4 ms·

I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already fami

by ivanr 7mo ago

I wrote about ECH a couple of months ago, when the specs were still in draft but already approved for publication. It's a short read, if you're not already familiar with ECH and its history: https://www.feistyduck.com/newsletter/issue_127_encrypted_client_hello_approved_for_publication https://www.feistyduck.com/newsletter/issue_127_encrypted_cl... In addition to the main RFC 9849, there is also RFC 9848 - "Bootstrapping TLS Encrypted ClientHello with DNS Service Bindings": https://datatracker.ietf.org/doc/rfc9848/ https://datatracker.ietf.org/doc/rfc9848/ There's an example of how it's used in the article.

fmajid 7mo ago
Thanks for the writeup, Ivan, I am a great fan of your work! Now we need to get Qualys to cap SSL Labs ratings at B for servers that don't support ECH. Also those that don't have HSTS and HSTS Preload while we're at it.
- ivanr 7mo ago
  Thanks! Sadly, SSL Labs doesn't appear to be actively maintained. I've noticed increasing gaps in its coverage and inspection quality. I left quite a while ago (2016) and can't influence its grading any more, sadly.
  - deleted 7mo ago
    [deleted]
  - crote 7mo ago
    Is there a well-maintained alternative to SSL Labs you can recommend?
    - ivanr 7mo ago
      Yes, there is! After I left SSL Labs, I built Hardenize, which was an attempt to go wider and handle more of network configuration, not just TLS and PKI. It covers a range of standards, from DNS, over email, TLS and PKI, and application security. Although Hardenize was a commercial product (it was acquired in 2022 by another company, Red Sift), it has a public report that's always been free. For example: https://www.hardenize.com/report/feistyduck.com https://www.hardenize.com/report/feistyduck.com The CSP inspection in Hardenize could use a refresh, but the TLS and PKI aspects are well maintained [at the time of writing].
    - Bender 7mo ago
      I use testssl.sh [1] mostly because I can test things not publicly accessible. [1] - https://github.com/testssl/testssl.sh https://github.com/testssl/testssl.sh
ignoramous 7mo ago
> There's an example of how it's used in the article A bit tricky in Go, but nothing too complicated. We implemented ECH in Aug 2024 for our DNS Android app and it has worked nicely since: https://github.com/celzero/firestack/blob/09b26631a2eac2cf9ceac38e17ce28fd61ae7319/intra/doh/doh.go#L331 https://github.com/celzero/firestack/blob/09b26631a2eac2cf9c...

by ivanr 7mo ago

fmajid 7mo ago

Thanks for the writeup, Ivan, I am a great fan of your work! Now we need to get Qualys to cap SSL Labs ratings at B for servers that don't support ECH. Also those that don't have HSTS and HSTS Preload while we're at it.

ivanr 7mo ago
Thanks! Sadly, SSL Labs doesn't appear to be actively maintained. I've noticed increasing gaps in its coverage and inspection quality. I left quite a while ago (2016) and can't influence its grading any more, sadly.
- deleted 7mo ago
  [deleted]
- crote 7mo ago
  Is there a well-maintained alternative to SSL Labs you can recommend?
  - ivanr 7mo ago
    Yes, there is! After I left SSL Labs, I built Hardenize, which was an attempt to go wider and handle more of network configuration, not just TLS and PKI. It covers a range of standards, from DNS, over email, TLS and PKI, and application security. Although Hardenize was a commercial product (it was acquired in 2022 by another company, Red Sift), it has a public report that's always been free. For example: https://www.hardenize.com/report/feistyduck.com https://www.hardenize.com/report/feistyduck.com The CSP inspection in Hardenize could use a refresh, but the TLS and PKI aspects are well maintained [at the time of writing].
  - Bender 7mo ago
    I use testssl.sh [1] mostly because I can test things not publicly accessible. [1] - https://github.com/testssl/testssl.sh https://github.com/testssl/testssl.sh

ignoramous 7mo ago

> There's an example of how it's used in the article A bit tricky in Go, but nothing too complicated. We implemented ECH in Aug 2024 for our DNS Android app and it has worked nicely since: https://github.com/celzero/firestack/blob/09b26631a2eac2cf9ceac38e17ce28fd61ae7319/intra/doh/doh.go#L331 https://github.com/celzero/firestack/blob/09b26631a2eac2cf9c...