# TLS 1.3: the key_share in a ClientHello after a HelloRetryRequest

In TLS 1.3 draft-21, if there is a ClientHello with a key_share, say, $(G_1, g^x)$, the server can send a HelloRetryRequest to request a new key_share value, e.g. ($G_2, g^y)$.

My questions are:

1. When the client send the second ClientHello, does it replace the old key_share with the new one? i.e, does the new key_share in the second ClientHello becomes $(G_2, g^x)$ or becomes $[(G_1, g^x), (G_2, g^y)]$?
2. When the server ask for a new key_share in the HelloRetryRequest, does it send its public value with $(G_2, g^y)$ it or just the Group $(G_2)$?
3. What does the key_share contain? it is confusing. In some cases I get the impression it is the group and the public-key $(G_1, g^x)$, in others, like in the HelloRetryRequest, I get the impression it is only the group $(G_2)$.

Need more clarification on what is supposed to be sent in the key_share in both: ClientHello, HelloRetryRequest, and the second ClientHello after the HelloRetryRequest.

## 1 Answer

Yes. When the client sends a new ClientHello after a HelloRetryRequest, it replaces the old KeyShare with the one the server requested in the HelloRetryRequest. This is according to my interpretation for the following text in the TLS 1.3 draft 21 here:

the new ClientHello, the client MUST replace the original "key_share" extension with one containing only a new KeyShareEntry for the group indicated in the selected_group field of the triggering HelloRetryRequest.

If you have any comments to confirm or correct me, please post before I accept my answer.