Um dos fatores que levou \u00e0 ativa\u00e7\u00e3o do suporte ECH por padr\u00e3o no Firefox foi a inclus\u00e3o, h\u00e1 alguns dias, do suporte ECH pela Cloudflare em sua rede de entrega de conte\u00fado. Na pr\u00e1tica, como os dados sobre os hosts solicitados s\u00e3o ocultados da an\u00e1lise ao aplicar o ECH, para filtrar e bloquear sites indesejados que usam a CDN da Cloudflare, agora ser\u00e1 necess\u00e1rio bloquear toda a rede da Cloudflare, bloquear todos os pedidos com ECH ou organizar a intercepta\u00e7\u00e3o de HTTPS com certificados raiz falsos no sistema do usu\u00e1rio. <\/p>\n
Inicialmente, para organizar o funcionamento de v\u00e1rios sites HTTPS em um \u00fanico endere\u00e7o IP, foi aplicado a extens\u00e3o TLS SNI, onde o nome do host solicitado era indicado na mensagem ClientHello, enviada antes da instala\u00e7\u00e3o do canal de comunica\u00e7\u00e3o criptografado. Essa caracter\u00edstica permitia, nas fases iniciais de processamento da conex\u00e3o, distribuir os pedidos entre hosts virtuais, mas tamb\u00e9m permitia ao provedor de internet filtrar seletivamente o tr\u00e1fego HTTPS e analisar quais sites o usu\u00e1rio acessa, o que n\u00e3o permitia alcan\u00e7ar plena confidencialidade ao usar HTTPS. <\/p>\n
Para resolver esse problema e evitar o vazamento de informa\u00e7\u00f5es sobre o site solicitado, foi posteriormente proposto a extens\u00e3o ESNI, que implementa a criptografia de dados com o nome do host. Durante a implementa\u00e7\u00e3o do ESNI, ficou claro que o mecanismo proposto n\u00e3o cobre todas as poss\u00edveis fontes de vazamento de dados sobre o host e sua aplica\u00e7\u00e3o \u00e9 insuficiente para garantir a completa confidencialidade das sess\u00f5es HTTPS. Em particular, ao retomar uma sess\u00e3o anteriormente estabelecida, o nome de dom\u00ednio em texto claro ainda continuava a ser indicado entre os par\u00e2metros da extens\u00e3o TLS PSK (Pre-Shared Key). Al\u00e9m disso, as tentativas de implementar o ESNI revelaram problemas de compatibilidade e escalabilidade que dificultavam a ado\u00e7\u00e3o generalizada do ESNI. <\/p>\n
Considerando as defici\u00eancias identificadas, o ESNI foi substitu\u00eddo por um novo mecanismo universal chamado ECH, que permite a criptografia dos par\u00e2metros de qualquer extens\u00e3o TLS. A principal diferen\u00e7a t\u00e9cnica entre ECH e ESNI \u00e9 que, em vez de campos separados, toda a mensagem ClientHello \u00e9 criptografada de uma s\u00f3 vez. O ECH envolve a divis\u00e3o do ClientHello em duas mensagens distintas \u2014 a mensagem criptografada ClientHelloInner (SNI Inner) e a mensagem base n\u00e3o criptografada ClientHelloOuter (SNI Outer). No SNI Outer n\u00e3o criptografado, s\u00e3o transmitidos dados que n\u00e3o comprometem a confidencialidade, como a vers\u00e3o do TLS e a lista de cifras utilizadas, al\u00e9m do nome do dom\u00ednio que n\u00e3o coincide com o nome do dom\u00ednio solicitado. Por exemplo, para todos os clientes da Cloudflare, o SNI Outer n\u00e3o criptografado indica o host comum \"cloudflare-ech.com\", enquanto o nome real do host solicitado \u00e9 transmitido no SNI Inner criptografado e n\u00e3o est\u00e1 dispon\u00edvel para an\u00e1lise.
![\"O](\"\/wp-content\/uploads\/2023\/10\/225939d0c0a33fb32a262a3e104079dc.png\")
<\/center> <\/p>\nO ECH tamb\u00e9m utiliza um esquema diferente de distribui\u00e7\u00e3o de chaves para criptografia \u2014 as informa\u00e7\u00f5es sobre a chave p\u00fablica s\u00e3o transmitidas nos registros DNS HTTPSSVC, e n\u00e3o em registros do tipo TXT. Para obter e criptografar a chave, \u00e9 utilizada a criptografia de ponta a ponta autenticada com base no mecanismo HPKE (Hybrid Public Key Encryption). O ECH tamb\u00e9m suporta a retransmiss\u00e3o segura da chave a partir do servidor, o que pode ser aplicado em casos de rota\u00e7\u00e3o de chaves. servidor<\/a> e para resolver problemas na obten\u00e7\u00e3o de chaves obsoletas do cache DNS. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47O Firefox e o Cloudflare ativaram o suporte a ECH para ocultar o dom\u00ednio no tr\u00e1fego HTTPS | ProHoster","description":"A Mozilla anunciou a inclus\u00e3o para os usu\u00e1rios da vers\u00e3o est\u00e1vel do Firefox do suporte ao mecanismo ECH (Encrypted Client Hello), que continua o desenvolvimento da tecnologia ESNI (Encrypted Server Name Indication) e.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"