Privacy-Enhanced Mail (PEM) File Format for Encrypted ClientHello (ECH)
Extracted elements (14)
A standard PEM file format for ECH key pairs was created because TLS servers can be built with different TLS libraries. Having a common format — analogous to what RFC 7468 provides for other structures — enables interoperability between key managers and TLS server implementations.
ECH key pairs need to be periodically regenerated by a key manager and then configured into potentially heterogeneous TLS servers. This PEM format provides a common interchange format across different TLS library implementations to support that operational workflow.
Any content after the PEM encoded ECHConfigList SHOULD be ignored by implementations.
The private key from an ECH PEM file MUST NOT be published in the DNS; only the ECHConfigList is to be published there.
The private key MUST be encoded as a PKCS #8 PrivateKey as defined in RFC 7468.
The public and private keys MUST both be PEM encoded per RFC 7468.
The public key(s) MUST be the base64-encoded form (RFC 4648, Section 4) of an ECHConfigList value that can be published in the DNS using an HTTPS RR.
The string "ECHCONFIG" MUST be used in the PEM file delimiter for the public key portion of the ECH PEM file.
When a private key is present in the PEM ECH file, the ECHConfigList MUST contain an ECHConfig that matches the private key.
A PEM ECH file contains zero or one private key and one encoded ECHConfigList. The file is the concatenation of the PEM-encoded private key (if present) followed by the PEM-encoded public key(s) as an ECHConfigList.
ECHConfig values within an ECHConfigList appear in decreasing order of preference, consistent with RFC 9849. The ECHConfigList may contain more than one ECHConfig if those values contain different extensions or different public_name values.
TLS servers may configure multiple ECH PEM file names; for example, only a subset of ECHConfigList values from those files may be used as the retry_configs value in the ECH fallback scenario. In that case, retry_configs might contain different public keys.
Storing cryptographic keys in files leaves them vulnerable should anyone gain read access to the filesystem. The same protection mechanisms used for a server's PEM-encoded HTTPS certificate private key MUST be applied to the PEM ECH configuration.
The security considerations of RFC 9848 apply when retrieving an ECHConfigList from the DNS, covering risks associated with bootstrapping TLS ECH via DNS Service Bindings.