[Paper Review] Challenges in Adapting ECH in TLS for Privacy Enhancement over the Internet

Vinod S. Khandkar, Manjesh K. Hanawal+1 more|arXiv (Cornell University)|Jul 5, 2022

Internet Traffic Analysis and Secure E-voting4 citations

TL;DR

This paper demonstrates that deploying Encrypted ClientHello (ECH) in TLS 1.3 alone is insufficient for end-to-end privacy, as many Internet services still use TLS 1.2 for side-channels that leak service identity via plain-text SNI. The authors show that attackers can exploit these side-channels to throttle or block primary data channels, undermining ECH's privacy guarantees, and conclude that full privacy requires universal migration to TLS 1.3 with ECH across all connections.

ABSTRACT

Security and Privacy are crucial in modern Internet services. Transport Layer Security (TLS) has largely addressed the issue of security. However, information about the type of service being accessed goes in plain-text in the initial handshakes of vanilla TLS, thus potentially revealing the activity of users and compromising privacy. The ``Encrypted ClientHello'' or ECH overcomes this issue by extending TLS 1.3 where all of the information that can potentially reveal the service type is masked, thus addressing the privacy issues in TLS 1.3. However, we notice that Internet services tend to use different versions of TLS for application data (primary connection/channel) and supporting data (side channels) such as scheduling information extit{etc.}. %, during the active session. Although many internet services have migrated to TLS 1.3, we notice that it is only true for the primary connections which do benefit from TLS 1.3, while the side-channels continue to use lower version of TLS (e.g., 1.2) %which do not support ECH and continue to leak type of service accessed. We demonstrate that privacy information leaked from the side-channels can be used to affect the performance on the primary channels, like blocking or throttling specific service on the internet. Our work demonstrates that adapting ECH on primary channels alone is not sufficient to prevent the privacy leaks and attacks on primary channels. Further, we demonstrate that it is necessary for all of the associated side-channels also to migrate to TLS 1.3 and adapt ECH extension in order to offer complete privacy preservatio

Motivation & Objective

• To investigate whether ECH in TLS 1.3 fully mitigates privacy leaks in modern Internet services.
• To identify and analyze the use of side-channels in popular services that still use TLS 1.2 despite primary channels using TLS 1.3.
• To demonstrate how attackers can exploit plain-text SNI in side-channels to compromise the privacy and performance of primary channels protected by ECH.
• To argue that complete privacy protection requires ECH deployment across all connections, including side-channels, not just primary channels.

Proposed method

• Conducted network traffic analysis on popular services like Netflix, Primevideo, and YouTube using a custom in-house monitoring tool.
• Identified side-channels by analyzing SNI patterns and traffic characteristics such as data volume and session duration.
• Performed controlled experiments by blocking side-channels to observe the impact on primary channel performance and user experience.
• Measured changes in data rates, content loading (e.g., thumbnails, ads), and session behavior under side-channel disruption.
• Evaluated the feasibility of distinguishing primary from side-channels using metrics like data volume and TLS session length.
• Demonstrated that even with ECH protecting the primary channel, side-channel leaks enable targeted attacks on the primary channel.

Experimental results

Research questions

• RQ1 To what extent do modern Internet services use TLS 1.3 with ECH on primary channels while relying on TLS 1.2 for side-channels?
• RQ2 Can plain-text SNI in TLS 1.2 side-channels be used to identify and target specific services for throttling or blocking?
• RQ3 How does blocking side-channels affect the performance and user experience of primary channels protected by ECH?
• RQ4 What metrics can reliably distinguish primary channels from side-channels in services with mixed TLS versions?
• RQ5 Is ECH deployment on primary channels alone sufficient to ensure end-to-end privacy in the presence of unencrypted side-channels?

Key findings

• Many popular services, including Netflix, Primevideo, and YouTube, use TLS 1.3 with ECH on primary channels but rely on TLS 1.2 for side-channels that carry scheduling, ad, or thumbnail data.
• Side-channels using TLS 1.2 expose SNI in plain text, enabling attackers to identify the service and target its primary channel without needing to decrypt the ECH-protected handshake.
• Blocking side-channels results in degraded user experience—e.g., YouTube continues playing at 4–5 Mbps but loses access to thumbnails and ads, indicating side-channels carry non-primary content.
• Primary channels can be distinguished from side-channels by their significantly higher data volume and longer session durations, even when using different TLS versions.
• The performance of primary channels is directly affected when side-channels are blocked, proving that side-channel privacy leaks can be exploited to disrupt primary service delivery.
• Current ECH deployment is insufficient for complete privacy, as attackers can bypass ECH protection by targeting unencrypted side-channels, undermining the privacy goals of TLS 1.3.