1712879 - Include bogus PSK when attempting ECH

Status: RESOLVED FIXED

(NSS :: Libraries, enhancement, P1)

Description

[Martin Thomson [:mt:]]

Recent changes to ECH include a change that allows the PSK extension to appear in CHOuter. This minimizes the extent to which CHOuter can be distinguished as such. This will make the message larger, but should make it less obvious when PSKs are used.

We can do this by keeping the PSK extension (we currently trim it off). To avoid leaking information (other than the PSK ID length), the values can be replaced with random garbage.

I don't think that it is great that we leak the PSK ID length in this way, but we don't have any good information about that, and the length isn't protected by padding in CHInner. Overall, it's probably safest to keep the length for the bogus extension.

Comment 1

[Martin Thomson [:mt:]]

Attachment: Bug 1712879 - Scramble the PSK extension in CHOuter. r=bbeurdouche,mt

Depends on D115852

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:mt, could you have a look please?
For more information, please visit auto_nag documentation.

Comment 3

[Dennis Jackson]

Attachment: Bug 1712879 - Allow for compressed, non-contiguous, extensions r=mt

In Draft 13, clients can now compress extensions which are non-contiguous but in-order.
This changeset removes the logic handling this.

Comment 4

[Dennis Jackson]

Attachment: Bug 1712879 - When ECH is accepted, reject extensions which were only advertised in the Outer Client Hello r=mt

Previously, we only tracked whether we'd advertised an extension at all. This change allows us to track the advertisements for both the Outer and Inner Client Hello seperately. If the server accepts ECH but includes an extension we only offered in the Outer Client Hello, we will send an alert.

As a side-effect, if the client offers an extension in the ClientHelloInner which is not offered in the ClientHelloOuter and the server accepts, we will send the same alert. It is unclear whether this is desirable behavior or not - since if we did not alert this would allow a network observer to distinguish whether ECH was used.

Comment 5

[Dennis Jackson]

Attachment: Bug 1712879 - Add test cases for ECH compression and unexpected extensions in SH. r=mt

• Update the test custom extension injectors to create large (1024 byte) extensions
• Update the compression tests to verify that compression ocurrs correctly.
• Add tests to ensure that when accepting ECH, the client rejects Xtns which are only
  valid for the CHO and vice versa

Depends on D130698

Comment 6

[Dennis Jackson]

https://hg.mozilla.org/projects/nss/rev/d41c0fcdcf85118f1866880d10ac7bf15d7edc5f
https://hg.mozilla.org/projects/nss/rev/beef1385132760879b9b8c9cecd4e0bb9d8b8efe
https://hg.mozilla.org/projects/nss/rev/daf5bc69425a16a809c4feeed4f0ab4ecee80400
https://hg.mozilla.org/projects/nss/rev/b8623fde307c21bf50e753b36416ad94fe8fd227