🔬 Evaluate ECH (Encrypted Client Hello) as an SNI-blocking countermeasure

[sepehrsadri]

What is ECH?

Encrypted Client Hello (ECH) encrypts the SNI field in TLS handshakes. This is the #1 field Iran's DPI uses to identify and block connections. If ECH works, SNI-based blocking becomes obsolete overnight.

Current Status (March 2026)

• Chrome: ECH support shipping (behind flag in some versions)
• Firefox: ECH enabled by default since Firefox 118
• Cloudflare: ECH support enabled for all domains
• Iran: Unknown blocking status — needs testing

Why This is Critical

If Iran can't see the SNI:

• VLESS Reality becomes undetectable (the SNI was the only weak point)

• CDN-based protocols no longer need clean IP rotation

• Domain fronting becomes unnecessary

• Simple VLESS+TLS is enough (no need for complex transports)

• Test curl --ech hard https://crypto.cloudflare.com/cdn-cgi/trace from Iran

• Test on Irancell, MCI, Rightel, Mokhaberat (fixed-line)

• Test with Firefox (has native ECH) connecting to CDN domains

• Test if ECH-enabled connections are blocked, throttled, or passed through

• Document results per ISP in a structured table

• If ECH works on even ONE ISP: immediately prioritize ECH-enabled configs

How to Test

# From a machine on a censored network:
# 1. Check if ECH is negotiated
curl -v --ech hard https://crypto.cloudflare.com/cdn-cgi/trace 2>&1 | grep -i ech

# 2. Test our own domain
curl -v --ech hard https://cdn.example.com 2>&1 | grep -i ech

# 3. Firefox: visit about:config → network.dns.echconfig.enabled = true
#    Then visit https://defo.ie/ech-check.php

References

• Cloudflare ECH blog
• ECH spec (RFC draft)
• RESEARCH-TOPICS.md — Topic 3b

---

Note on in-country testing. Measurement from inside a censored network is valuable, but this tracker is public: replying here to volunteer means self-identifying with a GitHub account. Please don't. Results are welcome via any channel you're comfortable with, and RIPE Atlas (already wired up in ripe-atlas-check.yml) gives a measurement path that puts no individual at risk.

[Katomoto]

Worth checking if this reproduces with a fresh install — some package managers cache broken versions.