Subject: [TLS] ECH AAD for HRR

From: Stephen Farrell <[email-masked]>
Date: Wed, 1 Sep 2021 18:00:41 +0100

(Apologies for the acronym laden subject:-)

I'm more or less at the "code complete" stage of
implementing draft-13 incl. HRR. (If anyone wants
to try interop, for now please contact me, but I
should have a server up in a few days.) I'm sure
as usual I'll have gotten some details wrong, but
I wasn't clear about one thing:

- When sending the 2nd CH following HRR, the spec
calls for omitting the "enc" field of the ECH
extension ("enc" holds the sender's public HPKE
value that's re-used from the 1st CH).
- The AAD for that ECH encryption is the outer
CH with zeros replacing where the ciphertext will
go.
- I concluded that the sender's ECH public value
(the "enc" field) ought not be present in the
AAD in that case, as well as being omitted in
the ECH value, but it wasn't entirely clear to me
from the spec (and it'd work either way).

So my question is: did I get that right or not?

Thanks in advance,
S.

---

From: David Benjamin <[email-masked]>
Date: Wed, 1 Sep 2021 13:13:03 -0400

That's right. The AAD and actual CH should be exactly the same, apart from
the payload being zeroed in place. You don't need to reserialize the
structure as a server, or serialize ClientHelloOuter twice as a client.

On Wed, Sep 1, 2021 at 1:01 PM Stephen Farrell <[email-masked]>
wrote:

> _______________________________________________
> TLS mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tls
>

---

From: Christopher Patton <[email-masked]>
Date: Wed, 1 Sep 2021 11:04:29 -0700

Yup, that was my interpretation as well.

---

From: Stephen Farrell <[email-masked]>
Date: Wed, 1 Sep 2021 19:44:20 +0100

Great, thanks both

S

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 2 Sep 2021 02:04:58 +0100

Earlier, I said:

On 01/09/2021 18:00, Stephen Farrell wrote:
> I should have a server up in a few days

I now have an ``openssl s_server`` that thinks it speaks
draft-13 running on draft-13.esni.defo.ie on port 8413
with the relevant ECHConfig published in DNS etc.

It'll probably crash and burn if someone tries to talk
to it, but happy to see that happen:-)

Cheers,
S.