Subject: [TLS] ECH-13 HRR Signal Derivation

From: Dennis Jackson <[email-masked]>
Date: Thu, 2 Sep 2021 09:42:24 +0100

I have two questions about the transcript for the confirmation signal 
<https://www.ietf.org/archive/id/draft-ietf-tls-esni-13.html#name-sending-helloretryrequest-2> 
for HelloRetryRequests in ECH Draft 13:

1. Should ClientHelloInner1 be replaced with a message_hash message as 
in TLS?

2. Is the entire HelloRetryRequest (with overwritten placeholder value) 
included in the transcript or is the HRR only included up to the end of 
the placeholder value?

I had assumed 1. yes and 2. the entire HRR, but an off-list conversation 
left me unsure.

Best,
Dennis

---

From: "Christopher Wood" <[email-masked]>
Date: Thu, 02 Sep 2021 05:47:56 -0700

On Thu, Sep 2, 2021, at 1:42 AM, Dennis Jackson wrote:
> <https://www.ietf.org/archive/id/draft-ietf-tls-esni-13.html#name-sending-helloretryrequest-2> for HelloRetryRequests in ECH Draft 13: 
> 
> 1. Should ClientHelloInner1 be replaced with a message_hash message as in TLS? 
> 
> I had assumed 1. yes and 2. the entire HRR, but an off-list 
> conversation left me unsure. 

That matches my interpretation of the text, though I see why (1) is not all that clear. If others agree, would you mind filing an issue to help clarify?

Thanks,
Chris