Encrypted Client Hello

[Seirdy]

Currently, information such as the domain leaks through TLS-encrypted traffic since SNI information is unencrypted. With Encrypted Client Hello, the whole Client Hello—including SNI—is encrypted using with public keys stored in DNS HTTPS resource records.

Combined with some measure to confuse traffic analysis (such as record padding accessible via OpenSSL commands), this ensures that eavesdroppers can’t discern the service being used on the target IP. It closes a major privacy hole in TLS.

This has been implemented in H2O and Cloudflare on the server side, and in Firefox and Chromium on the client-side. BoringSSL should offer support.