Comment by tialaramex | Hacker News Reader

Comment by tialaramex | Hacker News Reader

Parent Full thread

ECH is intended to be GREASEd which means there isn't an easy way to say "Block ECH only when it is used" because the obvious markers are present in every single connection.

That is, an ECH implementing browser talking to some web site that doesn't do ECH will present it an ECH blob which is random gibberish. The web site doesn't do ECH, so it ignores the ECH, but a middlebox doesn't know that and if it wants to "block ECH" it must tear down this connection.

If the same browser connects to a site which does have ECH the ECH blob isn't gibberish it's encrypted, the site decrypts it and treats the result as the real ClientHello.

Historically China's Great Firewall is willing to put work in to detect and sabotage things it doesn't like. But the point of GREASing extensions is to ensure that the extension itself isn't poisoned. As a result most likely ECH will work fine in China, they'll just block IPs they don't like, punish citizens (or indeed visitors) they don't like, and that's an internal matter that the Chinese can take up with their government in the usual (and costly) way.

This is not a magic anti-censorship tool, and isn't designed to be one. Even Tor isn't that, although its developers can point you at services that help if that's what you need.

So there would be ClientHello with greased ECH and SNI and ClientHello with real ECH and without SNI?

Regarding blocking, what prevents Chinese firewall from simply removing ECH extension from all ClientHello packets? Servers that don’t expect ECH would continue to work, those that expect wouldn’t accept connection, mission accomplished.

No. There's always SNI in the outer unencrypted ClientHello. ECH DNS entries explain which name you should use in this position, which will be constant across some number of inner names which will be encrypted.

Remember the IP address you connect to already tells a hypothetical eavesdropper roughly what you connected to. If it's a Wikimedia server or Microsoft is not concealed by lacking SNI. What ECH does is hide exactly which service you wanted from that IP address. Wikimedia run not only their famous encyclopedia, but a dictionary and numerous other useful references - from the same IP address with different hostnames. So maybe a future ECH-enabled German Wiktionary will use the same outer name as the English Wikipedia. Today an adversary can see which I am using, with ECH they cannot.

> Regarding blocking, what prevents Chinese firewall from simply removing ECH extension from all ClientHello packets? Servers that don’t expect ECH would continue to work, those that expect wouldn’t accept connection, mission accomplished.

The entire handshake is integrity protected. In TLS 1.3 (ECH is not proposed for any earlier versions) the transcript recorded by the server and client would deviate (one sent ECH the other did not receive it) and so the transcript signature check step fails and the connection doesn't work.

The Chinese don't bother messing about with this stuff, if you connect somewhere the Great Firewall thinks you shouldn't, it just closes the TCP connection and blocks traffic altogether. Simple, effective, and in a sense, standards compliant.

Thank you for the very detailed explanation!

The handshake messages are validated with an HMAC to prevent tampering

I don't see how this would work: China would effectively just be banning that browser, which is no skin off their back as other companies--even better: ones local to China--can make browsers that don't do this.

Sure, if China wants to ban say, Safari, they can do that.

Seems like a very bad idea to me, but it's their country and they can choose policy. I think Winnie the Pooh is smarter than Trump and won't just throw a tantrum because he didn't get his way, but it's certainly possible he'd decide to turn every iPhone in China into a brick rather than accept that we don't want to keep telling eavesdroppers which server name you wrote in the URL.

The GREASE isn't there primarily because of China, as I said they don't build crazy fragile technology, they don't have anybody to sell this too, the Great Firewall is an in-house project, so it's mostly simple and robust. Bad destination IP, connection blocked. Rarely a big problem in a technical sense.

GREASE is because of stupid corporate middleboxes. Middleboxes are a technical problem, because even when they have an apparently mundane and legitimate purpose they tend to go about it in stupid over-complicated ways that destroy forward compatibility. All of the weird spelling of TLS 1.3 is because of middleboxes. Why is HelloRetryRequest spelled ServerHello? Because if you don't say ServerHello at that point some famous middleboxes explode. Why is TLS 1.3 ClientHello written exactly like a TLS 1.2 ClientHello (including the version number) except with crazy extension values? Because otherwise middleboxes explode. Why is there a bunch of completely random data labelled "Session ID"? Is it a session ID? Nope. If that was missing, you guessed it, middleboxes explode.

Reply on news.ycombinator.com