What is ECH?

Encrypted Client Hello (ECH) is a Transport Layer Security (TLS) extension defined in RFC 8871 and RFC 8446 (TLS 1.3). It encrypts the Client Hello message sent by the client at the start of a TLS handshake. This prevents intermediate devices, such as ISPs, firewalls, or network monitors, from seeing sensitive fields like the Server Name Indication (SNI), which reveals the hostname being requested. Before ECH, SNI was sent in cleartext, allowing pervasive censorship, traffic filtering, and host-based blocking.

ECH works by using a two-layer Client Hello structure. The client sends an outer Client Hello that contains a minimal set of fields and a public key for the server. The actual, inner Client Hello is encrypted using a hybrid public-key encryption (HPKE) scheme. The server decrypts the inner message with its corresponding private key. Only the server that holds the correct key can read the real SNI. If the server cannot decrypt, the client and server fall back to a non-ECH handshake, or the connection fails gracefully. The outer Client Hello reveals only the IP address and a generic "public name" (often a CDN fronting domain), which does not disclose the specific site.

ECH is deployed primarily in TLS 1.3 due to its redesign of the handshake, which provides more room for extensions. It builds on earlier work like Encrypted SNI (ESNI). ECH is supported by major browsers (e.g., Chrome, Firefox) and CDN providers. It operates at the application-transport boundary within the TLS stack, complementing DNS encryption (DoH/DoT) to achieve stronger privacy against network observers. ECH is not yet universally deployed because it requires server-side key management and client adoption, but it represents the current standard for hiding the destination hostname in encrypted traffic.