https://nalar.dev/tags/encrypted-clienthello/ Recent content in Encrypted ClientHello on Nalar Hugo en-us Thu, 17 Sep 2026 00:00:00 +0700 https://nalar.dev/encrypted-clienthello-separates-public-routing-from-private-tls-identity/ Thu, 17 Sep 2026 00:00:00 +0700 https://nalar.dev/encrypted-clienthello-separates-public-routing-from-private-tls-identity/ <h1 id="encrypted-clienthello-separates-public-routing-from-private-tls-identity">Encrypted ClientHello Separates Public Routing From Private TLS Identity</h1> <p>TLS 1.3 encrypts most handshake messages, yet a conventional connection still exposes the initial <code>ClientHello</code>. That message can contain Server Name Indication, allowing an on-path observer to associate a connection with a requested hostname before application traffic is protected.</p> <p>Encrypted ClientHello, standardized in RFC 9849, changes that boundary. The client constructs a private <code>ClientHelloInner</code> containing the service-specific parameters and wraps it inside a public <code>ClientHelloOuter</code>. The outer message remains usable by the client-facing infrastructure, while sensitive inner fields are protected with Hybrid Public Key Encryption.</p>