OHTTP
A network protocol standardized by the IETF in RFC 9458. It decouples user identity from request content by routing traffic through an intermediary relay and gateway inserted between the client and the target server, providing privacy protection. The protocol relies on HPKE for its encryption layer.
Timeline (last 90 days)
Oblivious HTTP (OHTTP) is a network protocol designed to decouple user identity from request content; by inserting a relay and a gateway between the client and the server, it ensures that no single entity can simultaneously know both the client's IP and the request content.
In the OHTTP architecture, the relay can see the client's IP but cannot see the encrypted request content, while the gateway can decrypt and process the request content but can only see the relay's IP.
OHTTP's encryption mechanism is based on HPKE (Hybrid Public Key Encryption), where the client uses the gateway's public key to asymmetrically encrypt and encapsulate the request.
The OHTTP protocol was formally standardized by the IETF in RFC 9458.
The key to OHTTP's privacy guarantee is that the relay and the gateway must be operated by different entities and must not collude; otherwise, the privacy promise is rendered meaningless.
In certain jurisdictions, governments may simultaneously issue data disclosure orders to both the relay and the gateway, thereby circumventing OHTTP's privacy mechanism.
The additional encryption and relay hops introduced by OHTTP incur latency overhead, making it unsuitable for highly interactive scenarios with extreme real-time requirements.
Because request content is visible to the gateway, OHTTP protects the association between identity and content, rather than keeping the content itself confidential from the gateway.
OHTTP applicable scenarios include application telemetry and analytics reporting, password breach detection queries, and situations primarily involving one-way reporting that do not require returning large amounts of personalized content.
All Facts (9)
Oblivious HTTP (OHTTP) is a network protocol designed to decouple user identity from request content; by inserting a relay and a gateway between the client and the server, it ensures that no single entity can simultaneously know both the client's IP and the request content.
50%UnverifiedIn the OHTTP architecture, the relay can see the client's IP but cannot see the encrypted request content, while the gateway can decrypt and process the request content but can only see the relay's IP.
50%UnverifiedOHTTP's encryption mechanism is based on HPKE (Hybrid Public Key Encryption), where the client uses the gateway's public key to asymmetrically encrypt and encapsulate the request.
50%UnverifiedThe OHTTP protocol was formally standardized by the IETF in RFC 9458.
50%UnverifiedThe key to OHTTP's privacy guarantee is that the relay and the gateway must be operated by different entities and must not collude; otherwise, the privacy promise is rendered meaningless.
50%UnverifiedIn certain jurisdictions, governments may simultaneously issue data disclosure orders to both the relay and the gateway, thereby circumventing OHTTP's privacy mechanism.
50%UnverifiedThe additional encryption and relay hops introduced by OHTTP incur latency overhead, making it unsuitable for highly interactive scenarios with extreme real-time requirements.
50%UnverifiedBecause request content is visible to the gateway, OHTTP protects the association between identity and content, rather than keeping the content itself confidential from the gateway.
50%UnverifiedOHTTP applicable scenarios include application telemetry and analytics reporting, password breach detection queries, and situations primarily involving one-way reporting that do not require returning large amounts of personalized content.
50%