DEfO Project

Developing ECH for OpenSSL (DEfO)

The encrypted ClientHello (ECH) mechanism (RFC 9849) is a way to plug a few privacy-holes that remain in the Transport Layer Security (TLS) protocol that's used as the security layer for the web. OpenSSL is a widely used library that provides an implementation of the TLS protocol. The DEfO project has developed an implementation of ECH for OpenSSL, and proof-of-concept implementations of various clients and servers that use OpenSSL as a demonstration and for interoperability testing. DEfO was funded by the Open Technology Fund (OTF). Tolerant Networks Ltd. and people from the Guardian Project did the work in DEfO.

OTF funding for DEfO finished in November 2026, but the team continues to try help other projects with integrating and using ECH.

This organisation is where we keep our various ECH-enabled code repos and our ech-dev-utils repo that has HOWTOs, test scripts and other ancillary ECH developer content. That's the place to start if you want to play with these ECH-enabled packages.

Now that ECH has been upstreamed to all targets, the code here is almost identical to upstream, with the following additional features only supported here:

ECH split mode is supported here in the OpenSSL, haproxy and nginx packages
The OpenSSL code here supports use of X-Wing as an ECH KEM, in order to demonstrate use of post-quantum algorithms with ECH. That works with curl as built here (using that OpenSSL build) but also with golang clients.

Builder/CI status for repos

The ECH APIs used in these repos are those agreed with OpenSSL maintainers, which will be part of the OpenSSL 4.0 release, and (other than for split-mode ECH) have been upstreamed into the OpenSSL master branch.

For each of these ECH-enabled repos, we've added a 'builder' workflow (run daily and after a push) that attempts to merge our code with the latest upstream and that then does a build and a basic test. We expect these to fail from time to time as changes occur in the upstream packages. When that happens, there's a red badge below and we usually fix those within a couple of days by rebasing the repos here with the relevant upstream. Note that a red badge doesn't mean that our ECH-enabled code is broken, just that some manual intervention is needed to bring us back up to the bleeding edge with the upstream package.

We have now upstreamed ECH shared-mode code to the OpenSSL project and we've also upstreamed ECH code to curl, lighttpd, apache2, haproxy and nginx.

For openssl, haproxy and nginx, our ECH shared-mode code has been upstreamed, but the defo-project repos here also support ECH split-mode so we also have a daily check that those build and pass the basic ECH test.

As of 2026-09-17 we've updated these builds to reflect the latest upstreams.

For packages where our ECH code has already been upstreamed, we have checks that those build and pass a basic ECH test. Those are currently only run after a git push.