Generate ECH keypair with config after key
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 38.1k
- Forks
- 4.6k
- Avg merge
- 19d 15h
- Merged PRs (30d)
- 1
Description
The output of sing-box generate ech-keypair contains the ECH config followed by the private key. A file in this format cannot be used for tls.ech.key_path; it results in the following error:
FATAL[0000] create service: initialize inbound[0]: parse ECH keys: invalid ECH keys pem
However, the file parses if the file contains the private key first. Should the order be swapped in the output?
I was also looking at the draft RFC 9934, which uses this order, however it uses different PEM file delimiters than sing-box.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the sing-box generate ech-keypair command and compare its output with the PEM parsing in common/tls/ech_shared.go at the linked lines. Reproduce the tls.ech.key_path failure with the generated file, then verify that the output order is accepted by the parser and matches the intended ECH format.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100