Developing ECH for OpenSSL (DEfO)Developing ECH for OpenSSL (DEfO)The encrypted ClientHello (ECH) mechanism (RFC 9849) is a way to plug a few privacy-holes that remain in the Transport Layer Security (TLS) protocol that's used as the security layer for the web. OpenSSL is a widely used library that provides an implementation of the TLS protocol. The DEfO project developed an implementation of ECH for OpenSSL, as well as ECH integrations/implementations for various clients (curl, python) and servers (haproxy, nginx, apache, lighttpd) that use OpenSSL. Those implementations were initially used in interoperability testing but have since (mostly) been merged to upstream projects. DEfO was funded by the Open Technology Fund (OTF). Tolerant Networks Ltd. and people from the Guardian Project did the work in DEfO.
Along the way, we made an ECH Interop Report (Version 2). (The previous version is here.) The table below indicates the various combinations of server technology supported here.
In May/June 2025, we did a small ECH trial with the Wikimedia foundation and wrote up a report on that.
In June 2025, we had a couple of (semi-external) security folks do some analysis on remaining weaknesses of ECH; their report is here.
in August 2025, we wrote up a couple of short reports on our CI setup and the set of PRs submitted by the DEfO project up to that point.
In September 2025, we wrote up a short report on QUIC and ECH.
OpenSSL included our ECH code as part of it's release in April 2026. Subsequently, (and sometimes before:-), client and server code was upstreamed to the other projects.
The OTF-funded DEfO work ended in November 2026. We continue to help upstream projects maintain ECH code though.
We have a Github CI setup using the github DEfO project organisation but almost all of our ECH code has now been upstreamed so really lives on in those upstream projects. The exceptions (code yet to be upstreamed) are 1) ECH split mode for OpenSSL, haproxy and nginx, and 2) post-quantum ECH using X-wing. Those not-yet-upstreamed features are present in the DEfO-project github organisation's code.
This VM used be our main test server, but we've a more recent test setup at test.defo.ie. We'll keep this running for now though as some other projects have used these URLs for test purposes.
What's deployed on this VM is:
| Server Technology | URL/host:port details |
| nginx | https://defo.ie/ech-check.php a web page that tells you if ECH was used |
| OpenSSL s_server | https://draft-13.esni.defo.ie:8413/stats for "normal ECH" or https://draft-13.esni.defo.ie:8414/stats for one that forces HRR to P-384 |
| lighttpd 1.4 | https://draft-13.esni.defo.ie:9413/ |
| nginx | https://draft-13.esni.defo.ie:10413/ |
| apache2 | https://draft-13.esni.defo.ie:11413/ |
| haproxy | https://draft-13.esni.defo.ie:12413/ - haproxy shared mode (haproxy terminates TLS, so page won't show ECH success) https://draft-13.esni.defo.ie:12414/ - haproxy split mode (haproxy only decrypts ECH) |
ECH public keys for those servers are published in the DNS and are rotated hourly (at :42 currently, with a 1800 second TTL). We currently publish one HTTPS RR for each service containing an ECH configuration list with up to 3 public keys. (The three public keys thing is arguably not useful for clients, but we used it to exercise our provisioning scripts.)
To view the HTTPS RR for defo.ie use: "$ dig https defo.ie" but for services on other ports you have to use "$ dig https _10413._https.draft-13.esni.defo.ie" or similar.
Cloudflare also have a test server at https://cloudflare-ech.com/cdn-cgi/trace.
#ech-dev:matrix.orghttps://lists.mayfirst.org/mailman/listinfo/ech-dev/
