# Encrypted Client Hello Is Coming: A View from Passive Measurements
## 4 Results
### Encrypted Client Hello in QUIC Flows  
We now focus on the Encrypted Client Hello feature and study its adoption using the QUIC-Outgoing dataset. Specifically, for each QUIC connection in the data, the Tstat passive meter seeks the ECH extension in the \"Initial\" packet of each QUIC connection and records its in-clear fields. Among all QUIC flows, 59% carry an ECH extension, which is quite a surprising proportion. Not only do most clients support ECH, but they also include an ECH extension in most of their QUIC initial packets. Note that the ECH standard mandates clients to include an ineffective ECH, even when the server does not support it--called GREASE ECH (see [20]). Its goal is to avoid protocol ossification and traffic differentiation by middleboxes. In the following, we investigate the features of ECH extensions and the frequency of genuine and GREASE ones. Indeed, despite QUIC's full encryption since the initial packet, the structure and size of the ECH extension in the Client Hello remain accessible for passive observation. This makes it possible to distinguish between genuine ECH and GREASE ECH. As detailed in Section 2, ECH Client Hello packets include an outer, in-clear SNI called \"ECH Public Name\" that acts as a placeholder. Cloudflare, the only current adopter of ECH, publicly states that flows directed to its servers use the cloudflare-ech.com ECH Public Name ([[https://developers.cloudflare.com/ssl/edge-certificates/ech/](https://developers.cloudflare.com/ssl/edge-certificates/ech/)]([https://developers.cloudflare.com/ssl/edge-certificates/ech/](https://developers.cloudflare.com/ssl/edge-certificates/ech/)), accessed on 23 July 2025). To study the use of ECH in real-world traffic, Figure 6 shows the distribution of ECH extension size in QUIC flows, focusing on the top 10 ASes by traffic volume. We identify 6 dominant extension sizes, each corresponding to a GREASE value (in decimal format). These 6 values are consistently used across all ASes, except for Cloudflare, which additionally employs value 154, which is, however, still one of the 16 GREASE values recommended by the standard. Indeed, recall that the only AS (partially) supporting ECH is Cloudflare, while all ECH extensions in flows to other ASes are certainly GREASE. Figure 5: Percentage of HTTPS DNS requests followed or preceded by A and/or AAAA queries for the same domain by the same client (DNS-Incoming dataset). Less frequent extension sizes are grouped into the \"Other\" category in black. This group includes the subset of actual valid ECH exchanges, which account for 1.5% of all ECH flows and are uniquely directed to the ECH Public Name cloudflare-ech.com, exclusively served by the Cloudflare AS. Overall, although most QUIC flows include an ECH, only a fraction (1.96%) of those directed to Cloudflare do include a valid one, while all the other are GREASE ones. To conclude our analysis of the ECH extension, in Figure 7, we present the cumulative distribution of the size (in bytes) of the QUIC ECH extensions. The x-axis indicates the size of the ECH extension, while the y-axis shows the cumulative distribution function (CDF). The solid red line represents flows carrying a valid ECH extension, which we identify from the outer SNI, which reports the domain cloudflare-ech.com, whereas the dashed blue line refers to flows with a GREASE ECH extension. We observe a clear separation between the two distributions. Flows with actual ECH usage have sizes tightly concentrated between 150 and 180 bits. In contrast, flows without ECH exhibit a much broader and more irregular distribution, ranging from values below 50 bits up to 250 bits. Thus, we observe how the size of the GREASE ECH does not resemble that of the real ones; for instance, many real ECHs have a size of 154 Bytes, while this value never appears for GREASE ECHs. This entails that, although GREASE ECH can help prevent protocol ossification, middleboxes may still leverage the extension size to distinguish between real and GREASE ECH.