{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"V Firefox in Cloudflare je podpora ECH vklju\u010dena za skrivanje domene v HTTPS prometu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Podjetje Mozilla je napovedalo, da bo za uporabnike stabilne razli\u010dice Firefox vklju\u010dilo podporo za mehanizem ECH (Encrypted Client Hello), ki nadaljuje razvoj tehnologije ESNI (Encrypted Server Name Indication) in je namenjena \u0161ifriranju informacij o parametrih TLS seji, kot je zahtevano ime domene. Izvorno je bil koda za delovanje z ECH dodan v izdajo Firefox 85, vendar je bila privzeto onemogo\u010dena. V Chromu je podpora ECH za\u010dela postopoma vklju\u010devati z izdajo Chrome 115. <\/p>\n

Ker poleg povezave z serverom<\/a> uhajanje podatkov o zahtevanih domenah poteka preko DNS, je za popolno za\u0161\u010dito poleg ECH potrebna uporaba tehnologije DNS over HTTPS ali DNS over TLS za \u0161ifriranje DNS prometa. Firefox ne bo uporabljal ECH brez vklju\u010ditve DNS over HTTPS v nastavitvah. Podporo ECH v brskalniku lahko preverite na tej strani. <\/p>\n

Eden od dejavnikov, ki je privedel do privzete aktivacije podpore ECH v Firefox, je bilo vklju\u010ditev pred nekaj dnevi s strani podjetja Cloudflare podpore ECH v svoji mre\u017ei za dostavo vsebin. S prakti\u010dnega vidika, saj so podatki o zahtevanih gostiteljih pri uporabi ECH skriti pred analizo, bo za filtriranje in blokiranje ne\u017eelenih spletnih mest, ki uporabljajo CDN Cloudflare, zdaj potrebno blokirati celo omre\u017eje Cloudflare, blokirati vse zahteve z ECH ali organizirati prestrezanje HTTPS s pomo\u010djo ponarejenih korenskih potrdil na uporabni\u0161kem sistemu. <\/p>\n

Izvorno je bilo za organizacijo dela ve\u010d HTTPS spletnih mest na eni IP naslovu uporabljeno TLS raz\u0161iritev SNI, pri \u010demer je bilo ime zahtevane gostiteljske domene navedeno v sporo\u010dilu ClientHello, poslanem pred vzpostavitvijo \u0161ifriranega komunikacijskega kanala. Tak\u0161na lastnost je omogo\u010dila na zgodnji stopnji obdelave povezav razporejanje zahtevkov po virtualnih gostiteljih, omogo\u010dila pa je tudi na strani internetnega ponudnika izbirno filtriranje HTTPS prometa in analizo, katera spletna mesta odpirajo uporabniki, kar ni omogo\u010dilo dosego popolne zaupnosti pri uporabi HTTPS. <\/p>\n

Da bi re\u0161ili ta problem in prepre\u010dili uhajanje informacij o zahtevanem spletnem mestu, je bilo kasneje predlagano \u0161iritev ESNI, ki izvaja \u0161ifriranje podatkov z imenom gostitelja. Med uvajanjem ESNI so ugotovili, da predlagani mehanizem ne zajema vseh mo\u017enih virov uhajanja podatkov o gostitelju in njegova uporaba ni dovolj za zagotavljanje popolne zasebnosti HTTPS sej. Zlasti je pri obnovitvi prej vzpostavljene seje ime domene v odprti obliki \u0161e vedno bilo navedeno med parametri raz\u0161iritve TLS PSK (Pre-Shared Key). Poleg tega so poskusi uvajanja ESNI razkrili te\u017eave s zdru\u017eljivostjo in skalabilnostjo, ki so ovirale splo\u0161no sprejetje ESNI. <\/p>\n

Ob upo\u0161tevanju ugotovljenih pomanjkljivosti je bil razvit nov univerzalni mehanizem ECH, ki omogo\u010da \u0161ifriranje parametrov vseh raz\u0161iritev TLS. Tehni\u010dno je glavna razlika med ECH in ESNI v tem, da se namesto posameznih polj \u0161ifrira celotna sporo\u010dilo ClientHello. ECH predvideva lo\u010devanje ClientHello na dva lo\u010dena sporo\u010dila \u2014 \u0161ifrirano sporo\u010dilo ClientHelloInner (SNI Inner) in neza\u0161ifrirano osnovno sporo\u010dilo ClientHelloOuter (SNI Outer). V neza\u0161ifriranem SNI Outer se prena\u0161ajo podatki, ki ne ogro\u017eajo zaupnosti, kot so razli\u010dica TLS in seznam uporabljenih \u0161ifrov, pa tudi skupno ime domene, ki ne sovpada z dejanskim imenom prejetega domene. Na primer, za vse stranke Cloudflare se v neza\u0161ifriranem SNI Outer navede skupni gostitelj \u201ecloudflare-ech.com\u201c, dejansko ime prejetega gostitelja pa se prenese v \u0161ifriranem SNI Inner in ni dostopno za analizo.

\"V<\/center> <\/p>\n

ECH uporablja tudi druga\u010dno shemo distribucije klju\u010da za \u0161ifriranje \u2014 informacije o javnem klju\u010du se prena\u0161ajo v DNS zapisih HTTPSSVC, ne pa v zapisih tipa TXT. Za pridobivanje in \u0161ifriranje klju\u010da se uporablja overjena kon\u010dna \u0161ifriranja na osnovi mehanizma HPKE (Hibridna javna klju\u010dna \u0161ifriranja). ECH prav tako podpira varno ponovno prena\u0161anje klju\u010da s stre\u017enika, kar se lahko uporablja v primeru rotacije klju\u010dev. stre\u017enikom<\/a> in za re\u0161evanje te\u017eav pri pridobivanju zastarelih klju\u010dev iz predpomnilnika DNS.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Firefox in Cloudflare sta vklju\u010dila podporo ECH za skrito domeno v HTTPS prometu | ProHoster","description":"Podjetje Mozilla je napovedalo vklju\u010ditev podpore za mehanizem ECH (Encrypted Client Hello) za uporabnike stabilne razli\u010dice Firefox, kar nadaljuje razvoj tehnologije ESNI (Encrypted Server Name Indication) in.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}