I-D Action: draft-scalone-cfr-source-privacy-02.txt
| Newsgroups | gmane.ietf.announce |
|---|---|
| Message-ID | <178819469217.333696.6689822596201538695@dt-datatracker-6669c7b496-4m6kd> |
Internet-Draft draft-scalone-cfr-source-privacy-02.txt is now available. Title: Customer-Facing Relay (CFR): Enhancing Source Privacy in Encrypted Transport and CDN Scenarios Author: Gianpaolo Angelo Scalone Name: draft-scalone-cfr-source-privacy-02.txt Pages: 22 Dates: 2026-08-31 Abstract: Encrypted ClientHello (ECH) protects sensitive TLS ClientHello fields, including the Server Name Indication (SNI), from on-path observers. ECH does not, however, attempt to hide the client's network-layer source identity from the ECH client-facing server (CFS). In split-mode deployments, the CFS decrypts the ClientHelloInner in order to route the connection to the appropriate backend while also receiving the connection from the client's visible source address. This creates a distinct source-privacy problem. Where ECH service and content front-door infrastructure are concentrated, a relatively small number of providers can obtain a privileged vantage point from which a stable source address can be correlated with many encrypted destinations and with other service telemetry. Measurements over a corpus of approximately one million domains, together with an active- ECH validation subset, show substantial front-door concentration and motivate treating source privacy as a complement to destination privacy. This document describes the Customer-Facing Relay (CFR), a network- layer, access-side source-aliasing function. A CFR forwards encrypted TCP or UDP traffic without terminating TLS or QUIC and replaces the subscriber-visible source address with a shared or short-lived source alias. The document also examines the different privacy properties of IPv4 NAT/CGN and IPv6 source addressing and identifies requirements for privacy-preserving source mapping. The IETF datatracker status page for this Internet-Draft is: https://datatracker.ietf.org/doc/draft-scalone-cfr-source-privacy/ There is also an HTMLized version available at: https://datatracker.ietf.org/doc/html/draft-scalone-cfr-source-privacy-02 A diff from the previous version is available at: https://author-tools.ietf.org/iddiff?url2=draft-scalone-cfr-source-privacy-02 Internet-Drafts are also available by rsync at: rsync.ietf.org::internet-drafts _______________________________________________ I-D-Announce mailing list -- [email protected] To unsubscribe send an email to [email protected]