{"id":110431,"date":"2023-10-04T15:10:15","date_gmt":"2023-10-04T13:10:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike"},"modified":"2023-10-04T15:10:15","modified_gmt":"2023-10-04T13:10:16","slug":"v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","title":{"rendered":"St\u00f6d f\u00f6r ECH f\u00f6r att d\u00f6lja dom\u00e4nnamn i HTTPS-trafik har lagts till i Firefox och Cloudflare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Mozilla har meddelat att de inf\u00f6r st\u00f6d f\u00f6r mekanismen ECH (Encrypted Client Hello) f\u00f6r anv\u00e4ndarna av den stabila versionen av Firefox, vilket forts\u00e4tter att utveckla teknologin ESNI (Encrypted Server Name Indication) och syftar till att kryptera information om TLS-sessioner, s\u00e5som det beg\u00e4rda dom\u00e4nnamnet. Den ursprungliga koden f\u00f6r att st\u00f6dja ECH lades till i Firefox 85, men var inaktiverad som standard. I Chrome b\u00f6rjade st\u00f6d f\u00f6r ECH gradvis aktiveras fr\u00e5n och med version 115. <\/p>\n

Eftersom anslutningen till servern<\/a> l\u00e4ckage av information om beg\u00e4rda dom\u00e4ner sker genom DNS, kr\u00e4vs ut\u00f6ver ECH \u00e4ven anv\u00e4ndning av teknologin DNS \u00f6ver HTTPS eller DNS \u00f6ver TLS f\u00f6r att kryptera DNS-trafiken. Firefox kommer inte att anv\u00e4nda ECH utan aktivering av DNS \u00f6ver HTTPS i inst\u00e4llningarna. Du kan kontrollera st\u00f6d f\u00f6r ECH i webbl\u00e4saren p\u00e5 den h\u00e4r sidan. <\/p>\n

En av faktorerna till att st\u00f6d f\u00f6r ECH aktiverades som standard i Firefox var att Cloudflare f\u00f6r n\u00e5gra dagar sedan aktiverade st\u00f6d f\u00f6r ECH i sitt inneh\u00e5llsn\u00e4tverk. Fr\u00e5n ett praktiskt perspektiv, eftersom data om beg\u00e4rda v\u00e4rdar \u00e4r dolda fr\u00e5n analys n\u00e4r ECH anv\u00e4nds, kommer det nu att kr\u00e4vas att blockera hela Cloudflare-n\u00e4tverket, blockera alla f\u00f6rfr\u00e5gningar med ECH eller organsera avlyssning av HTTPS med hj\u00e4lp av falska rotcertifikat p\u00e5 anv\u00e4ndarsystemet f\u00f6r att filtrera och blockera o\u00f6nskade webbplatser som anv\u00e4nder Cloudflare CDN. <\/p>\n

Ursprungligen anv\u00e4ndes TLS-till\u00e4gget SNI f\u00f6r att m\u00f6jligg\u00f6ra drift av flera HTTPS-webbplatser p\u00e5 en och samma IP-adress, d\u00e4r namnet p\u00e5 den beg\u00e4rda v\u00e4rden angavs i ClientHello-meddelandet som skickades innan den krypterade kommunikationskanalen etablerades. Denna egenskap gjorde det m\u00f6jligt att f\u00f6rdela f\u00f6rfr\u00e5gningar mellan virtuella v\u00e4rdar i det tidiga skedet av anslutningsbehandlingen, men till\u00e4t \u00e4ven internetleverant\u00f6rer att selektivt filtrera HTTPS-trafik och analysera vilka webbplatser anv\u00e4ndaren bes\u00f6ker, vilket hindrade fullst\u00e4ndig konfidentialitet vid anv\u00e4ndning av HTTPS. <\/p>\n

F\u00f6r att l\u00f6sa detta problem och f\u00f6rhindra l\u00e4ckage av information om den beg\u00e4rda webbplatsen f\u00f6reslogs senare en utvidgning av ESNI, som implementerar kryptering av data med namn p\u00e5 v\u00e4rden. Under inf\u00f6randet av ESNI uppt\u00e4cktes att den f\u00f6reslagna mekanismen inte t\u00e4cker alla m\u00f6jliga k\u00e4llor till datal\u00e4ckage om v\u00e4rden, och dess till\u00e4mpning \u00e4r otillr\u00e4cklig f\u00f6r att s\u00e4kerst\u00e4lla fullst\u00e4ndig konfidentialitet vid HTTPS-sessioner. S\u00e4rskilt vid f\u00f6rnyelse av en tidigare etablerad session angavs dom\u00e4nnamnet i klartext bland parametrarna f\u00f6r TLS-till\u00e4gget PSK (Pre-Shared Key). Dessutom avsl\u00f6jade f\u00f6rs\u00f6ken med att implementera ESNI problem med kompatibilitet och skalbarhet, vilket hindrade spridningen av ESNI. <\/p>\n

Med de identifierade bristerna hos ESNI har en ny universell mekanism, ECH, utvecklats, som m\u00f6jligg\u00f6r kryptering av parametrar i alla TLS-till\u00e4gg. Tekniskt sett \u00e4r den huvudsakliga skillnaden mellan ECH och ESNI att ist\u00e4llet f\u00f6r att kryptera separata f\u00e4lt, krypteras hela meddelandet ClientHello p\u00e5 en g\u00e5ng. ECH inneb\u00e4r en uppdelning av ClientHello i tv\u00e5 separata meddelanden \u2014 det krypterade meddelandet ClientHelloInner (SNI Inner) och det okrypterade basmeddelandet ClientHelloOuter (SNI Outer). I det okrypterade SNI Outer \u00f6verf\u00f6rs data som inte p\u00e5verkar konfidentialiteten, s\u00e5som TLS-version och lista \u00f6ver anv\u00e4nda krypteringsmetoder, samt det allm\u00e4nna dom\u00e4nnamnet, vilket inte \u00f6verlappar med det faktiska beg\u00e4rda dom\u00e4nnamnet. Till exempel, f\u00f6r alla Cloudflare-kunder anges den allm\u00e4nna v\u00e4rden \"cloudflare-ech.com\" i det okrypterade SNI Outer, medan det faktiska beg\u00e4rda v\u00e4rdenamn \u00f6verf\u00f6rs i det krypterade SNI Inner och inte \u00e4r tillg\u00e4ngligt f\u00f6r analys.

\"St\u00f6d<\/center> <\/p>\n

ECH anv\u00e4nder ocks\u00e5 ett annat nyckeldistributionsschema f\u00f6r kryptering \u2014 informationen om den offentliga nyckeln \u00f6verf\u00f6rs i DNS-poster av typen HTTPSSVC, snarare \u00e4n i poster av typ TXT. F\u00f6r att erh\u00e5lla och kryptera nyckeln anv\u00e4nds autentiserad slut-till-slut-kryptering baserad p\u00e5 mekanismen HPKE (Hybrid Public Key Encryption). ECH st\u00f6djer \u00e4ven s\u00e4ker nyckel\u00f6verf\u00f6ring fr\u00e5n servern, vilket kan till\u00e4mpas vid nyckelrotation. servern<\/a> och f\u00f6r att l\u00f6sa problem vid h\u00e4mtning av f\u00f6r\u00e5ldrade nycklar fr\u00e5n DNS-cachen.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043b\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u0445 TLS-\u0441\u0435\u0430\u043d\u0441\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0435 \u0434\u043e\u043c\u0435\u043d\u043d\u043e\u0435 \u0438\u043c\u044f. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u043a\u043e\u0434 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441 ECH \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432 \u0432\u044b\u043f\u0443\u0441\u043a Firefox 85, \u043d\u043e \u0431\u044b\u043b \u043e\u0442\u043a\u043b\u044e\u0447\u0451\u043d \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u0412 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":110432,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110431","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47I Firefox och Cloudflare \u00e4r ECH-st\u00f6d aktiverat f\u00f6r att d\u00f6lja dom\u00e4ner i HTTPS-trafik | ProHoster","description":"F\u00f6retaget Mozilla har meddelat att det har aktiverat st\u00f6d f\u00f6r mekanismen ECH (Encrypted Client Hello) f\u00f6r anv\u00e4ndare av den stabila versionen av Firefox, som forts\u00e4tter utvecklingen av teknologin ESNI (Encrypted Server Name Indication).","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Firefox \u0438 Cloudflare \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0430 ECH \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u0434\u043e\u043c\u0435\u043d\u0430 \u0432 HTTPS-\u0442\u0440\u0430\u0444\u0438\u043a\u0435 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 Firefox \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 ECH (Encrypted Client Hello), \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ESNI (Encrypted Server Name Indication) \u0438.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/v-firefox-i-cloudflare-vklyuchena-podderzhka-ech-dlya-skrytiya-domena-v-https-trafike","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-04T13:10:16+00:00","article:modified_time":"2023-10-04T13:10:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"110431","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:44","updated":"2026-02-09 21:46:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110431","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=110431"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110431\/revisions"}],"predecessor-version":[{"id":160302,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/110431\/revisions\/160302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/110432"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=110431"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=110431"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=110431"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}