Good-bye ESNI, hello ECH!
Dec 8, 2020Christopher Patton
Summary
Introduces Encrypted Client Hello (ECH) as a successor to Encrypted SNI (ESNI). ECH encrypts the entire TLS handshake, protecting sensitive metadata like SNI and ALPN from network observers. It builds upon the lessons learned from ESNI and TLS 1.3's handshake encryption attempts, addressing key distribution challenges and the need for handshake parameters essential for authentication to be sent in the clear. ECH aims to enhance privacy and lay the groundwork for future security and performance features in TLS.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack