Subject: [Uta] adding another note of caution for developers

From: Stephen Farrell <[email-masked]>
Date: Fri, 12 Nov 2021 16:16:18 +0000

Hiya,

During the UTA session it occurred to me it might make sense
to have a sentence something like:

"Ongoing development of TLS continues so implementers ought
not assume that they can depend on specific content of TLS
messages. For example, experiments like ECH [1] mean that
the ClientHello visible before being processed by a TLS
library may not correspond to the actual TLS session
details."

   [1] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/

Reason is I have seen application layer code that peeks into
the ClientHello in web servers that I had to modify when
integrating with my ECH-supporting OpenSSL fork.

Cheers,
S.