The encrypted ClientHello (ECH) mechanism (draft-spec) is a way to plug a few privacy-holes that remain in the Transport Layer Security (TLS) protocol that's used as the security layer for the web. OpenSSL is a widely used library that provides an implementation of the TLS protocol. The DEfO project has developed an implementation of ECH for OpenSSL, and proof-of-concept implementations of various clients and servers that use OpenSSL as a demonstration and for interoperability testing. DEfO is funded by the Open Technology Fund (OTF). Tolerant Networks Ltd. and people from the Guardian Project are doing the work in DEfO.
This organisation is where we keep our various ECH-enabled code repos and our ech-dev-utils repo that has HOWTOs, test scripts and other ancillary ECH developer content. That's the place to start if you want to play with these ECH-enabled packages.
The ECH APIs used in these repos match those agreed with OpenSSL maintainers, as part of the work to upstream our ECH code into the OpenSSL ECH feature branch. That work is partly completed, so you can think of the OpenSSL repo here as being a few PRs ahead of the "official" OpenSSL feature branch for ECH.
For each of these ECH-enabled repos, we've added a 'builder' workflow (run daily and after a push) that attempts to merge our code with the latest upstream and that then does a build and a basic test. We expect these to fail from time to time as changes occur in the upstream packages. When that happens, there's a red badge below and we usually fix those within a couple of days by rebasing the repos here with the relevant upstream. Note that a red badge doesn't mean that our ECH-enabled code is broken, just that some manual intervention is needed to bring us back up to the bleeding edge with the upstream package.
Packages with our ECH code yet to be upstreamed:
| Package | 'Builder' status | Details |
|---|---|---|
| openssl |  |
workflow link |
| apache-httpd |  |
workflow link |
| haproxy |  |
workflow link |
| nginx |  |
workflow link |
| python |  |
workflow link |
For packages where our ECH code has already been upstreamed, we also have a
daily check that those build and pass a basic ECH test. So far, that's just
for curl and lighttpd:
| Package | 'Builder' status | Details |
|---|---|---|
| curl |  |
workflow link |
| lighttpd1.4 |  |
workflow link |
