I hacked some ECH (encrypted client hello) support in the JDK network stack the other day (in TLS 1.3).
https://github.com/johanvos/jdk/tree/ech2
Follow
@johanvos very cool! Do you have any more information about how far you got with it? By the way, we're part of the https://defo.ie/ project to help people implement ECH. Reach out if you get stuck: https://social.librem.one/@guardianproject/111392426169230785
@guardianproject Oh nice. I used defo.ie for testing :) It works as in:
* inner ECH is sent correctly inside outer ECH, CFS forwards inner ECH to origin server, which replies with SH, and client processes that, TLS session starts.
Not implemented: ECH Config retry and Grease.
ECH is a fantastic standard. I wish there were more providers with a CFS (in split mode) though...