1. 3

When a client wants to form a TLS connection to any of the domains served by an ESNI-supporting provider, it sends an “encrypted_server_name” extension, which contains the true extension encrypted under the provider’s public key. The provider can then decrypt the extension and either terminate the connection (in Share> Mode) or forward it to the backend server (in Split Mode).

Servers operating in Split Mode SHOULD have DNS configured to return the same A (or AAAA) record for all ESNI-enabled servers they service. This yields an anonymity set of cardinality equal to the number of ESNI-enabled server domains supported by a given client-facing server. Thus, even with SNI encryption, an attacker which can enumerate the set of ESNI-enabled domains supported by a client-facing server can guess the correct SNI with probability at least 1/K, where K is the size of this ESNI-enabled server anonymity set. This probability may be increased via traffic analysis or other mechanisms.

    1. 1

      I don’t understand the point of encryption providing at least 1/K chance of decryption, or did i get this wrong?