the length of the CTR fields in bytes.  Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length. <del> Key or Key Length: 3 bits This field containts the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. </del>  If X flag is 0 then the KID is in the range of 0-7 and the frame counter (CTR) is found in the next LEN bytes: Adding a digital signature to each encrypted frame will be an overkill, instead we propose adding signature over multiple frames. <del> The signature is calculated by contatenating the authentication tags </del>  of the frames that the sender wants to authenticate (in reverse sent order) and signing it with the signature key.  Signature keys are exchanged out of band along the secret keys. The receiver has to keep track of all the frames received but yet not verified, by storing the authentication tags of each received frame. <del> When a signature is received, the reciever will verify it with the signature key associated to the key id of the frame the singature was sent in.  If the verification is sucessful, the received will mark </del>  the frames as authenticated and remove them from the list of the not verified frames.  It is up to the application to decide what to do when signature verification fails. graph and send multiple signatures in parallel (each for a branch of the dependency graph). <del> In case of simulcast or K-SVC, each spatial layer sould be </del>  authenticated with different signatures to prevent the SFU to discard frames with the signature info. following primitives: o A hash function This is used for the Key derivation and frame <del> hashes for signture.  We recommend using SHA256 hash function. </del>  o An AEAD encryption algorithm [RFC5116] While any AEAD algorithm can be used to encrypt the frame, we recommend using algorithms with safe 4. SFrame must be integrated with an E2EE key management framework to <del> exchange and rotate the encryption keys such as MLSPROTO which scales to very large groups.  Call members will create a MLS group to exchange the encryption keys for all further calls for that group. When a client joins the call, they create a random key material and encrypt it to every other client on the call using their MLS application secret.  This key material is passed to SFrame to derive SFrame keys for that client.  When group membership changes, the active clients in the call must update their keys for "Forward Secrecy" and "Post Compromise Security".  Key ratcheting can be used when a new member joins the group but for member leave events, a fresh key material will be generated by each client endpoint in the call and encrypt it using their MLS application secret. If authentication is enabled, every client will also generate public- private key pair for signing and exchange the public part with the secret key material. </del>  5. 5.1.2. When using simulcast, the same input image will produce N different <del> encoded frames (one per simulcat layer) which would be processed inpependently by the frame encryptor and assigned an unique counter </del>  for each. 5.1.3.

Rewrite the Key management section Add MLS subsection Update the SFrame format Fixed typos

the length of the CTR fields in bytes.  Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length.  <ins> Key or Key Length: 3 bits This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. </ins> If X flag is 0 then the KID is in the range of 0-7 and the frame counter (CTR) is found in the next LEN bytes: Adding a digital signature to each encrypted frame will be an overkill, instead we propose adding signature over multiple frames.  <ins> The signature is calculated by concatenating the authentication tags </ins> of the frames that the sender wants to authenticate (in reverse sent order) and signing it with the signature key.  Signature keys are exchanged out of band along the secret keys. The receiver has to keep track of all the frames received but yet not verified, by storing the authentication tags of each received frame.  <ins> When a signature is received, the receiver will verify it with the signature key associated to the key id of the frame the signature was sent in.  If the verification is successful, the received will mark </ins> the frames as authenticated and remove them from the list of the not verified frames.  It is up to the application to decide what to do when signature verification fails. graph and send multiple signatures in parallel (each for a branch of the dependency graph).  <ins> In case of simulcast or K-SVC, each spatial layer should be </ins> authenticated with different signatures to prevent the SFU to discard frames with the signature info. following primitives: o A hash function This is used for the Key derivation and frame  <ins> hashes for signature.  We recommend using SHA256 hash function. </ins> o An AEAD encryption algorithm [RFC5116] While any AEAD algorithm can be used to encrypt the frame, we recommend using algorithms with safe 4. SFrame must be integrated with an E2EE key management framework to  <ins> exchange and rotate the encryption keys.  This framework will maintain a group of participant endpoints who are in the call.  At call setup time, each endpoint will create a fresh key material and optionally signing key pair for that call and encrypt them to every other endpoints.  They encrypted keys are delivered by the messaging delivery server using a reliable channel. The key management framework will monitor the group changes, and exchange new keys when necessary.  It is up to the application to define this group, for example one application could have ephemeral group for every call and keep rotating key when end points joins or leave the call, while another app could have a persisted group that can be used for multiple calls and exchange keys with all group endpoints for every call. When a new key material is created during the call, we recommend not to start using it immediately in SFrame to give time for the new keys to be delivered.  If the application supports delivery receipts, it can be used to track if the key is delivered to all other endpoints on the call before using it. Keys must have a sequential id starting from 0 and incremented eery time a new key is generated for this endpoint.  The key id will be added in the SFrame header during encryption, so the recipient know which key to use for the decryption. 4.1. While any other E2EE key management framework can be used with SFrame, there is a big advantage if it is used with MLSARCH which supports group natively and can support very large groups an efficiently.  When MLSPROTO is used, the endpoints keys (AKA Application secret) can be used directly for SFrame without the need to exchange separate key material.  The application secret is rotated automatically by MLSPROTO when group membership changes. </ins> 5. 5.1.2. When using simulcast, the same input image will produce N different  <ins> encoded frames (one per simulcast layer) which would be processed independently by the frame encryptor and assigned an unique counter </ins> for each. 5.1.3.


7.2. The cipher suites defined in this draft use short authentication tags <del> for both inner and outer encryption, however it can easily support other ciphers with full authentication tag if the short ones are proved insecure. </del>  8.

I don't think we should not reference the inner/outer encryption, as we only define the e2ee encryption in the draft

7.2. The cipher suites defined in this draft use short authentication tags  <ins> for encryption, however it can easily support other ciphers with full authentication tag if the short ones are proved insecure. </ins> 8.


media metadata The IV is 128 bits long and calculated from the CTR field of the <del> Frame header: </del>  4.3.2.

Add more information for how the CTR is used to derive the final IV
The current IV equation is IVCounter XOR SaltKey. This will lead to IV reuse across multiple blocks in AES-CTR for example Frame 0 AES(0) XOR Block0, AES(1) XOR Block1, AES(2) XOR Block2,... Frame 1 AES (1) XOR Block0, AES(2) XOR Block1, AES(3) XOR Block2,.. Frame 2 AES(2) XOR Block0, AES(3) XOR Block1, AES(4) XOR Block2,... The equation should be changed to shift the frame counter to high significant 8 bytes and the other 8 bytes will be zeros then do the XOR FrameCounter8 = DecodeVarIntIntoInt64(counter) FrameCounter16 = FrameCounter << 8 IV = FrameCounter16 XOR SaltKey
lgtm

media metadata The IV is 128 bits long and calculated from the CTR field of the  <ins> Frame header.  First the var int CTR is decoded into 16 bytes long field, where CTR fills the the 8 most significant bytes and low 8 bytes are always filled with zeros: </ins> 4.3.2.


end-to-end encrypted. As such, two layers of encryptions and authentication are required: <del> 1- Hop-by-hop (HBH) encryption of media, metadata, and feedback messages between the the endpoints and SFU 2- End-to-end (E2E) encryption of media between the endpoints </del>  While DTLS-SRTP can be used as an efficient HBH mechanism, it is inherently point-to-point and therefore not suitable for a SFU 4.3.  4.3.1. <del> Each client creates a 32 bytes secret key K and share it with with other participants via an E2EE channel.  From K, we derive 3 secrets: </del>  <del> 1- Salt key used to calculate the IV </del>  <del> 2- Encryption key to encrypt the media frame </del>  <del> 3- Authentication key to authenticate the encrypted frame and the media metadata </del>  <del> The IV is 128 bits long and calculated from the CTR field of the Frame header.  First the var int CTR is decoded into 16 bytes long field, where CTR fills the the 8 most significant bytes and low 8 bytes are always filled with zeros: </del>  4.3.2. media metadata will be moved out of the encoded frame buffer, to be used later in the RTP generic frame header extension.  The encoded frame, the metadata buffer and the frame counter are passed to SFrame <del> encryptor.  The encryptor constructs SFrame header using frame counter and key id and derive the encryption IV.  The frame is encrypted using the encryption key and the header, encrypted frame, the media metadata and the header are authenticated using the authentication key.  The authentication tag is then truncated (If supported by the cipher suite) and prepended at the end of the ciphertext. </del>  The encrypted payload is then passed to a generic RTP packetized to <del> construct the RTP packets and encrypts it using SRTP keys for the HBH </del>  encryption to the media server. 4.3.3. The receiving clients buffer all packets that belongs to the same frame using the frame beginning and ending marks in the generic RTP frame header extension, and once all packets are available, it passes <del> it to Frame for decryption.  SFrame maintains multiple decryptor </del>  objects, one for each client in the call.  Initially the client might not have the mapping between the incoming streams the user's keys, in this case SFrame tries all unmapped keys until it finds one that 4.5. <del> 4.5.1. </del> Each SFrame session uses a single ciphersuite that specifies the following primitives: <del> o A hash function This is used for the Key derivation and frame hashes for signature.  We recommend using SHA256 hash function. </del>  <del> o An AEAD encryption algorithm [RFC5116] While any AEAD algorithm can be used to encrypt the frame, we recommend using algorithms with safe MAC truncation like AES-CTR and HMAC to reduce the per-frame overhead.  In this case we can use 80 bits MAC for video frames and 32 bits for audio frames similar to DTLS-SRTP cipher suites: </del>  <del> 1- AES_CM_128_HMAC_SHA256_80 </del>  <del> 2- AES_CM_128_HMAC_SHA256_32 </del>  <del> o [Optional] A signature algorithm If signature is supported, we recommend using ed25519 </del>  <del> 4.5.2. </del>  <del> SRTP is used as an HBH encryption, since the media payload is already encrypted, and SRTP only protects the RTP headers, one implementation could use 4 bytes outer auth tag to decrease the overhead, however it is up to the application to use other ciphers like AES-128-GCM with full authentication tag. </del>  5. 5.1. While any other E2EE KMS can be used with SFrame, there is a big <del> advantage if it is used with MLSARCH which natively supports very large groups efficiently.  When MLSPROTO is used, the endpoints keys (AKA Application secret) can be used directly for SFrame without the need to exchange separate key material.  The application secret is rotated automatically by MLSPROTO when group membership changes. </del>  6. 7.3. <del> PERC has significant overhead over SFrame because the overhead is per packet, not per frame, and OHB (Original Header Block) which duplicates any RTP header/extension field modified by the SFU. PERCLITE <https://mailarchive.ietf.org/arch/msg/perc/ </del>  SB0qMHWz6EsDtz3yIEX0HWp5IEY/> is slightly better because it doesn't use the OHB anymore, however it still does per packet encryption <del> using SRTP.  Below the the overheard in PERCLITE implemented by Cosmos Software which uses extra 11 bytes per packet to preserve the PT, SEQ_NUM, TIME_STAMP and SSRC fields in addition to the extra MAC tag per packet. </del>  OverheadPerPacket = 11 + MAC length Overhead bps = PacketPerSecond * OverHeadPerPacket * 8 Similar to SFrame, we will assume the HBH authentication tag length will always be 4 bytes for audio and video even though it is not the <del> case in this PERCLITE implementation </del>  7.3.1.

This PR revises the encryption procedures in a few ways: Ciphersuites for AES-GCM are now included The combination of AES-CM and SHA2 is spelled out, including an AAD length prefix to guard against confusion attacks We use the RFC 5116 AEAD interface (in particular, no separate auth tag) ... and as a result the tag truncation is internal to the AES-CM+SHA combination SFrame encryption now includes the encoded header as AAD Depends on

end-to-end encrypted. As such, two layers of encryptions and authentication are required:  <ins> Hop-by-hop (HBH) encryption of media, metadata, and feedback messages between the the endpoints and SFU End-to-end (E2E) encryption of media between the endpoints </ins> While DTLS-SRTP can be used as an efficient HBH mechanism, it is inherently point-to-point and therefore not suitable for a SFU 4.3. <ins> SFrame encryption uses an AEAD encryption algorithm and hash function defined by the ciphersuite in use (see ciphersuites).  We will refer to the following aspects of the AEAD algorithm below: "AEAD.Encrypt" and "AEAD.Decrypt" - The encryption and decryption functions for the AEAD.  We follow the convention of RFC 5116 RFC5116 and consider the authentication tag part of the ciphertext produced by "AEAD.Encrypt" (as opposed to a separate field as in SRTP RFC3711). "AEAD.Nk" - The size of a key for the encryption algorithm, in bytes "AEAD.Nn" - The size of a nonce for the encryption algorithm, in bytes </ins> 4.3.1.  <ins> Each client creates a secret key "base_key" and shares it with the other participants via an E2E secure channel.  From "base_key", we derive the following values using HKDF RFC5869: </ins>  <ins> A Salt key used to calculate the IV </ins>  <ins> An encryption key to encrypt the media frame </ins>  <ins> An authentication key to authenticate the encrypted frame and the media metadata </ins>  <ins> Each SFrame KID value identifies a "base_key", and thus both the "sframe_secret" and "sframe_salt" values to be used for encryption and decryption. </ins> 4.3.2. media metadata will be moved out of the encoded frame buffer, to be used later in the RTP generic frame header extension.  The encoded frame, the metadata buffer and the frame counter are passed to SFrame  <ins> encryptor. SFrame encryption uses the AEAD encryption algorithm for the ciphersuite in use.  The key for the encryption is the "sframe_key" and the nonce is formed by XORing the "sframe_salt" with the current counter, encoded as a big-endian integer of length "AEAD.Nn". The encryptor forms an SFrame header using the S, CTR, and KID values provided.  The encoded header is provided as AAD to the AEAD encryption operation, with any frame metadata appended. </ins> The encrypted payload is then passed to a generic RTP packetized to  <ins> construct the RTP packets and encrypt it using SRTP keys for the HBH </ins> encryption to the media server. 4.3.3. The receiving clients buffer all packets that belongs to the same frame using the frame beginning and ending marks in the generic RTP frame header extension, and once all packets are available, it passes  <ins> it to SFrame for decryption.  SFrame maintains multiple decryptor </ins> objects, one for each client in the call.  Initially the client might not have the mapping between the incoming streams the user's keys, in this case SFrame tries all unmapped keys until it finds one that 4.5.  Each SFrame session uses a single ciphersuite that specifies the following primitives:  <ins> o A hash function used for key derivation and hashing signature inputs o An AEAD encryption algorithm RFC5116 used for frame encryption, optionally with a truncated authentication tag </ins>  <ins> o [Optional] A signature algorithm </ins>  <ins> This document defines the following ciphersuites: </ins>  <ins> In the "AES_CM" suites, the length of the authentication tag is indicated by the last value: "_8" indicates an eight-byte tag and "_4" indicates a four-byte tag. In a session that uses multiple media streams, different ciphersuites might be configured for different media streams.  For example, in order to conserve bandwidth, a session might use a ciphersuite with 80-bit tags for video frames and another ciphersuite with 32-bit tags for audio frames. 4.5.1. </ins>  <ins> In order to allow very short tag sizes, we define a synthetic AEAD function using the authenticated counter mode of AES together with HMAC for authentication.  We use an encrypt-then-MAC approach as in SRTP RFC3711. </ins>  <ins> Before encryption or decryption, encryption and authentication subkeys are derived from the single AEAD key using HKDF.  The subkeys are derived as follows, where "Nk" represents the key size for the AES block cipher in use and "Nh" represents the output size of the hash function: </ins>  <ins> The AEAD encryption and decryption functions are then composed of individual calls to the CM encrypt function and HMAC.  The resulting MAC value is truncated to a number of bytes "tag_len" fixed by the ciphersuite. </ins> 5. 5.1. While any other E2EE KMS can be used with SFrame, there is a big  <ins> advantage if it is used with I-D.ietf-mls-architecture which natively supports very large groups efficiently.  When I-D.ietf-mls-protocol is used, the endpoints keys (AKA Application secret) can be used directly for SFrame without the need to exchange separate key material.  The application secret is rotated automatically by I- D.ietf-mls-protocol when group membership changes. </ins> 6. 7.3.  <ins> RFC8723 has significant overhead over SFrame because the overhead is per packet, not per frame, and OHB (Original Header Block) which duplicates any RTP header/extension field modified by the SFU.  I- D.murillo-perc-lite <https://mailarchive.ietf.org/arch/msg/perc/ </ins> SB0qMHWz6EsDtz3yIEX0HWp5IEY/> is slightly better because it doesn't use the OHB anymore, however it still does per packet encryption  <ins> using SRTP.  Below the the overheard in I-D.murillo-perc-lite implemented by Cosmos Software which uses extra 11 bytes per packet to preserve the PT, SEQ_NUM, TIME_STAMP and SSRC fields in addition to the extra MAC tag per packet. </ins> OverheadPerPacket = 11 + MAC length Overhead bps = PacketPerSecond * OverHeadPerPacket * 8 Similar to SFrame, we will assume the HBH authentication tag length will always be 4 bytes for audio and video even though it is not the  <ins> case in this I-D.murillo-perc-lite implementation </ins> 7.3.1.


4.3.1. <del> Each client creates a secret key "base_key" and shares it with the other participants via an E2E secure channel.  From "base_key", we derive the following values using HKDF RFC5869: </del>  <del> A Salt key used to calculate the IV An encryption key to encrypt the media frame </del>  <del> An authentication key to authenticate the encrypted frame and the media metadata </del>  <del> Each SFrame KID value identifies a "base_key", and thus both the "sframe_secret" and "sframe_salt" values to be used for encryption and decryption. </del>  <del> 4.3.2. </del>  After encoding the frame and before packetizing it, the necessary media metadata will be moved out of the encoded frame buffer, to be construct the RTP packets and encrypt it using SRTP keys for the HBH encryption to the media server. <del> 4.3.3. </del>  The receiving clients buffer all packets that belongs to the same frame using the frame beginning and ending marks in the generic RTP frame header extension, and once all packets are available, it passes <del> it to SFrame for decryption.  SFrame maintains multiple decryptor objects, one for each client in the call.  Initially the client might not have the mapping between the incoming streams the user's keys, in this case SFrame tries all unmapped keys until it finds one that passes the authentication verification and use it to decrypt the frame.  If the client has the mapping ready, it can push it down to SFrame later. The KeyId field in the SFrame header is used to find the right key for that user, which is incremented by the sender when they switch to a new key. For frames that are failed to decrypt because there is not key available yet, SFrame will buffer them and retries to decrypt them once a key is received. </del>  <del> 4.3.4. </del>  Unlike messaging application, in video calls, receiving a duplicate frame doesn't necessary mean the client is under a replay attack, allows only older frame pithing a short interval to support out of order delivery. <del> 4.3.5. Because the E2EE keys could be rotated during the call when people join and leave, these new keys are exchanged using the same E2EE secure channel used in the initial key negotiation.  Sending new fresh keys is an expensive operation, so the key management component might chose to send new keys only when other clients leave the call and use hash ratcheting for the join case, so no need to send a new key to the clients who are already on the call.  SFrame supports both modes 4.3.5.1. When SFrame decryptor fails to decrypt one of the frames, it automatically ratchets the key forward and retries again until one ratchet succeed or it reaches the maximum allowed ratcheting window. If a new ratchet passed the decryption, all previous ratchets are deleted. 4.3.5.2. SFrame will set the key immediately on the decrypts when it is received and destroys the old key material, so if the key manager sends a new key during the call, it is recommended not to start using it immediately and wait for a short time to make sure it is delivered to all other clients before using it to decrease the number of decryption failure.  It is up to the application and the key manager to define how long this period is. </del> 4.4. Every client in the call knows the secret key for all other clients 5. <del> SFrame must be integrated with an E2EE key management framework to exchange and rotate the encryption keys.  This framework will maintain a group of participant endpoints who are in the call.  At call setup time, each endpoint will create a fresh key material and optionally signing key pair for that call and encrypt the key material and the public signing key to every other endpoints.  They encrypted keys are delivered by the messaging delivery server using a reliable channel. The KMS will monitor the group changes, and exchange new keys when necessary.  It is up to the application to define this group, for example one application could have ephemeral group for every call and keep rotating key when end points joins or leave the call, while another application could have a persisted group that can be used for multiple calls and exchange keys with all group endpoints for every call. When a new key material is created during the call, we recommend not to start using it immediately in SFrame to give time for the new keys to be delivered.  If the application supports delivery receipts, it can be used to track if the key is delivered to all other endpoints on the call before using it. Keys must have a sequential id starting from 0 and incremented eery time a new key is generated for this endpoint.  The key id will be added in the SFrame header during encryption, so the recipient know which key to use for the decryption. </del>  5.1. <del> While any other E2EE KMS can be used with SFrame, there is a big advantage if it is used with I-D.ietf-mls-architecture which natively supports very large groups efficiently.  When I-D.ietf-mls-protocol is used, the endpoints keys (AKA Application secret) can be used directly for SFrame without the need to exchange separate key material.  The application secret is rotated automatically by I- D.ietf-mls-protocol when group membership changes. </del>  6.

This PR attempts to capture the spirit of the original key management provisions with a little more clarity about assumptions. It also adds a more more explicit construction for connecting SFrame to MLS.

4.3.1.  <ins> Each SFrame encryption or decryption operation is premised on a single secret "base_key", which is labeled with an integer KID value signaled in the SFrame header. The sender and receivers need to agree on which key should be used for a given KID.  The process for provisioning keys and their KID values is beyond the scope of this specification, but its security properties will bound the assurances that SFrame provides.  For example, if SFrame is used to provide E2E security against intermediary media nodes, then SFrame keys MUST be negotiated in a way that does not make them accessible to these intermediaries. For each known KID value, the client stores the corresponding symmetric key "base_key".  For keys that can be used for encryption, the client also stores the next counter value CTR to be used when encrypting (initially 0). When encrypting a frame, the application specifies which KID is to be used, and the counter is incremented after successful encryption. When decrypting, the "base_key" for decryption is selected from the available keys using the KID value in the SFrame Header. A given key MUST NOT be used for encryption by multiple senders. Such reuse would result in multiple encrypted frames being generated with the same (key, nonce) pair, which harms the protections provided by many AEAD algorithms.  Implementations SHOULD mark each key as usable for encryption or decryption, never both. Note that the set of available keys might change over the lifetime of a real-time session.  In such cases, the client will need to manage key usage to avoid media loss due to a key being used to encrypt before all receivers are able to use it to decrypt.  For example, an application may make decryption-only keys available immediately, but delay the use of encryption-only keys until (a) all receivers have acknowledged receipt of the new key or (b) a timeout expires. </ins>  <ins> 4.3.2. </ins>  <ins> SFrame encrytion and decryption use a key and salt derived from the "base_key" associated to a KID.  Given a "base_key" value, the key and salt are derived using HKDF RFC5869 as follows: </ins>  <ins> The hash function used for HKDF is determined by the ciphersuite in use. </ins>  <ins> 4.3.3. </ins> After encoding the frame and before packetizing it, the necessary media metadata will be moved out of the encoded frame buffer, to be construct the RTP packets and encrypt it using SRTP keys for the HBH encryption to the media server.  <ins> 4.3.4. </ins> The receiving clients buffer all packets that belongs to the same frame using the frame beginning and ending marks in the generic RTP frame header extension, and once all packets are available, it passes  <ins> it to SFrame for decryption.  The KID field in the SFrame header is used to find the right key for the encrypted frame. </ins>  <ins> For frames that are failed to decrypt because there is key available for the KID in the SFrame header, the client MAY buffer the frame and retry decryption once a key with that KID is received. 4.3.5. </ins> Unlike messaging application, in video calls, receiving a duplicate frame doesn't necessary mean the client is under a replay attack, allows only older frame pithing a short interval to support out of order delivery.  4.4. Every client in the call knows the secret key for all other clients 5.  <ins> SFrame must be integrated with an E2E key management framework to exchange and rotate the keys used for SFrame encryption and/or signing.  The key management framework provides the following functions: Provisioning KID/"base_key" mappings to participating clients (optional) Provisioning clients with a list of trusted signing keys Updating the above data as clients join or leave It is up to the application to define a rotation schedule for keys. For example, one application might have an ephemeral group for every call and keep rotating key when end points joins or leave the call, while another application could have a persistent group that can be used for multiple calls and simply derives ephemeral symmetric keys for a specific call. </ins> 5.1.  <ins> If the participants in a call have a pre-existing E2E-secure channel, they can use it to distribute SFrame keys.  Each client participating in a call generates a fresh encryption key and optionally a signing key pair.  The client then uses the E2E-secure channel to send their encryption key and signing public key to the other participants. In this scheme, it is assumed that receivers have a signal outside of SFrame for which client has sent a given frame, for example the RTP SSRC.  SFrame KID values are then used to distinguish generations of the sender's key.  At the beginning of a call, each sender encrypts with KID=0.  Thereafter, the sender can ratchet their key forward for forward secrecy: The sender signals such an update by incrementing their KID value.  A receiver who receives from a sender with a new KID computes the new key as above.  The old key may be kept for some time to allow for out-of-order delivery, but should be deleted promptly. If a new participant joins mid-call, they will need to receive from each sender (a) the current sender key for that sender, (b) the signing key for the sender, if used, and (c) the current KID value for the sender.  Evicting a participant requires each sender to send a fresh sender key to all receivers. 5.2. The Messaging Layer Security (MLS) protocol provides group authenticated key exchange I-D.ietf-mls-architecture I-D.ietf-mls- protocol.  In principle, it could be used to instantiate the sender key scheme above, but it can also be used more efficiently directly. MLS creates a linear sequence of keys, each of which is shared among the members of a group at a given point in time.  When a member joins or leaves the group, a new key is produced that is known only to the augmented or reduced group.  Each step in the lifetime of the group is know as an "epoch", and each member of the group is assigned an "index" that is constant for the time they are in the group. In SFrame, we derive per-sender "base_key" values from the group secret for an epoch, and use the KID field to signal the epoch and sender index.  First, we use the MLS exporter to compute a shared SFrame secret for the epoch. For compactness, do not send the whole epoch number.  Instead, we send only its low-order E bits.  Note that E effectively defines a re-ordering window, since no more than 2^E epoch can be active at a given time.  Receivers MUST be prepared for the epoch counter to roll over, removing an old epoch when a new epoch with the same E lower bits is introduced.  (Sender indices cannot be similarly compressed.) Once an SFrame stack has been provisioned with the "sframe_epoch_secret" for an epoch, it can compute the required KIDs and "sender_base_key" values on demand, as it needs to encrypt/ decrypt for a given member. MLS also provides an authenticated signing key pair for each participant.  When SFrame uses signatures, these are the keys used to generate SFrame signatures. </ins> 6.


This PR adds test vectors for SFrame encryption. A Go script is provided that implements the header encoding and the relevant encryption routines, generates test vectors for salient cases, and serializes them as Markdown or JSON. The Markdown version is included in the specification directly.

9. This document makes no requests of IANA. <ins> 10. This section provides a set of test vectors that implementations can use to verify that they correctly implement SFrame encryption and decryption.  For each ciphersuite, we provide: [in] The "base_key" value (hex encoded) [out] The "secret", "key", and "salt" values derived from the "base_key" (hex encoded) A plaintext value that is encrypted in the following encryption cases A sequence of encryption cases, including: [in] The "KID" and "CTR" values to be included in the header [out] The resulting encoded header (hex encoded) [out] The nonce computed from the "salt" and "CTR" values The ciphertext resulting from encrypting the plaintext with these parameters (hex encoded) An implementation should reproduce the output values given the input values.  Encryption with the input values and the plaintext should produce the ciphertext.  Decryption with the input values and the ciphertext should produce the plaintext. Line breaks and whitespace within values are inserted to conform to the width requirements of the RFC format.  They should be removed before use.  These test vectors are also available in JSON format at TestVectors. 10.1. 10.2. 10.3. 10.4. </ins>


key that needs to be used for decrypting. Both the frame counter and the key id are encoded in a variable <del> length format to decrease the overhead, so the first byte in the Sframe header is fixed and contains the header metadata with the following format: </del>  Reserved (R): 1 bit This field MUST be set to zero on sending, and MUST be ignored by receivers.  Counter Length (LEN): 3 bits This <del> field indicates the length of the CTR fields in bytes.  Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length.  Key or Key Length: 3 bits This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. </del>  If X flag is 0 then the KID is in the range of 0-7 and the frame counter (CTR) is found in the next LEN bytes: <del> Key id (KID): 3 bits The key id (0-7).  Frame counter (CTR): (Variable length) Frame counter value up to 8 bytes long. </del>  if X flag is 1 then KLEN is the length of the key (KID), that is found after the SFrame header metadata byte.  After the key id (KID), the frame counter (CTR) will be found in the next LEN bytes: <del> Key length (KLEN): 3 bits The key length in bytes.  Key id (KID): (Variable length) The key id value up to 8 bytes long.  Frame counter (CTR): (Variable length) Frame counter value up to 8 bytes long. </del>  4.3. these parameters (hex encoded) An implementation should reproduce the output values given the input <del> values.  Encryption with the input values and the plaintext should produce the ciphertext.  Decryption with the input values and the ciphertext should produce the plaintext. </del>  Line breaks and whitespace within values are inserted to conform to the width requirements of the RFC format.  They should be removed

PR fixes URL PR also updates AES-CTR test vectors accordingly. PR clarifies that decryption ought to work but comparing encrypted data may sometimes fail.
The spec says: Counter Length (LEN): 3 bits This field indicates the length of the CTR fields in bytes. This probably means 000 is 1 byte, 001 is 2 bytes, and so on... It would be good to clarify this.

key that needs to be used for decrypting. Both the frame counter and the key id are encoded in a variable  <ins> length format to decrease the overhead.  The length is up to 8 bytes and is represented in 3 bits in the SFrame header: 000 represents a length of 1, 001 a length of 2... The first byte in the SFrame header is fixed and contains the header metadata with the following format: </ins> Reserved (R): 1 bit This field MUST be set to zero on sending, and MUST be ignored by receivers.  Counter Length (LEN): 3 bits This  <ins> field indicates the length of the CTR fields in bytes (1-8). Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length.  Key or Key Length: 3 bits This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. </ins> If X flag is 0 then the KID is in the range of 0-7 and the frame counter (CTR) is found in the next LEN bytes:  <ins> Frame counter byte length (LEN): 3bits The frame counter length in bytes (1-8).  Key id (KID): 3 bits The key id (0-7).  Frame counter (CTR): (Variable length) Frame counter value up to 8 bytes long. </ins> if X flag is 1 then KLEN is the length of the key (KID), that is found after the SFrame header metadata byte.  After the key id (KID), the frame counter (CTR) will be found in the next LEN bytes:  <ins> Frame counter byte length (LEN): 3bits The frame counter length in bytes (1-8).  Key length (KLEN): 3 bits The key length in bytes (1-8).  Key id (KID): (Variable length) The key id value up to 8 bytes long.  Frame counter (CTR): (Variable length) Frame counter value up to 8 bytes long. </ins> 4.3. these parameters (hex encoded) An implementation should reproduce the output values given the input  <ins> values: * An implementation should be able to encrypt with the input values and the plaintext to produce the ciphertext.  * An implementation must be able to decrypt with the input values and the ciphertext to generate the plaintext. </ins> Line breaks and whitespace within values are inserted to conform to the width requirements of the RFC format.  They should be removed


4.1.  4.2. <del> Since each endpoint can send multiple media layers, each frame will have a unique frame counter that will be used to derive the encryption IV.  The frame counter must be unique and monotonically increasing to avoid IV reuse. </del>  <del> As each sender will use their own key for encryption, so the SFrame header will include the key id to allow the receiver to identify the key that needs to be used for decrypting. </del>  <del> Both the frame counter and the key id are encoded in a variable length format to decrease the overhead.  The length is up to 8 bytes and is represented in 3 bits in the SFrame header: 000 represents a length of 1, 001 a length of 2... The first byte in the SFrame header is fixed and contains the header metadata with the following format: </del>  Reserved (R): 1 bit This field MUST be set to zero on sending, and MUST be ignored by receivers.  Counter Length (LEN): 3 bits This <del> field indicates the length of the CTR fields in bytes (1-8). Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length.  Key or Key Length: 3 bits This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. If X flag is 0 then the KID is in the range of 0-7 and the frame counter (CTR) is found in the next LEN bytes: Frame counter byte length (LEN): 3bits The frame counter length in bytes (1-8).  Key id (KID): 3 bits The key id (0-7).  Frame counter (CTR): (Variable length) Frame counter value up to 8 bytes long. if X flag is 1 then KLEN is the length of the key (KID), that is found after the SFrame header metadata byte.  After the key id (KID), the frame counter (CTR) will be found in the next LEN bytes: Frame counter byte length (LEN): 3bits The frame counter length in bytes (1-8).  Key length (KLEN): 3 bits The key length in bytes (1-8).  Key id (KID): (Variable length) The key id value up to 8 bytes long.  Frame counter (CTR): (Variable length) Frame counter value up to 8 bytes long. </del>  4.3.

I suppose there's a valid question about how prescriptive we want to be about CTR. On the one hand, the hard requirement is that (KID, CTR) pairs be unique, not that CTR be a counter, so you could allow senders flexibility in populating CTR as long as they enforce uniqueness. On the other hand, if CTR is required to be a counter, you can rely on that for things like gap and replay detection or reordering (as with the RTP sequence number).
It might be worth an issue. It seems to me we should probably spell out explicitly a good default implementation (incrementing counter) given it is simple and efficient.

4.1. <ins> An SFrame ciphertext comprises an SFrame header followed by the output of an AEAD encryption of the plaintext RFC5116, with the header provided as additional authenticated data (AAD). The SFrame header is a variable-length structure described in detail in sframe-header.  The structure of the encrypted data and authentication tag are determined by the AEAD algorithm in use. When SFrame is applied per-packet, the payload of each packet will be an SFrame ciphertext.  When SFrame is applied per-frame, the SFrame ciphertext representing an encrypted frame will span several packets, with the header appearing in the first packet and the authentication tag in the last packet. </ins> 4.2.  <ins> The SFrame header specifies two values from which encryption parameters are derived: A Key ID (KID) that determines which encryption key should be used A counter (CTR) that is used to construct the IV for the encryption Applications MUST ensure that each (KID, CTR) combination is used for exactly one encryption operation.  Typically this is done by assigning each sender a KID or set of KIDs, then having each sender use the CTR field as a monotonic counter, incrementing for each plaintext that is encrypted.  Note that in addition to its simplicity, this scheme minimizes overhead by keeping CTR values as small as possible. </ins>  <ins> Both the counter and the key id are encoded as integers in network (big-endian) byte order, in a variable length format to decrease the overhead.  The length of each field is up to 8 bytes and is represented in 3 bits in the SFrame header: 000 represents a length of 1, 001 a length of 2, etc. </ins>  <ins> The first byte in the SFrame header has a fixed format and contains the header metadata: </ins> Reserved (R): 1 bit This field MUST be set to zero on sending, and MUST be ignored by receivers.  Counter Length (LEN): 3 bits This  <ins> field indicates the length of the CTR field in bytes, minus one (the range of possible values is thus 1-8).  Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length. Key or Key Length: 3 bits This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. If X flag is 0 then the KID is in the range of 0-7 and the counter (CTR) is found in the next LEN bytes: if X flag is 1 then KLEN is the length of the key (KID).  The KID is encoded in the KLEN bytes following the metadata byte, and the counter (CTR) is encoded in the next LEN bytes: </ins> 4.3.


Each SFrame session uses a single ciphersuite that specifies the following primitives: <del> o A hash function used for key derivation and hashing signature inputs </del>  o An AEAD encryption algorithm RFC5116 used for frame encryption, optionally with a truncated authentication tag <del> o [Optional] A signature algorithm </del> This document defines the following ciphersuites: In the "AES" suites, the length of the authentication tag is 5. SFrame must be integrated with an E2E key management framework to <del> exchange and rotate the keys used for SFrame encryption and/or signing.  The key management framework provides the following functions: </del>  Provisioning KID/"base_key" mappings to participating clients <del> (optional) Provisioning clients with a list of trusted signing keys </del> Updating the above data as clients join or leave It is up to the application to define a rotation schedule for keys. If the participants in a call have a pre-existing E2E-secure channel, they can use it to distribute SFrame keys.  Each client participating <del> in a call generates a fresh encryption key and optionally a signing key pair.  The client then uses the E2E-secure channel to send their encryption key and signing public key to the other participants. </del>  In this scheme, it is assumed that receivers have a signal outside of SFrame for which client has sent a given frame, for example the RTP out-of-order delivery, but should be deleted promptly. If a new participant joins mid-call, they will need to receive from <del> each sender (a) the current sender key for that sender, (b) the signing key for the sender, if used, and (c) the current KID value for the sender.  Evicting a participant requires each sender to send a fresh sender key to all receivers. </del>  5.2. and "sender_base_key" values on demand, as it needs to encrypt/ decrypt for a given member. <del> MLS also provides an authenticated signing key pair for each participant.  When SFrame uses signatures, these are the keys used to generate SFrame signatures. </del> 6. 6.1. receiver will be able to verify which is the sender of the media coming within the RTP stream at any given point if time, preventing the SFU trying to impersonate any of the participants with another <del> participant's media.  Note that in order to prevent impersonation by a malicious participant (not the SFU) usage of the signature is required.  In case of video, the a new signature should be started each time a key frame is sent to allow the receiver to identify the source faster after a switch. </del>  6.1.2.

The signature mechanism was removed from SFrame some time ago. This PR removes a few remaining references to it.
Seems good but needs rebasing
NAME NAME I think we are ok to merge this PR?

Each SFrame session uses a single ciphersuite that specifies the following primitives:  <ins> o A hash function used for key derivation </ins> o An AEAD encryption algorithm RFC5116 used for frame encryption, optionally with a truncated authentication tag  This document defines the following ciphersuites: In the "AES" suites, the length of the authentication tag is 5. SFrame must be integrated with an E2E key management framework to  <ins> exchange and rotate the keys used for SFrame encryption.  The key management framework provides the following functions: </ins> Provisioning KID/"base_key" mappings to participating clients  Updating the above data as clients join or leave It is up to the application to define a rotation schedule for keys. If the participants in a call have a pre-existing E2E-secure channel, they can use it to distribute SFrame keys.  Each client participating  <ins> in a call generates a fresh encryption key.  The client then uses the E2E-secure channel to send their encryption key to the other participants. </ins> In this scheme, it is assumed that receivers have a signal outside of SFrame for which client has sent a given frame, for example the RTP out-of-order delivery, but should be deleted promptly. If a new participant joins mid-call, they will need to receive from  <ins> each sender (a) the current sender key for that sender and (b) the current KID value for the sender.  Evicting a participant requires each sender to send a fresh sender key to all receivers. </ins> 5.2. and "sender_base_key" values on demand, as it needs to encrypt/ decrypt for a given member.  6. 6.1. receiver will be able to verify which is the sender of the media coming within the RTP stream at any given point if time, preventing the SFU trying to impersonate any of the participants with another  <ins> participant's media. Note that in order to prevent impersonation by a malicious participant (not the SFU), a mechanism based on digital signature would be required.  SFrame does not protect against such attacks. </ins> 6.1.2.


hash function: The AEAD encryption and decryption functions are then composed of <del> individual calls to the CM encrypt function and HMAC.  The resulting </del>  MAC value is truncated to a number of bytes "tag_len" fixed by the ciphersuite.

I wasn't sure if CM was meant for "Counter Mode", if so, I thought using the standard terminology would be better... : )
I also originally got very confused by the CM acronym so definitely suggest taking the change.
NAME would you be able to rebase your commit?
NAME Should be good now. (~Note that I did not update the label in to avoid affecting the test vectors.~ Pushed a commit with updated test vectors.)
This PR looks good to me. I agree with the terminology change and the changes to the known-answer test generator. I re-ran the known-answer test generator locally and confirmed that it produced the test vectors in the PR.LGTM. This might conflict with URL depending on which PR gets merged first.

hash function: The AEAD encryption and decryption functions are then composed of  <ins> individual calls to the CTR encrypt function and HMAC.  The resulting </ins> MAC value is truncated to a number of bytes "tag_len" fixed by the ciphersuite.


The first byte in the SFrame header has a fixed format and contains the header metadata: <del> Reserved (R): 1 bit This field MUST be set to zero on sending, and MUST be ignored by receivers.  Counter Length (LEN): 3 bits This field indicates the length of the CTR field in bytes, minus one (the range of possible values is thus 1-8).  Extended Key Id Flag (X): 1 bit Indicates if the key field contains the key id or the key length. Key or Key Length: 3 bits This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. If X flag is 0 then the KID is in the range of 0-7 and the counter </del>  (CTR) is found in the next LEN bytes: <del> if X flag is 1 then KLEN is the length of the key (KID).  The KID is </del>  encoded in the KLEN bytes following the metadata byte, and the counter (CTR) is encoded in the next LEN bytes: Each SFrame session uses a single ciphersuite that specifies the following primitives: <del> o A hash function used for key derivation </del>  <del> o An AEAD encryption algorithm RFC5116 used for frame encryption, optionally with a truncated authentication tag </del>  This document defines the following ciphersuites: 6.1. <del> Selective Forwarding Units (SFUs) as described in https://tools.ietf.org/html/rfc7667#section-3.7 receives the RTP streams from each participant and selects which ones should be forwarded to each of the other participants.  There are several approaches about how to do this stream selection but in general, in order to do so, the SFU needs to access metadata associated to each frame and modify the RTP information of the incoming packets when they are transmitted to the received participants. </del>  This section describes how this normal SFU modes of operation interacts with the E2EE provided by SFrame O/A required to establish a new RTP stream, the SFU may decide to reuse previously existing RTP sessions or even pre-allocate a predefined number of RTP streams and choose in each moment in time <del> which participant media will be sending through it.  This means that in the same RTP stream (defined by either SSRC or MID) may carry media from different streams of different participants.  As different keys are used by each participant for encoding their media, the receiver will be able to verify which is the sender of the media coming within the RTP stream at any given point if time, preventing the SFU trying to impersonate any of the participants with another participant's media. </del>  Note that in order to prevent impersonation by a malicious participant (not the SFU), a mechanism based on digital signature The encryption overhead will vary between audio and video streams, because in audio each packet is considered a separate frame, so it will always have extra MAC and IV, however a video frame usually <del> consists of multiple RTP packets.  The number of bytes overhead per frame is calculated as the following 1 + FrameCounter length + 4 The constant 1 is the SFrame header byte and 4 bytes for the HBH </del>  authentication tag for both audio and video packets. 7.1. <del> Using three different audio frame durations 20ms (50 packets/s) 40ms (25 packets/s) 100ms (10 packets/s) Up to 3 bytes frame counter (3.8 days of data for 20ms frame duration) and 4 bytes fixed MAC length. </del>  7.2. The per-stream overhead bits per second as calculated for the <del> following video encodings: 30fps@1000Kbps (4 packets per frame) 30fps@512Kbps (2 packets per frame) 15fps@200Kbps (2 packets per frame) 7.5fps@30Kbps (1 packet per frame) Overhead bps = (Counter length + 1 + 4 ) * 8 * fps </del>  7.3. RFC8723 has significant overhead over SFrame because the overhead is per packet, not per frame, and OHB (Original Header Block) which <del> duplicates any RTP header/extension field modified by the SFU.  I- D.murillo-perc-lite <https://mailarchive.ietf.org/arch/msg/perc/ </del>  SB0qMHWz6EsDtz3yIEX0HWp5IEY/> is slightly better because it doesn't use the OHB anymore, however it still does per packet encryption <del> using SRTP.  Below the the overheard in I-D.murillo-perc-lite implemented by Cosmos Software which uses extra 11 bytes per packet to preserve the PT, SEQ_NUM, TIME_STAMP and SSRC fields in addition to the extra MAC tag per packet. </del>  <del> OverheadPerPacket = 11 + MAC length Overhead bps = PacketPerSecond * OverHeadPerPacket * 8 </del>  Similar to SFrame, we will assume the HBH authentication tag length will always be 4 bytes for audio and video even though it is not the these parameters (hex encoded) An implementation should reproduce the output values given the input <del> values: * An implementation should be able to encrypt with the input values and the plaintext to produce the ciphertext.  * An implementation must be able to decrypt with the input values and the ciphertext to generate the plaintext. </del>  Line breaks and whitespace within values are inserted to conform to the width requirements of the RFC format.  They should be removed

This PR addresses a few outstanding formatting cleanup issues: Fixes the list formatting problems identified in ... as well as a few others Wraps paragraphs to 80 columns
Merging on my own since these are just formatting changes.
This : ... is probably not a single paragraph. Similar problems and . It might be worth a more thorough proof-read of the document for others similar formatting problems.

The first byte in the SFrame header has a fixed format and contains the header metadata:  <ins> This field MUST be set to zero on sending, and MUST be ignored by receivers. This field indicates the length of the CTR field in bytes, minus one (the range of possible values is thus 1-8). Indicates if the key field contains the key id or the key length. This field contains the key id (KID) if the X flag is set to 0, or the key length (KLEN) if set to 1. If X flag is 0, then the KID is in the range of 0-7 and the counter </ins> (CTR) is found in the next LEN bytes:  <ins> If X flag is 1 then KLEN is the length of the key (KID).  The KID is </ins> encoded in the KLEN bytes following the metadata byte, and the counter (CTR) is encoded in the next LEN bytes: Each SFrame session uses a single ciphersuite that specifies the following primitives:  <ins> A hash function used for key derivation </ins>  <ins> An AEAD encryption algorithm RFC5116 used for frame encryption, optionally with a truncated authentication tag </ins> This document defines the following ciphersuites: 6.1.  <ins> Selective Forwarding Units (SFUs) as described in Section 3.7 of RFC7667 receives the RTP streams from each participant and selects which ones should be forwarded to each of the other participants. There are several approaches about how to do this stream selection but in general, in order to do so, the SFU needs to access metadata associated to each frame and modify the RTP information of the incoming packets when they are transmitted to the received participants. </ins> This section describes how this normal SFU modes of operation interacts with the E2EE provided by SFrame O/A required to establish a new RTP stream, the SFU may decide to reuse previously existing RTP sessions or even pre-allocate a predefined number of RTP streams and choose in each moment in time  <ins> which participant media will be sending through it. This means that in the same RTP stream (defined by either SSRC or MID) may carry media from different streams of different participants.  As different keys are used by each participant for encoding their media, the receiver will be able to verify which is the sender of the media coming within the RTP stream at any given point if time, preventing the SFU trying to impersonate any of the participants with another participant's media. </ins> Note that in order to prevent impersonation by a malicious participant (not the SFU), a mechanism based on digital signature The encryption overhead will vary between audio and video streams, because in audio each packet is considered a separate frame, so it will always have extra MAC and IV, however a video frame usually  <ins> consists of multiple RTP packets. The number of bytes overhead per frame is calculated as the following The constant 1 is the SFrame header byte and 4 bytes for the HBH </ins> authentication tag for both audio and video packets. 7.1.  <ins> Using three different audio frame durations 20ms (50 packets/s) 40ms (25 packets/s) 100ms (10 packets/s) Up to 3 bytes frame counter (3.8 days of data for 20ms frame duration) and 4 bytes fixed MAC length. </ins> 7.2. The per-stream overhead bits per second as calculated for the  <ins> following video encodings: 30fps @ 1000Kbps (4 packets per frame) 30fps @ 512Kbps (2 packets per frame) 15fps @ 200Kbps (2 packets per frame) 7.5fps @ 30Kbps (1 packet per frame) Overhead "bps = (Counter length + 1 + 4 ) * 8 * fps" </ins> 7.3. RFC8723 has significant overhead over SFrame because the overhead is per packet, not per frame, and OHB (Original Header Block) which  <ins> duplicates any RTP header/extension field modified by the SFU. I-D.murillo-perc-lite <https://mailarchive.ietf.org/arch/msg/perc/ </ins> SB0qMHWz6EsDtz3yIEX0HWp5IEY/> is slightly better because it doesn't use the OHB anymore, however it still does per packet encryption  <ins> using SRTP. Below the the overheard in I-D.murillo-perc-lite implemented by Cosmos Software which uses extra 11 bytes per packet to preserve the "PT", "SEQ_NUM", "TIME_STAMP" and "SSRC" fields in addition to the extra MAC tag per packet. </ins>  <ins> "OverheadPerPacket = 11 + MAC length Overhead bps = PacketPerSecond * OverHeadPerPacket * 8 " </ins> Similar to SFrame, we will assume the HBH authentication tag length will always be 4 bytes for audio and video even though it is not the these parameters (hex encoded) An implementation should reproduce the output values given the input  <ins> values: An implementation should be able to encrypt with the input values and the plaintext to produce the ciphertext. An implementation must be able to decrypt with the input values and the ciphertext to generate the plaintext. </ins> Line breaks and whitespace within values are inserted to conform to the width requirements of the RFC format.  They should be removed


S/MIME receiving agents during certificate and CRL signature verification: <del> For 512-bit RSA with SHA-1 see RFC3279 and FIPS186-2 without Change Notice 1, for 512-bit RSA with SHA-256 see RFC4055 and FIPS186-2 without Change Notice 1, for 1024-bit through 3072-bit RSA with SHA-256 see RFC4055 and FIPS186-2 with Change Notice 1, and for 4096-bit RSA with SHA-256 see RFC4055 and RFC3447.  In either case, the first reference provides the signature algorithm's object identifier and the second provides the signature algorithm's definition. For 512-bit DSA with SHA-1 see RFC3279 and FIPS186-2 without Change Notice 1, for 512-bit DSA with SHA-256 see RFC5758 and FIPS186-2 without Change Notice 1, for 1024-bit DSA with SHA-1 see RFC3279 and FIPS186-2 with Change Notice 1, for 1024-bit through 3072 DSA with SHA-256 see RFC5758 and FIPS186-3.  In either case, the first reference provides the signature algorithm's object identifier and the second provides the signature algorithm's definition. </del>  For RSASSA-PSS with SHA-256 see RFC4056.  4.4. PKIX describes an extensible framework in which the basic certificate

Move the pointer to docs for historical algorithms to the historic appendix. Correct the fact that this is now a WG document.

S/MIME receiving agents during certificate and CRL signature verification:  <ins> For 1024-bit through 3072-bit RSA with SHA-256 see RFC4055 and FIPS186-2 with Change Notice 1, and for 4096-bit RSA with SHA-256 see RFC4055 and RFC3447.  In either case, the first reference provides the signature algorithm's object identifier and the second provides the signature algorithm's definition. </ins> For RSASSA-PSS with SHA-256 see RFC4056. <ins> For ECDSA see RFC5758 and RFC6090.  The first reference provides the signature algorithm's object identifier and the second provides the signature algorithm's definition. For EdDSA see I-D.ietf-curdle-pkix and I-D.irtf-cfrg-eddsa.  The first reference provides the signature algorithm's object identifier and the second provides the signature algorithm's definition. </ins> 4.4. PKIX describes an extensible framework in which the basic certificate


There are other classes of solutions in which the master secret is verified by verifying a certificate provided by the protected service.  These solutions offer more protection against a Man-In-The- <del> Middle attack by the fronting service. </del>  The fronting service could be pressured by adversaries.  By design, it could be forced to deny access to the protected service, or to [1]. Thanks to Daniel Kahn Gillmor for a pretty detailed review of the <del> initial draft.  Thanks to Stephen Farrell, Mark Orchezowski, Martin Rex and Martin Thomson for their reviews. </del>  8.  References

Two sets of comments from Mark O, received after WGLC. One is a reference to the acknowledgement section, in which he would rather not see his name spelled out. The other is about residual risks of fronting server spoofing when only the hidden service is verified in TLS.

There are other classes of solutions in which the master secret is verified by verifying a certificate provided by the protected service.  These solutions offer more protection against a Man-In-The-  <ins> Middle attack by the fronting service.  The downside is the the client will not verify the identity of the fronting service with risks discussed in {#frontingspoofing}, but solutions will have to mitigate this risks.  Overall, end-to-end TLS to the protected service is preferable. </ins> The fronting service could be pressured by adversaries.  By design, it could be forced to deny access to the protected service, or to [1]. Thanks to Daniel Kahn Gillmor for a pretty detailed review of the  <ins> initial draft.  Thanks to Stephen Farrell, Martin Rex Martin Thomson and employees of the UK National Cyber Security Centre for their reviews. </ins> 8.  References


There are other classes of solutions in which the master secret is verified by verifying a certificate provided by the protected service.  These solutions offer more protection against a Man-In-The- <del> Middle attack by the fronting service.  The downside is the the client will not verify the identity of the fronting service with risks discussed in {#frontingspoofing}, but solutions will have to mitigate this risks.  Overall, end-to-end TLS to the protected service is preferable. </del>  The fronting service could be pressured by adversaries.  By design, it could be forced to deny access to the protected service, or to

The delayed merge of PR left a dangling reference in the markdown source. This is an attempt to fix the issue.

There are other classes of solutions in which the master secret is verified by verifying a certificate provided by the protected service.  These solutions offer more protection against a Man-In-The-  <ins> Middle attack by the fronting service.  The downside is that the client will not verify the identity of the fronting service, which enables fronting server spoofing attacks such as the "honeypot" attack discussed below.  Overall, end-to-end TLS to the protected service is preferable, but it is important to also provide a way to authenticate the fronting service. </ins> The fronting service could be pressured by adversaries.  By design, it could be forced to deny access to the protected service, or to


of monitoring get blocked, monitoring focuses on the clear text SNI. The purpose of SNI encryption and privacy is to prevent that. <del> In the past, there have been multiple attempts at defining SNI encryption.  These attempts have generally floundered, because the simple designs fail to mitigate several of the attacks listed in snisecreq.  In the absence of a TLS-level solution, the most popular approach to SNI privacy for web services is HTTP-level fronting, which we discuss in httpfronting. </del>  2. 5. <del> Replacing clear text SNI transmission by an encrypted variant will improve the privacy and reliability of TLS connections, but the design of proper SNI encryption solutions is difficult.  This document does not present the design of a solution, but provides guidelines for evaluating proposed solutions. </del> This document lists a number of attacks against SNI encryption in snisecreq, and also in delegationtokens, and presents a list of requirements to mitigate these attacks.  Current HTTP-based solutions [1]. Thanks to Daniel Kahn Gillmor for a pretty detailed review of the <del> initial draft.  Thanks to Mike Bishop, Stephen Farrell, Barry Leiba, Martin Rex, Meral Shirazipour, Martin Thomson and employees of the UK National Cyber Security Centre for their reviews. </del>  8.  References

These proposed edits address the feedback from Bernard Aboba (Issue ).
NAME Can you check the proposed fixes? Thanks.
Thanks, NAME
Document: draft-ietf-tls-sni-encryption Reviewer: Bernard Aboba Review result: Ready with Nits This document has been reviewed as part of the transport area review team's ongoing effort to review key IETF documents. These comments were written primarily for the transport area directors, but are copied to the document's authors and WG to allow them to address any issues raised and also to the IETF discussion list for information. When done at the time of IETF Last Call, the authors should consider this review as part of the last-call comments they receive. Please always CC EMAIL if you reply to or forward this review. I have not identified any transport related issues. NITS Expansion of acronyms on first use: Abstract: TLS Section 1: DNS Section 2.1: ISP, QoS, MITM Section 2 s/mutiple/multiple/ Section 2.1 s/fradulent/fraudulent/ Section 3.6 The downside is the the client will not verify the identity of the fronting service with risks discussed in , but solutions will have to mitigate this risks. [BA] Several problems with this sentence: s/the the/the/ s/this risks/the risk/ s/discussed in ,/discussed in [REF-TBD],/ Section 3.7.1 This section seems somewhat out of place in a section on Security and Privacy Requirements for SNI Encryption, given that it relates to hiding of the ALPN, and the text admits a weak case for linking the two problems: Using the same technique for hiding the ALPN and encrypting the SNI may result in excess complexity. It might be preferable to encrypt these independently. You might consider moving this section to Section 4.3.1, under Section 4.3 Related Work. Section 5 The first paragraph of this section strikes me as being potentially better suited to inclusion in Section 1 Introduction. Replacing clear text SNI transmission by an encrypted variant will improve the privacy and reliability of TLS connections, but the design of proper SNI encryption solutions is difficult. This document does not present the design of a solution, but provides guidelines for evaluating proposed solutions.
Thanks for the feedback, Bernard. We already fixed in the editor copy some of the issues that you described based on other feedback received during last call, but not all. Your comments about section 3.7.1 and section 5 are interesting. I like your suggestion of moving some of the text from section 5 to the introduction and believe that it will improve the document. Regarding section 3.7.1, you suggest adding a comment on related work, and perhaps moving some of the discussion of ALPN there. I understand the rationale, but I am a bit worried about going too far there -- the current text reflects discussions and feedback on the TLS list. Also, if we did add a section on related work we would probably need to reference the deployment of encrypted DNS services, and I am a bit worried about doing that late in the production cycle. How about a compromise, such as pointing the issue in the introduction with a forward reference to section 3.7.1? -- Christian Huitema
Regarding abbreviations: TLS, DNS, ISP, and QoS are considered "well known" acronyms according to URL, and do not need to be spelled out. Changes for spelling our MITM are proposed in PR .
Fixed in Pr

of monitoring get blocked, monitoring focuses on the clear text SNI. The purpose of SNI encryption and privacy is to prevent that.  <ins> Replacing clear text SNI transmission by an encrypted variant will improve the privacy and reliability of TLS connections, but the design of proper SNI encryption solutions is difficult.  In the past, there have been multiple attempts at defining SNI encryption.  These attempts have generally floundered, because the simple designs fail to mitigate several of the attacks listed in snisecreq.  In the absence of a TLS-level solution, the most popular approach to SNI privacy for web services is HTTP-level fronting, which we discuss in httpfronting. This document does not present the design of a solution, but provides guidelines for evaluating proposed solutions.  The need for related work on the encryption of the Application Layer Protocol Negotiation (ALPN) parameters of TLS is discussed in hiding-alpn. </ins> 2. 5.  This document lists a number of attacks against SNI encryption in snisecreq, and also in delegationtokens, and presents a list of requirements to mitigate these attacks.  Current HTTP-based solutions [1]. Thanks to Daniel Kahn Gillmor for a pretty detailed review of the  <ins> initial draft.  Thanks to Bernard Aboba, Mike Bishop, Stephen Farrell, Barry Leiba, Martin Rex, Meral Shirazipour, Martin Thomson and employees of the UK National Cyber Security Centre for their reviews. </ins> 8.  References


2.1. <del> The SNI was defined to facilitate management of servers, though the developers of middleboxes soon found out that they could take advantage of the information.  Many examples of such usage are reviewed in RFC8404.  They include: </del>  The SNI is probably also included in the general collection of <del> metadata by pervasive surveillance actors. </del>  2.2. described as legitimate.  Most of these functions can, however, be realized by other means.  For example, some DNS service providers offer customers the provision to "opt in" filtering services for <del> parental control and phishing protection.  Per-stream QoS can be </del>  provided by a combination of packet marking and end-to-end agreements.  As SNI encryption becomes common, we can expect more deployment of such "end-to-end" solutions.

Comments and discussion are found in issue . The proposed changes are minimal.
Once this is processed one way or another, I would like to publish a revised draft.
Thanks for clearly writing down attacks and requirements in this document. One small technical comment on this sentence: Sec 2.3: "Per-stream QoS can be provided by a combination of packet marking and end-to-end agreements." If this sentence is meant to mean use of DSCP, I don't think this is true, as DSCP is usually not available end-to-end but most often gets changed or bleached somewhere on the path. And two editorial comments: Sec 2.1: "The SNI was defined to facilitate management of servers, though the developers of middleboxes soon found out that they could take advantage of the information." "soon found out" does sound a bit story-telling like to me. I recommend a more objective phrasing like: "The SNI was defined to facilitate management of servers, though other usages by middleboxes also take advantage of the information." or something similar... Also sec 2.1: "The SNI is probably also included in the general collection of metadata by pervasive surveillance actors." This sentence is phrased a bit speculatively and at the same kind seems inherently true as a "pervasive surveillance actor" usually just collect all available data/traffic... I guess the more interesting question would be if and how this information is used. Anyway I recommend some rephrasing like: "The SNI could also be utilised by the general collection of metadata by pervasive surveillance actors."
Hi Christian, Please see below. From my point of view „some time after“ wouldn’t make it much better because I think the important part of the information of this sentence is that middleboxes use that information (for good or bad) and not who had the idea when. But again just a comment... Yes, removing end-to-end does help but it also sounds a bit as if that is a solution ready to use which I don’t think is the case. Maybe also say “could” instead “can” (to propose another minimal change)? Mirja >
Addressed in PR

2.1.  <ins> The SNI was defined to facilitate management of servers, but the developers of middleboxes found out that they could take advantage of the information.  Many examples of such usage are reviewed in RFC8404.  They include: </ins> The SNI is probably also included in the general collection of  <ins> metadata by pervasive surveillance actors, for example to identify services used by surveillance targets. </ins> 2.2. described as legitimate.  Most of these functions can, however, be realized by other means.  For example, some DNS service providers offer customers the provision to "opt in" filtering services for  <ins> parental control and phishing protection.  Per-stream QoS could be </ins> provided by a combination of packet marking and end-to-end agreements.  As SNI encryption becomes common, we can expect more deployment of such "end-to-end" solutions.


Progressive deployment of solutions like DNS in TLS RFC7858 and DNS over HTTPS RFC8484 mitigates the disclosure of DNS information.  More and more services are colocated on multiplexed servers, loosening the <del> relation between IP address and web service.  However, multiplexed servers rely on the Service Name Information (SNI) TLS extension to direct connections to the appropriate service implementation.  This protocol element is transmitted in clear text.  As the other methods of monitoring get blocked, monitoring focuses on the clear text SNI. The purpose of SNI encryption and privacy is to prevent that. </del>  Replacing clear text SNI transmission by an encrypted variant will improve the privacy and reliability of TLS connections, but the The SNI was defined to facilitate management of servers, but the developers of middleboxes found out that they could take advantage of the information.  Many examples of such usage are reviewed in <del> RFC8404.  They include: </del>  The SNI is probably also included in the general collection of metadata by pervasive surveillance actors, for example to identify The clear-text transmission of the SNI was not flagged as a problem in the security consideration sections of RFC3546, RFC4366, or RFC6066.  These specifications did not anticipate the alternative <del> uses and abuses described in snileak.  One reason may be that, when these RFCs were written, the SNI information was available through a variety of other means. </del>  Many deployments still allocate different IP addresses to different services, so that different services can be identified by their IP <del> addresses.  However, content distribution networks (CDN) commonly serve a large number of services through a comparatively small number of addresses. </del>  The SNI carries the domain name of the server, which is also sent as part of the DNS queries.  Most of the SNI usage described in snileak The decoupling of IP addresses and server names, deployment of DNS privacy, and protection of server certificate transmissions all contribute to user privacy in the face of an RFC3552-style adversary. <del> Encrypting the SNI now will complete this push for privacy and make it harder to censor or otherwise provide differential treatment to specific internet services. </del>  2.3. <del> Deploying SNI encryption will help thwart most of the "unanticipated" SNI usages described in snileak, including censorship and pervasive surveillance.  It will also thwart functions that are sometimes described as legitimate.  Most of these functions can, however, be realized by other means.  For example, some DNS service providers offer customers the provision to "opt in" filtering services for parental control and phishing protection.  Per-stream QoS could be provided by a combination of packet marking and end-to-end agreements.  As SNI encryption becomes common, we can expect more deployment of such "end-to-end" solutions. At the moment, enterprises have the option of installing a firewall performing SNI filtering to prevent connections to certain websites. With SNI encryption this becomes ineffective.  Obviously, managers could block usage of SNI encryption in enterprise computers, but this wide-scale blocking would diminish the privacy protection of traffic leaving the enterprise, which may not be desirable.  Enterprise managers could rely instead on filtering software and management software deployed on the enterprise's computers. </del>  3. Over the past years, there have been multiple proposals to add an SNI <del> encryption option in TLS.  Many of these proposals appeared promising, though were rejected after security reviews identified plausible attacks.  In this section, we collect a list of these known attacks. </del>  3.1. encrypted SNI values and forcing the multiplexed server to spend resources in useless decryption attempts. <del> It may be argued that this is not an important DOS avenue, as regular TLS connection attempts also require the server to perform a number of cryptographic operations.  However, in many cases, the SNI decryption will have to be performed by a front-end component with limited resources, while the TLS operations are performed by the component dedicated to their respective services.  SNI-based DOS attacks could target the front-end component. </del>  3.4. The SNI encryption requirement does not stop with HTTP over TLS. Multiple other applications currently use TLS, including, for <del> example, SMTP RFC5246, DNS RFC7858, IMAP RFC2595, and XMPP RFC7590. </del>  These applications, too, will benefit from SNI encryption.  HTTP-only methods like those described in httpfrontingtunnels would not apply there.  In fact, even for the HTTPS case, the HTTPS tunneling service 4. In the absence of TLS-level SNI encryption, many sites rely on an <del> "HTTP Co-Tenancy" solution.  The TLS connection is established with the fronting server, and HTTP requests are then sent over that connection to the hidden service.  For example, the TLS SNI could be set to "fronting.example.com", the fronting server, and HTTP requests sent over that connection could be directed to "hidden.example.com", </del>  accessing the hidden service.  This solution works well in practice when the fronting server and the hidden server are "co-tenants" of the same multiplexed server. implementations, trust, and applicability: The discovery issue is common to most SNI encryption solutions.  The <del> browser issue may be solved by developing a browser extension that support HTTP Fronting, and manages the list of fronting services associated with the hidden services that the client uses.  The multi- protocol issue can be mitigated by using implementation of other applications over HTTP, such as for example DNS over HTTPS RFC8484. The trust issue, however, requires specific developments. </del>  4.1. In practice, this attack is well mitigated when the hidden service is accessed through a specialized application.  The name of the fronting server can then be programmed in the code of the application.  But <del> the attack is much harder to mitigate when the hidden service has to be accessed through general purpose web browsers.  The browsers will need a mechanism to obtain the fronting server indication in a secure way. </del>  There are several proposed solutions to this problem, such as creating a special form of certificate to codify the relation between fronting and hidden server, or obtaining the relation between hidden and fronting service through the DNS, possibly using DNSSEC to avoid <del> spoofing. We can observe that content distribution networks (CDNs) have a similar requirement.  They need to convince the client that "www.example.com" can be accessed through the seemingly unrelated "cdn-node-xyz.example.net".  Most CDNs have deployed DNS-based solutions to this problem.  However, the CDN often holds the authoritative certificate of the origin.  There is simultaneously verification of a relationship between the origin and the CDN, through the certificate, and a risk that the CDN can spoof the content from the origin. </del>  4.3.

This addresses comments from Roman , Éric , Adam , Alissa and Alexey . Also make sure that fixes addressing Mirja's comment will be in the final text.
NAME I think this properly addresses the comments, but you may want to check with Adam for section 3.6 and Alexey for section 4.
LGTM -- thanks, Christian!
Please use RFC 8314 instead of RFC 2595 as a reference for IMAP over TLS.
Done in PR
COMMENT: Section 1: s/servers rely on the Service Name Information (SNI) TLS extension/servers rely on the Server Name Indication (SNI) TLS extension [RFC 6066]/ Section 2.1: Why is parental controls in quotes? Section 2.2: s/Encrypting the SNI now will complete this push/Encrypting the SNI completes this push/ (for timelessness) Section 2.3: In the first paragraph I would suggest trying to use the present tense more so that this still makes sense far in the future. s/At the moment/At the time of this writing/
Done in PR
Adam Roach has entered the following ballot position for draft-ietf-tls-sni-encryption-05: Yes When responding, please keep the subject line intact and reply to all email addresses included in the To and CC lines. (Feel free to cut this introductory paragraph, however.) Please refer to URL for more information about IESG DISCUSS and COMMENT positions. The document, along with other ballot positions, can be found here: URL COMMENT: Thanks to everyone who worked on this. It seems that it will be a useful tool for evaluating potential solutions. : Nit: "URL follows:" : This final sentence appears to be missing some kind of citation before the comma. : It's a bit unclear why this is described as part of the injection of a third party into the scenario. As far as I understand, the described attack exists today, in the absence of any SNI encrypting schemes. If there's a new twist introduced by a multi-party security context, the current text doesn't seem to explain what it is. : Nit: "...including, for example, SMTP..." Nit: "URL XMPP..." Nit: "...benefit from SNI..." Nit: "HTTP-only..." : Nit: "URL" : I think you're missing a comma between the two Martins.
Done in PR
COMMENT: Thank you for the work put into this document. It is well-written and easy to follow. Please find below a couple of comments and nits. Reading " In practice, it may well be that no solution can meet every requirement, and that practical solutions will have to make some compromises." in the abstract brought a smile on my face Same for "employees of the UK National Cyber Security Centre" at the end Regards, -éric == COMMENTS == -- Section 2.1 -- C.1) I would suggest to use the words "network operators" rather than ISP as enterprise or parents for home networks are also relying on clear-text SNI to enforce some policies. -- Section 2.2 -- C.2) The word "abuses" seems a little strong in the first paragraph, I prefer the wording used in 2.1 "unanticipated usage". But, this is only one comment. -- Section 3.6 -- C.3) It is rather a question for my own curiosity... "The fronting service could be pressured by adversaries. " is an obvious attack but even if SNI is protected, the fronting service can still apply any policy to a protected service as it has the knowledge of protected services by design. Hence, I wonder why this case is mentioned here. -- Security section -- Like Warren, I find the content of this section unusual. == NITS == -- Section 2.1 -- Probably worth expanding "MITM" at first use. --Section 3.3 -- Probably worth expanding "DOS" at first use.
Barry Leiba commented: Actually, "DoS" (with the small "o") is in the RFC Editor's list of abbreviations that do not need to be expanded. That, of course, doesn't mean that it shouldn't be expanded. But it should be spelled with the small "o", in any case.
Done in PR

Progressive deployment of solutions like DNS in TLS RFC7858 and DNS over HTTPS RFC8484 mitigates the disclosure of DNS information.  More and more services are colocated on multiplexed servers, loosening the  <ins> relation between IP address and web service.  For example, in virtual hosting solutions, multiple services can be hosted as co-tenants on the same server, and the IP address and port do not uniquely identify a service.  In cloud or Content Delivery Networks (CDNs) solutions, a given platform hosts the services or servers servers of a lot of organization, and looking up to what netblock an IP address belongs reveals little.  However, multiplexed servers rely on the Service Name Information (SNI) TLS extension RFC6066 to direct connections to the appropriate service implementation.  This protocol element is transmitted in clear text.  As the other methods of monitoring get blocked, monitoring focuses on the clear text SNI.  The purpose of SNI encryption and privacy is to prevent that. </ins> Replacing clear text SNI transmission by an encrypted variant will improve the privacy and reliability of TLS connections, but the The SNI was defined to facilitate management of servers, but the developers of middleboxes found out that they could take advantage of the information.  Many examples of such usage are reviewed in  <ins> RFC8404.  Other examples came out during discussions of this draft. They include: </ins> The SNI is probably also included in the general collection of metadata by pervasive surveillance actors, for example to identify The clear-text transmission of the SNI was not flagged as a problem in the security consideration sections of RFC3546, RFC4366, or RFC6066.  These specifications did not anticipate the alternative  <ins> usage described in snileak.  One reason may be that, when these RFCs were written, the SNI information was available through a variety of other means, such as tracking IP addresses, DNS names, or server certificates. </ins> Many deployments still allocate different IP addresses to different services, so that different services can be identified by their IP  <ins> addresses.  However, CDNs commonly serve a large number of services through a comparatively small number of addresses. </ins> The SNI carries the domain name of the server, which is also sent as part of the DNS queries.  Most of the SNI usage described in snileak The decoupling of IP addresses and server names, deployment of DNS privacy, and protection of server certificate transmissions all contribute to user privacy in the face of an RFC3552-style adversary.  <ins> Encrypting the SNI completes this push for privacy and make it harder to censor or otherwise provide differential treatment to specific internet services. </ins> 2.3.  <ins> Deploying SNI encryption helps thwart most of the unanticipated SNI usages including censorship and pervasive surveillance, but it also will break or reduce the efficacy of the operational practices and techniques implemented in middle-boxes as described in snileak.  Most of these functions can, however, be realized by other means.  For example, some DNS service providers offer customers the provision to "opt in" filtering services for parental control and phishing protection.  Per-stream QoS could be provided by a combination of packet marking and end-to-end agreements.  As SNI encryption becomes common, we can expect more deployment of such "end-to-end" solutions. At the time of this writing, enterprises have the option of installing a firewall performing SNI filtering to prevent connections to certain websites.  With SNI encryption this becomes ineffective. Obviously, managers could block usage of SNI encryption in enterprise computers, but this wide-scale blocking would diminish the privacy protection of traffic leaving the enterprise, which may not be desirable.  Enterprise managers could rely instead on filtering software and management software deployed on the enterprise's computers. </ins> 3. Over the past years, there have been multiple proposals to add an SNI  <ins> encryption option in TLS.  A review of the TLS mailing list archives shows that many of these proposals appeared promising but were rejected after security reviews identified plausible attacks.  In this section, we collect a list of these known attacks. </ins> 3.1. encrypted SNI values and forcing the multiplexed server to spend resources in useless decryption attempts.  <ins> It may be argued that this is not an important Denial of Service Attacks (DoS) avenue, as regular TLS connection attempts also require the server to perform a number of cryptographic operations.  However, in many cases, the SNI decryption will have to be performed by a front-end component with limited resources, while the TLS operations are performed by the component dedicated to their respective services.  SNI-based DoS attacks could target the front-end component. </ins> 3.4. The SNI encryption requirement does not stop with HTTP over TLS. Multiple other applications currently use TLS, including, for  <ins> example, SMTP RFC5246, DNS RFC7858, IMAP RFC8314, and XMPP RFC7590. </ins> These applications, too, will benefit from SNI encryption.  HTTP-only methods like those described in httpfrontingtunnels would not apply there.  In fact, even for the HTTPS case, the HTTPS tunneling service 4. In the absence of TLS-level SNI encryption, many sites rely on an  <ins> "HTTP Co-Tenancy" solution, often refered to as Domain Fronting domfront.  The TLS connection is established with the fronting server, and HTTP requests are then sent over that connection to the hidden service.  For example, the TLS SNI could be set to "fronting.example.com", the fronting server, and HTTP requests sent over that connection could be directed to "hidden.example.com", </ins> accessing the hidden service.  This solution works well in practice when the fronting server and the hidden server are "co-tenants" of the same multiplexed server. implementations, trust, and applicability: The discovery issue is common to most SNI encryption solutions.  The  <ins> browser issue was solved in domfront by implementing domain fronting as a pluggable transport for the Tor browser.  The multi-protocol issue can be mitigated by using implementation of other applications over HTTP, such as for example DNS over HTTPS RFC8484.  The trust issue, however, requires specific developments. </ins> 4.1. In practice, this attack is well mitigated when the hidden service is accessed through a specialized application.  The name of the fronting server can then be programmed in the code of the application.  But  <ins> the attack is harder to mitigate when the hidden service has to be accessed through general purpose web browsers. </ins> There are several proposed solutions to this problem, such as creating a special form of certificate to codify the relation between fronting and hidden server, or obtaining the relation between hidden and fronting service through the DNS, possibly using DNSSEC to avoid  <ins> spoofing.  The experiment described in domfront solved the issue by integrating with the Lantern Internet circumvention circumvention tool. We can observe that CDNs have a similar requirement.  They need to convince the client that "www.example.com" can be accessed through the seemingly unrelated "cdn-node-xyz.example.net".  Most CDNs have deployed DNS-based solutions to this problem.  However, the CDN often holds the authoritative certificate of the origin.  There is simultaneously verification of a relationship between the origin and the CDN, through the certificate, and a risk that the CDN can spoof the content from the origin. </ins> 4.3.


httpfronting. This document does not present the design of a solution, but provides <del> guidelines for evaluating proposed solutions.  The need for related work on the encryption of the Application Layer Protocol Negotiation (ALPN) parameters of TLS is discussed in hiding-alpn. </del>  2. They include: The SNI is probably also included in the general collection of <del> metadata by pervasive surveillance actors, for example to identify services used by surveillance targets. </del>  2.2. solutions that could quickly reach large scale deployments. Replacing clear text SNI transmission by an encrypted variant will <del> also thwart MITM interferences that are sometimes described as legitimate.  As explained in end-to-end, alternative solutions will have to be developed. </del>  6.

Trying to address the last comments (issue ).
NAME I hope this reflects our discussion.
Checking in after Roman's comments on the list.

httpfronting. This document does not present the design of a solution, but provides  <ins> guidelines for evaluating proposed solutions.  (The review of HTTP- level solutionsin httpfronting is not an endorsement of these solutions.)  The need for related work on the encryption of the Application Layer Protocol Negotiation (ALPN) parameters of TLS is discussed in hiding-alpn. </ins> 2. They include: The SNI is probably also included in the general collection of  <ins> metadata by pervasive surveillance actors RFC7258, for example to identify services used by surveillance targets. </ins> 2.2. solutions that could quickly reach large scale deployments. Replacing clear text SNI transmission by an encrypted variant will  <ins> break or reduce the efficacy of the operational practices and techniques implemented in middle-boxes as described in snileak.  As explained in end-to-end, alternative solutions will have to be developed. </ins> 6.


are supported by the server. Since network addresses may change, a client SHOULD NOT assume that <del> extended token lengths are supported by a server later than 60 minutes after receiving the most-recent response with an extended token length. </del>  If a server supports extended token lengths but receives a request with a token of a length it is unwilling or unable to handle, it MUST

This pull request tries to motivate why ~60min is about right.
section 2.2.2: doc> Since network addresses may change, a client SHOULD NOT assume that doc> extended token lengths are supported by a server later than 60 doc> minutes after receiving the most-recent response with an extended doc> token length. 60 minutes for address changes? Out of curiosity, upon what was this based? I lack a good deal of context, but this kind of feels like the kind of constant that will get baked into code and come to govern some behaviour that later might need updating.
The number indeed sounds arbitrary. We could make use of the parameter mechanics that RFC 7252 has (ACK_TIMEOUT and friends) and set the default to 1800 s.

are supported by the server. Since network addresses may change, a client SHOULD NOT assume that  <ins> extended token lengths are supported by a server for an unlimited duration.  Unless additional information is available, the client should assume that addresses (and therefore extended token lengths) are valid for a minimum of 1800s, and for a maximum of 86400s (1 day).  A client may use additional forms of input into this determination.  For instance a client may assume a server which is in the same subnet as the client has a similiar address lifetime as the client.  The client may use DHCP lease times or Router Advertisements to set the limits.  For servers which is not local, if the server was looked up using DNS, then the DNS resource record will have a Time To Live, and the extended token length should be kept for only that amount of time. </ins> If a server supports extended token lengths but receives a request with a token of a length it is unwilling or unable to handle, it MUST


appropriate.  In the absence of integrity and reply protection, an on-path attacker or rogue server/intermediary could return a state (either one modified in a reply, or an unsolicited one) that could <del> alter the internal state of the client.  However, a careful analysis of any potential attacks to the security and privacy properties of the system might reveal that there are cases where such cryptographic protections do not add value in a specific case. </del>  RFC3610 with a 64-bit tag is RECOMMENDED, combined with a sequence number and a replay window.  Where encryption is not needed, RFC6234,

… into more positive language
[[TODO]]
Not sure I follow the 5077 analogy. Do we ever plan to use stateless without some integrity protection? We might save a lot of weasel-wording by simply requiring it.

appropriate.  In the absence of integrity and reply protection, an on-path attacker or rogue server/intermediary could return a state (either one modified in a reply, or an unsolicited one) that could  <ins> alter the internal state of the client.  It is this reason that at least the use of integrity protection on the token is always recommended. It maybe that in some very specific case, as a result of a careful and detailed analysis of any potential attacks, that there may be cases where such cryptographic protections do not add value.  The authors of this document have not found such a use case as yet. </ins> RFC3610 with a 64-bit tag is RECOMMENDED, combined with a sequence number and a replay window.  Where encryption is not needed, RFC6234,