On the Importance of Encrypted-SNI (ESNI) to Censorship Circumvention

With the increasing use of TLS encryption over web traffic, censors increasingly deploy SNI filtering to be able to censor encrypted connections. Specifically, a censor can identify the web domain being accessed by a client via the SNI extension in the TLS ClientHello message. In response, in August 2018, a new extension called ESNI (Encrypted-SNI) is proposed for TLS 1.3, aiming at preventing such server name leakage. In this paper, we study the implications of ESNI for censorship. We first characterize SNI-based censorship in China by measuring its prevalence and effectiveness. We outline the assisting role played by SNI-filtering in censorship by comparing it with other commonly used censorship techniques. We then measure the extent of deployment of ESNI, and discuss ESNI’s promise in helping censorship circumvention tools. We monitor the censorship associated with ESNI within 14 geographic regions around the world. Based on our measurements, we discuss the key factors to the potential success of ESNI for censorship evasion and the upcoming challenges.