ECH
约 1 分钟阅读
- 加密 SNI - ESNI -> ECH - Encrypted Client Hello - 加密 Client Hello
- 依赖 HTTPS DNS 记录
- HAProxy - #1924GitHub Issuehaproxy/haproxy#1924
- OpenSSL #7482GitHub Issueopenssl/openssl#7482
- WolfSSL v5.6.0 --enable-hpke
- Nginx #2275
- curl 依赖 OpenSSL - 需要通过 fork 的 OpenSSL 才能支持
- 参考
- blog.cloudflare.com/encrypted-client-hello
- www.cloudflare.com/zh-cn/ssl/encrypted-sni
- I-D draft-ietf-tls-esniIETF 草案I-D draft-ietf-tls-esniIETF Internet-Draft document.IETF · Internet-Draft
- Chrome 117 - chromestatus.com/feature/6196703843581952
- chrome://flags/#encrypted-client-hello
- 2023-09
- tls-ech.dev
- defo.ie/ech-check.php
- cloudflare-ech.com
# 国内被拦截
dig tls-ech.dev HTTPS +short
# 通过 sni 判断是否走的 ECH
curl https://wener.me/cdn-cgi/trace
# https://github.com/curl/curl/blob/master/docs/ECH.md
curl --ech true --doh-url https://cloudflare-dns.com/dns-query https://wener.me/cdn-cgi/trace
# 需要代理
curl -s -H 'accept: application/dns+json' 'https://dns.google.com/resolve?name=tls-ech.dev&type=HTTPS' | jq '.Answer[].data' -r1 . ech=AEn+DQBFKwAgACABWIHUGj4u+PIggYXcR5JF0gYk3dCRioBW8uJq9H4mKAAIAAEAAQABAANAEnB1YmxpYy50bHMtZWNoLmRldgAA关联信息
反向链接、本文链接的其他页面和外部资料。
参考资料
GitHub2 条
- haproxy/haproxy#1924github.com/haproxy/haproxy/issues/1924
- openssl/openssl#7482github.com/openssl/openssl/issues/7482
标准文档1 条
- I-D draft-ietf-tls-esnidatatracker.ietf.org/doc/html/draft-ietf-tls-esniIETF · Internet-Draft
IETF Internet-Draft document.
其他外链8 条
- blog.cloudflare.com/encrypted-client-helloblog.cloudflare.com/encrypted-client-hello
- chromestatus.com/feature/6196703843581952chromestatus.com/feature/6196703843581952
- cloudflare-ech.comcloudflare-ech.com/
- defo.ie/ech-check.phpdefo.ie/ech-check.php
- tls-ech.devtls-ech.dev/
- trac.nginx.org/nginx/ticket/2275trac.nginx.org/nginx/ticket/2275
- www.cloudflare.com/zh-cn/ssl/encrypted-sniwww.cloudflare.com/zh-cn/ssl/encrypted-sni
- www.wolfssl.com/encrypted-client-hello-ech-now-supported-wolfsslwww.wolfssl.com/encrypted-client-hello-ech-now-supported-wolfssl