Is Encrypted Client Hello supported?

[Oakchris1955]

It seems like encrypted client hello (ECH) isn't configured anywhere for any of the supported TLS libraries. Is this intentional or did just no one bother adding support for it? If the later, I could help with that.

[seanmonstar]

No one has bothered to figure out how to add it. You're welcome to consider and propose what configuration should look like 🤓

[Oakchris1955]

I see that Server Name Indication is already supported, so it only makes sense to support ECH too. I don't have the time to do this right not, but when I will, I will open a PR.

[Restia-Ashbell]

Rustls already supports this. You can pass in a TLS config with ECH enabled via tls_backend_preconfigured. Perhaps reqwest could provide a dedicated API for this use case, and also allow automatically querying ECH config through a custom DNS resolver.

[Oakchris1955]

Perhaps reqwest could provide a dedicated API for this use case, and also allow automatically querying ECH config through a custom DNS resolver.

That's what I am having in my mind too, since reqwest also offers the option to use other TLS libraries than rustls

[0x676e67]

Here’s an example library for ECH client configuration and usage with rustls. Technically, adapting it isn’t difficult, but we need to abstract a set of APIs to let users implement their own ECH-Config fetching:
https://crates.io/crates/echw