tech · quantum risk
Is Encrypted Client Hello Quantum Proof? Network Security & PQC
Verdict
ECH improves privacy of TLS metadata but does not by itself make connections quantum-proof. Hybrid/PQC key exchange and certificate algorithms remain the core quantum migration work.
Overview
Encrypted Client Hello hides the server name and related ClientHello fields from passive on-path observers when correctly deployed.
Quantum adversaries who record classical handshakes still target key exchange, not only SNI. ECH and PQC solve different problems and should be planned together on modern stacks.
Middleboxes that require clear SNI will conflict with ECH—same class of operational issue as hybrid TLS rollout.
Cryptographic profile
- Signatures: TLS with ECH config (classical or hybrid KEM underneath), DNS HTTPS/SVCB records often used with ECH
- Hash: TLS transcript
- Public-key exposure: ECH protects metadata (SNI) classically; quantum risk still sits in the handshake KEM and certs.
What breaks
Mitigations
- Deploy ECH where privacy matters and clients support it
- Still pilot hybrid TLS for confidentiality against future CRQC
- Coordinate DNS HTTPS records and CDN/edge config
FAQ
Does ECH stop harvest-now-decrypt-later?
No. HNDL targets key exchange; ECH targets metadata visibility.
Need ECH for internal mTLS?
Often lower priority than certificate algorithm agility on internal meshes.
Key concepts (technical dictionary)
Terms used on this page — open a definition: