Encrypted Client Hello: Ready for Prime Time?, (Mon, Mar 9th)
Source SANS ISC Handlers Diary
Description
Last week, two related RFCs were published: 
Impact
The adoption of ECH will significantly improve user privacy by encrypting the Client Hello message, preventing passive network observers—including ISPs, governments, and malicious actors—from identifying the specific hostnames clients connect to. This reduces the risk of censorship, targeted surveillance, and traffic correlation attacks. For organizations, this means enhanced confidentiality of client-server communications at the handshake level. However, ECH also impacts network security operations. Traditional TLS inspection, traffic filtering, and anomaly detection tools that rely on plaintext SNI or Client Hello data will lose visibility, potentially reducing the effectiveness of security monitoring and threat detection. Enterprises that perform TLS interception for data loss prevention or compliance may need to adjust policies or deploy alternative methods. Additionally, blocking DNS HTTPS records to disable ECH can degrade network performance by disabling HTTP/3 and QUIC, affecting user experience. Since ECH is still emerging, organizations that rely on legacy DNS or TLS stacks may face compatibility issues. Overall, while ECH strengthens privacy and security for end users, it requires organizations to adapt their network security architectures and monitoring strategies.
Defensive guidance
Organizations should proactively update their DNS resolvers and TLS client/server implementations to support ECH, ensuring compatibility with emerging privacy standards. Network security teams must evaluate the impact of ECH on existing TLS inspection and monitoring tools and consider deploying endpoint-based security solutions or enhanced behavioral analytics that do not rely on plaintext handshake data. For environments requiring visibility into TLS handshakes, organizations can implement split DNS or internal PKI solutions to selectively manage encrypted handshakes. Monitoring DNS HTTPS records for domains of interest can help detect ECH adoption and plan accordingly. Blocking DNS HTTPS records to disable ECH is possible but not recommended due to collateral impacts on HTTP/3 and QUIC protocols. Security teams should engage with vendors to ensure their products support ECH and consider updating security policies to balance privacy benefits with operational needs. Finally, educating stakeholders about ECH's privacy advantages and operational implications will facilitate smoother adoption and risk management.
Summary
Encrypted Client Hello (ECH) is a significant advancement in TLS privacy, addressing the longstanding issue of the Server Name Indication (SNI) being sent in plaintext during the TLS handshake. The SNI reveals the hostname a client intends to connect to, which can be exploited for surveillance, censorship, or traffic analysis. Previous attempts to encrypt only the SNI extension were insufficient, as other parts of the Client Hello message could still be fingerprinted or leaked. ECH extends encryption to most of the Client Hello message, providing a more comprehensive privacy solution. The main technical challenge is that the Client Hello is the first message sent in the TLS handshake, so no shared keys exist yet to encrypt it. ECH solves this by leveraging DNS HTTPS records to publish public keys that clients use to encrypt their Client Hello messages. This approach avoids additional round trips and maintains handshake efficiency. Two RFCs published in March 2026—RFC 9848 (bootstrapping ECH with DNS service bindings) and RFC 9849 (the ECH protocol itself)—formalize these mechanisms. Cloudflare is a notable early implementer, allowing customers to enable ECH via their edge certificate settings, though this feature may not be available on free plans. Tools like 'dig' can be used to query DNS HTTPS records to verify ECH support for domains. However, older DNS tools may not support HTTPS record queries properly. While ECH enhances privacy by preventing passive observers from seeing the SNI and other Client Hello data, it also complicates network monitoring and intrusion detection systems that rely on inspecting TLS handshakes. Some network administrators might consider blocking HTTPS DNS records to disable ECH, but this also disables HTTP/3 and QUIC protocols, which could degrade performance and user experience. Currently, there are no known exploits targeting ECH, and its deployment is still in early stages. The threat is assessed as medium severity due to the privacy implications and potential operational impacts rather than direct vulnerabilities or exploits.