Large-Scale Measurement of Encrypted TLS Server Name Indication (ESNI): How Far Have We Come?
Yangyang Guan, Wei Xia, Gaopeng Gou, Peipei Fu, Bingxu Wang, Zhen Li · 2021
With the development of Internet techniques, the Transport Layer Security (TLS) protocol has become the most popular protocol for traffic encryption. ESNI, which is an extension of the TLS 1.3 protocol and enables the encryption of SNI, greatly protects the privacy of users. Currently, the measurement and exploration of ESNI applications and deployment are quite lacking. In this paper, we conduct the first study of ESNI deployment and use since its standardization by the IETF. We propose a novel ESNI measurement method combining active DNS TXT and TLS scanning. We collect a large amount of domain data based on passive monitoring and open source sites, and acquire 5.5 billion data during 3 months. We perform a global measurement of ESNI by deploying high-performance active detection services. According to comprehensive analysis, we find that 0.73% of global sites and 3.4% second-level domains support ESNI. The higher proportion correspond to China (.cn) and Russia (.ru), being 21.13% and 15.63% respectively. We also establish and investigate the critical contribution of hosting services and CDNs to rapid deployment and initial uptake of the ESNI. They will accelerate the deployment of ESNI applications. Especially, Cloudflare is the only vendor that supports ESNI on the server side. Finally, we validate the measurement framework and the results demonstrate the feasibility of the measurement method.