Skip to main content

4. Security Considerations

4. Security Considerations​

Storing cryptographic keys in files leaves them vulnerable if someone gains read access to the filesystem where they are stored. The same protection mechanisms used for a server's PEM-encoded HTTPS certificate private key should be used for the PEM ECH configuration.

The security considerations of [RFC9848] apply when retrieving an ECHConfigList from the DNS. For clarity, only the ECHConfigList is to be published in the DNS; the private key from an ECH PEM file MUST NOT be published in the DNS.