{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"V prohl\u00ed\u017ee\u010di Firefox a Cloudflare byla povolena podpora ECH pro skryt\u00ed dom\u00e9ny v HTTPS provozu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Spole\u010dnost Mozilla ozn\u00e1mila zahrnut\u00ed podpory mechanismu ECH (Encrypted Client Hello) pro u\u017eivatele stabiln\u00ed verze Firefoxu, kter\u00fd pokra\u010duje ve v\u00fdvoji technologie ESNI (Encrypted Server Name Indication) a je ur\u010den k \u0161ifrov\u00e1n\u00ed informac\u00ed o parametrech TLS sezen\u00ed, jako je po\u017eadovan\u00e9 dom\u00e9nov\u00e9 jm\u00e9no. P\u016fvodn\u011b byl k\u00f3d pro pr\u00e1ci s ECH p\u0159id\u00e1n do vyd\u00e1n\u00ed Firefoxu 85, ale byl ve v\u00fdchoz\u00edm nastaven\u00ed vypnut. V Chromu za\u010dali postupn\u011b zav\u00e1d\u011bt podporu ECH po\u010d\u00ednaje verz\u00ed Chrome 115. <\/p>\n

Jeliko\u017e krom\u011b p\u0159ipojen\u00ed k serverem<\/a> \u00fanik informac\u00ed o po\u017eadovan\u00fdch dom\u00e9n\u00e1ch prob\u00edh\u00e1 prost\u0159ednictv\u00edm DNS, je pro plnou ochranu krom\u011b ECH nezbytn\u00e9 vyu\u017eit\u00ed technologie DNS over HTTPS nebo DNS over TLS pro \u0161ifrov\u00e1n\u00ed DNS provozu. Firefox nebude pou\u017e\u00edvat ECH bez aktivace DNS over HTTPS v nastaven\u00ed. Podporu ECH v prohl\u00ed\u017ee\u010di lze zkontrolovat na t\u00e9to str\u00e1nce. <\/p>\n

Jedn\u00edm z faktor\u016f pro v\u00fdchoz\u00ed aktivaci podpory ECH v Firefoxu byla ned\u00e1vn\u00e1 aktivace t\u00e9to funkce spole\u010dnost\u00ed Cloudflare ve sv\u00e9 s\u00edti pro doru\u010dov\u00e1n\u00ed obsahu. Z praktick\u00e9ho hlediska, jeliko\u017e jsou \u00fadaje o po\u017eadovan\u00fdch hostitel\u00edch p\u0159i pou\u017eit\u00ed ECH skryty p\u0159ed anal\u00fdzou, pro filtrov\u00e1n\u00ed a blokaci ne\u017e\u00e1douc\u00edch web\u016f, kter\u00e9 pou\u017e\u00edvaj\u00ed CDN Cloudflare, je nyn\u00ed pot\u0159eba bu\u010f blokovat celou s\u00ed\u0165 Cloudflare, blokovat v\u0161echny po\u017eadavky s ECH, nebo zav\u00e9st odposlech HTTPS pomoc\u00ed podvodn\u00fdch ko\u0159enov\u00fdch certifik\u00e1t\u016f na u\u017eivatelsk\u00e9m syst\u00e9mu. <\/p>\n

P\u016fvodn\u011b bylo pro organizaci pr\u00e1ce v\u00edce HTTPS web\u016f na jedn\u00e9 IP adrese pou\u017eito roz\u0161\u00ed\u0159en\u00ed TLS SNI, p\u0159i kter\u00e9m bylo jm\u00e9no po\u017eadovan\u00e9ho hostitele uvedeno v zpr\u00e1v\u011b ClientHello, p\u0159en\u00e1\u0161en\u00e9 p\u0159ed vytvo\u0159en\u00edm \u0161ifrovan\u00e9ho kan\u00e1lu. Tato vlastnost umo\u017enila na po\u010d\u00e1tku zpracov\u00e1n\u00ed p\u0159ipojen\u00ed rozd\u011blovat po\u017eadavky mezi virtu\u00e1ln\u00ed hostitele, ale tak\u00e9 umo\u017enila internetov\u00e9mu poskytovateli selektivn\u011b filtrovat HTTPS provoz a analyzovat, kter\u00e9 weby u\u017eivatel nav\u0161t\u011bvuje, co\u017e neumo\u017e\u0148ovalo dos\u00e1hnout pln\u00e9 d\u016fv\u011brnosti p\u0159i pou\u017eit\u00ed HTTPS. <\/p>\n

Aby vy\u0159e\u0161ili tento probl\u00e9m a vylou\u010dili \u00fanik informac\u00ed o dotazovan\u00e9m webu, bylo pozd\u011bji navr\u017eeno roz\u0161\u00ed\u0159en\u00ed ESNI, kter\u00e9 implementuje \u0161ifrov\u00e1n\u00ed dat s n\u00e1zvem hostitele. P\u0159i zav\u00e1d\u011bn\u00ed ESNI se uk\u00e1zalo, \u017ee navr\u017een\u00fd mechanismus nezahrnuje v\u0161echny mo\u017en\u00e9 zdroje \u00faniku dat o hostiteli, a jeho pou\u017eit\u00ed nebylo dostate\u010dn\u00e9 pro zaji\u0161t\u011bn\u00ed \u00fapln\u00e9 d\u016fv\u011brnosti HTTPS relac\u00ed. Zejm\u00e9na p\u0159i obnoven\u00ed d\u0159\u00edve nav\u00e1zan\u00e9 relace bylo jm\u00e9no dom\u00e9ny v otev\u0159en\u00e9 podob\u011b st\u00e1le uv\u00e1d\u011bno mezi parametry TLS roz\u0161\u00ed\u0159en\u00ed PSK (Pre-Shared Key). Krom\u011b toho pokusy o zaveden\u00ed ESNI odhalily probl\u00e9my s kompatibilitou a \u0161k\u00e1lovatelnost\u00ed, kter\u00e9 br\u00e1nily jeho \u0161irok\u00e9mu roz\u0161\u00ed\u0159en\u00ed. <\/p>\n

S ohledem na zji\u0161t\u011bn\u00e9 nedostatky byl vyvinut nov\u00fd univerz\u00e1ln\u00ed mechanismus ECH, kter\u00fd umo\u017e\u0148uje \u0161ifrov\u00e1n\u00ed parametr\u016f jak\u00fdchkoli TLS roz\u0161\u00ed\u0159en\u00ed. Technicky hlavn\u00edm rozd\u00edlem ECH od ESNI je to, \u017ee m\u00edsto jednotliv\u00fdch pol\u00ed se \u0161ifruje rovnou cel\u00e9 zpr\u00e1va ClientHello. ECH p\u0159edpokl\u00e1d\u00e1 rozd\u011blen\u00ed ClientHello na dv\u011b samostatn\u00e9 zpr\u00e1vy \u2014 \u0161ifrovanou zpr\u00e1vu ClientHelloInner (SNI Inner) a ne\u0161ifrovanou z\u00e1kladn\u00ed zpr\u00e1vu ClientHelloOuter (SNI Outer). V ne\u0161ifrovan\u00e9m SNI Outer jsou p\u0159ed\u00e1v\u00e1ny nezbytn\u00e9 neomezen\u00e9 \u00fadaje, jako je verze TLS a seznam pou\u017e\u00edvan\u00fdch \u0161ifrovac\u00edch algoritm\u016f, a tak\u00e9 celkov\u00e9 jm\u00e9no dom\u00e9ny, kter\u00e9 se nesetk\u00e1v\u00e1 se skute\u010dn\u00fdm jm\u00e9nem po\u017eadovan\u00e9 dom\u00e9ny. Nap\u0159\u00edklad pro v\u0161echny klienty Cloudflare bude v ne\u0161ifrovan\u00e9m SNI Outer uveden spole\u010dn\u00fd host \u201ecloudflare-ech.com\u201c, a skute\u010dn\u00e9 jm\u00e9no po\u017eadovan\u00e9ho hostitele bude p\u0159ed\u00e1v\u00e1no v \u0161ifrovan\u00e9m SNI Inner a nebude dostupn\u00e9 pro anal\u00fdzu.

\"V<\/center> <\/p>\n

ECH tak\u00e9 pou\u017e\u00edv\u00e1 jin\u00fd mechanismus distribuce kl\u00ed\u010de pro \u0161ifrov\u00e1n\u00ed \u2014 informace o ve\u0159ejn\u00e9m kl\u00ed\u010di se p\u0159ed\u00e1v\u00e1 v DNS z\u00e1znamech HTTPSSVC, nikoli v z\u00e1znamech typu TXT. Pro z\u00edsk\u00e1n\u00ed a \u0161ifrov\u00e1n\u00ed kl\u00ed\u010de se pou\u017eije autentizovan\u00e9 end-to-end \u0161ifrov\u00e1n\u00ed na z\u00e1klad\u011b mechanismu HPKE (Hybrid Public Key Encryption). ECH tak\u00e9 podporuje bezpe\u010dn\u00fd op\u011btovn\u00fd p\u0159enos kl\u00ed\u010de ze serveru, co\u017e m\u016f\u017ee b\u00fdt uplatn\u011bno v p\u0159\u00edpad\u011b rotace kl\u00ed\u010d\u016f. serveru<\/a> a pro \u0159e\u0161en\u00ed probl\u00e9m\u016f p\u0159i z\u00edsk\u00e1v\u00e1n\u00ed zastaral\u00fdch kl\u00ed\u010d\u016f z DNS cache.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Podpora ECH pro skr\u00fdv\u00e1n\u00ed dom\u00e9ny v HTTPS provozu byla aktivov\u00e1na ve Firefoxu a Cloudflare | ProHoster","description":"Spole\u010dnost Mozilla ozn\u00e1mila, \u017ee pro u\u017eivatele stabiln\u00ed v\u011btve Firefoxu zp\u0159\u00edstupn\u00ed podporu mechanismu ECH (Encrypted Client Hello), co\u017e pokra\u010duje ve v\u00fdvoji technologie ESNI (Encrypted Server Name Indication) a.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}