Encrypted ClientHello (ECH)

Encrypted ClientHello (ECH) is a TLS extension, specified in the IETF TLS working group’s draft-ietf-tls-esni and built on the TLS handshake defined by TLS 1.3 (RFC 8446), that encrypts the ClientHello message so a network observer on the path between client and server can no longer read it in plaintext. Without ECH, the TLS SNI extension — which tells a server which hostname a client is trying to reach when multiple sites share one IP address — travels unencrypted inside the ClientHello during the TLS handshake, letting any on-path observer see which site a client is visiting even though the rest of the session is encrypted. ECH closes that gap by splitting the handshake into an “outer” ClientHello, sent in the clear with placeholder values, and an “inner” ClientHello carrying the real SNI and other sensitive extensions, encrypted to a public key the server publishes in DNS — usually as the “ech” parameter of an SVCB or HTTPS record. A client-facing server capable of decrypting the inner ClientHello (common at CDNs and multi-tenant hosts) then routes the connection to the correct backend without ever exposing the real hostname on the wire. ECH supersedes an earlier, less robust proposal called Encrypted SNI (ESNI) from the same working group. ECH does not hide the destination IP address or encrypt traffic before the TLS handshake begins; it only protects handshake metadata that would otherwise leak which site, among several sharing an address, a client is connecting to.

AdminKit’s glossary recently added several related protocol-extension terms worth knowing alongside ECH: certificate pinning, Oblivious DoH (ODoH), DHCPv6, TCP Fast Open and SYN cookies.

Encrypted ClientHello is part of AdminKit’s Machine protocols cluster; the full AdminKit glossary lists other related terms.