ech_config

ech_config is Ruby implementation of Encrypted ClientHello Configuration.

ech_config supports 0xfe0b ~ 0xfe0d ECHConfig.version.

The gem is available at rubygems.org. You can install with:

$ gem install ech_config

require 'ech_config'

echconfigs = ECHConfig.decode_vectors(octet)

Clients MUST ignore an ECHConfig that carries an unsupported mandatory ECHConfig extension (RFC 9849 4.2). This gem decodes every extension it does not know as UnknownExtension, so:

echconfigs.reject do |echconfig|
  echconfig.echconfig_contents.extensions.any_unsupported_mandatory?
end

ech_authinfo and ech_auth (draft-sullivan-tls-signed-ech-updates-02) are decoded as ECHAuthInfo / ECHAuth. ECHConfig#to_be_signed returns the bytes an ech_auth signature is computed over; validating not_after, trusted_keys and the signature itself is left to the caller.

ech_auth = echconfig
           .echconfig_contents
           .extensions[ECHConfig::ECHConfigContents::Extensions::ECHAuth::TYPE]
OpenSSL::PKey.read(ech_auth.spki)
             .verify(nil, ech_auth.signature, echconfig.to_be_signed)

The draft leaves both extension types unassigned (TBD1 / TBD2), so ech_config uses placeholder codepoints until IANA assigns them.

The gem is available as open source under the terms of the MIT License.