ECH Without Padding Is a Lookup Table

by Danila Vershinin, September 10, 2026

ECH hides the SNI, yet every vhost we measured, 8 of 8 in the lab and 5 of 5 in production, was identifiable from server handshake record sizes alone. Here is the measured leak, and the one-directive NGINX module that closes it.