance and efficiency
overheads, due to the additional round trip to the server (at a
minumum), additional data exchanged, and additional CPU cost of
cryptographic computations.
However, even when IP address tracking is mitigated using one of
these techniques, each request needs to be on a completely new TLS
connection to avoid the connection itself being used to correlate
behavior.  This imposes considerable performance and efficiency
overheads, due to the additional round trip to the server (at a
minimum), additional data exchanged, and additional CPU cost of
cryptographic computations.
The details of an HPKE public key that the accepts, including an
identifier for that key and the HPKE algorithms that are used with
that key.
The details of an HPKE public key for the , including an
identifier for that key and the HPKE algorithms that are used with
that key.
Encoding an integer to a sequence of bytes in network byte order is
described using the function "encode(n, v)", where "n" is the number
of bytes and "v" is the integer value.  ASCII ASCII encoding of a
string "s" is indicated using the function "encode_str(s)".  The
function "len()" returns the length of a sequence of bytes.
Encoding an integer to a sequence of bytes in network byte order is
described using the function "encode(n, v)", where "n" is the number
of bytes and "v" is the integer value.  ASCII ASCII encoding of a
string "s" is indicated using the function "encode_str(s)".
Extract a pseudorandom key "prk" using the "Extract" function
provided by the KDF algorithm associated with "context".  The
"ikm" input to this function is "secret"; the "salt" input is the
concatenation of "enc" (from "enc_request") and "response_nonce".
Use the "Expand" function provided by the same KDF to extract an
AEAD key "key", of length "Nk" - the length of the keys used by
the AEAD associated with "context".  Generating "aead_key" uses a
label of "key".
Extract a pseudorandom key, "prk", using the "Extract" function
provided by the KDF algorithm associated with "context".  The
"ikm" input to this function is "secret"; the "salt" input is the
concatenation of "enc" (from "enc_request") and "response_nonce".
Use the "Expand" function provided by the same KDF to extract an
AEAD key, "key", of length "Nk" - the length of the keys used by
the AEAD associated with "context".  Generating "aead_key" uses a
label of "key".
Concatenate "response_nonce" and "ct", yielding an "enc_response".
Note that "response_nonce" is of fixed-length, so there is no
ambiguity in parsing either "response_nonce" or "ct".
Concatenate "response_nonce" and "ct", yielding an ,
"enc_response".  Note that "response_nonce" is of fixed-length, so
there is no ambiguity in parsing either "response_nonce" or "ct".
Secondly, generic implementations are often configured to augment
requests with information about the , such as the Via field or the
Forwarded field FORWARDED.  A relay MUST NOT add information when
forwarding requests that might be used to identify , with the
exception of information that a is aware of.
Secondly, generic implementations are often configured to augment
requests with information about the , such as the Via field or the
Forwarded field FORWARDED.  A relay MUST NOT add information when
forwarding requests that might be used to identify , with the
exception of information that a is aware of; see differential.
It is the responsibility of the application that uses Oblivious HTTP
to either reject replayed requests or to ensure that replayed
requests have no adverse affects on their operation.  This section
describes some approaches that are universally applicable and
suggestions for more targeted techniques.
It is the responsibility of the application that uses Oblivious HTTP
to either reject replayed requests or to ensure that replayed
requests have no adverse effects on their operation.  This section
describes some approaches that are universally applicable and
suggestions for more targeted techniques.
privacy depends on having each configuration used by many other .  It
is critical to prevent the use of unique configurations, which might
be used to track of individual , but it is also important to avoid
creating small groupings of that might weaken privacy protections.
privacy depends on having each configuration used by many other .  It
is critical to prevent the use of unique configurations, which might
be used to track individual , but it is also important to avoid
creating small groupings of that might weaken privacy protections.