The encrypted ClientHello (ECH) mechanism (draft-spec) is a way to plug a few privacy-holes that remain in the Transport Layer Security (TLS) protocol that's used as the security layer for the web. OpenSSL is a widely used library that provides an implementation of the TLS protocol. The DEfO project has developed an implementation of ECH for OpenSSL, and proof-of-concept implementations of various clients and servers that use OpenSSL as a demonstration and for interoperability testing. DEfO was initially funded by the Open Technology Fund (OTF), and subsequently by the National Democratic Initiative. In mid-2023 OTF extended our funding to help with upstreaming the relevant ECH code to the various projects involved. Tolerant Networks Ltd. and people from the Guardian Project are doing the work in DEfO.
This organisation is where we keep our various ECH-enabled code repos and our ech-dev-utils repo that has HOWTOs, test scripts and other ancillary ECH developer content. That's the place to start if you want to play with these ECH-enabled packages.
For each of our ECH-enabled repos, we've added a 'builder' workflow (run daily) that attempts to merge our code with the latest upstream and that then does a build and a basic test. We expect these to fail from time to time as changes occur in the upstream packages. When that happens, there's a red badge below and we usually fix those within a couple of days by rebasing the repos here with the relevant upstream. Note that a red badge doesn't mean that our ECH-enabled code is broken, just that some manual intervention is needed to bring us back up to the bleeding edge with the upstream package.
Packages with our ECH code yet to be upstreamed:
| Package | 'Builder' status | Details |
|---|---|---|
| openssl |  |
workflow link |
| apache-httpd |  |
workflow link |
| haproxy |  |
workflow link |
| lighttpd1.4 |  |
workflow link |
| nginx |  |
workflow link |
For packages where our ECH code has already been upstreamed, we also have a
daily check that those build and pass a basic ECH test. So far, that's just
for curl:
| Package | 'Builder' status | Details |
|---|---|---|
| curl |  |
workflow link |
