SNI encryption

[martinthomson]

Server Name Indication could be encrypted to protect it from being inspected by passive attackers. There are some virtual-hosting type situations where hiding this information is considered desirable. If we can encrypt SNI, then it is probably trivial to encrypt other extensions.

However, this complicates the handshake. A lot. It also complicates virtual-hosting scenarios. Rich summarizes the issues pretty well here: http://www.ietf.org/mail-archive/web/tls/current/msg11823.html

[leonklingele]

Is this already ruled-out? How could the SNI be encrypted without an addition RTT?

One could hash the SNI in the Client Hello which would at least help if the served host name is not publicly known (e.g. using a self-signed certificate).

[kaduk]

It seems likely that there will eventually be an (optional?) extension that permits an encrypted "real" SNI, with some fake public SNI. But maybe that is not what you are asking.

[leonklingele]

@ekr why was this closed?

[ekr]

Because we are not going to do anything about it in the base specification.