@techreport{sullivan-tls-signed-ech-updates-02,
    number =    {draft-sullivan-tls-signed-ech-updates-02},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-sullivan-tls-signed-ech-updates/02/},
    author =    {Nick Sullivan and Dennis Jackson and Alessandro Ghedini},
    title =     {{Authenticated ECH Config Distribution and Rotation}},
    pagetotal = 19,
    year =      2026,
    month =     jul,
    day =       6,
    abstract =  {Encrypted ClientHello (ECH) requires clients to have the server's ECH configuration before connecting. Currently, when ECH fails, servers can send updated configurations but clients cannot authenticate them unless the server has a valid certificate for the public name, limiting deployment flexibility. This document specifies a new mechanism for authenticating ECH configurations. Servers include additional information in their initial ECH configurations, which enables clients to authenticate updated configurations without relying on a valid certificate for the public name.},
}