crypto/tls: support Encrypted Client Hello in clients

[dennisjackson]

Encrypted Client Hello is a new privacy feature that is finishing standardization at the IETF. ECH is a big step forward for the internet, because it removes one of the last places where the websites users visit is leaked to the network in plaintext.

ECH has already been implemented in NSS and BoringSSL, and an experimental fork is available for OpenSSL.

Firefox has launched support for ECH, Chrome is expected to launch support imminently and Cloudflare have rolled out server-side support globally.

Support in crypto/tls would need to be both for servers and clients. Lack of support is currently blocking Caddy from shipping ECH.

cc @FiloSottile

[dennisjackson]

I should add that Cloudflare's fork of crypto/tls has ECH support in case that's of interest to the official Golang maintainers.

[ianlancetaylor]

CC @golang/security

[rolandshoemaker]

We were just talking about this today. It seems like a reasonable thing to implement given the direction the ecosystem is going. I think we're likely to prioritize client support first, but given the existence of stuff like Caddy, server support also seems reasonable.

I think we'll want to design the API such that we can internally wire up the net/http client to automatically populate the necessary information via e.g. the DNS discovery mechanism (or manually configure it by passing a tls.Config).

[mholt]

Thank you Roland 😁 Thousands of users appreciate that!

[pitapita012]

Any updates?

[DeltaLaboratory]

Is there work being done somewhere on this proposal or will start working on this proposal after ECH has been fully standardized to RFC?