In TLS 1.3 draft-21, if there is a ClientHello with a key_share, say, $(G_1, g^x)$, the server can send a HelloRetryRequest to request a new key_share value, e.g. ($G_2, g^y)$.

My questions are:

  1. When the client send the second ClientHello, does it replace the old key_share with the new one? i.e, does the new key_share in the second ClientHello becomes $(G_2, g^x)$ or becomes $[(G_1, g^x), (G_2, g^y)]$?
  2. When the server ask for a new key_share in the HelloRetryRequest, does it send its public value with $(G_2, g^y)$ it or just the Group $(G_2)$?
  3. What does the key_share contain? it is confusing. In some cases I get the impression it is the group and the public-key $(G_1, g^x)$, in others, like in the HelloRetryRequest, I get the impression it is only the group $(G_2)$.

Need more clarification on what is supposed to be sent in the key_share in both: ClientHello, HelloRetryRequest, and the second ClientHello after the HelloRetryRequest.


Yes. When the client sends a new ClientHello after a HelloRetryRequest, it replaces the old KeyShare with the one the server requested in the HelloRetryRequest. This is according to my interpretation for the following text in the TLS 1.3 draft 21 here:

the new ClientHello, the client MUST replace the original "key_share" extension with one containing only a new KeyShareEntry for the group indicated in the selected_group field of the triggering HelloRetryRequest.

If you have any comments to confirm or correct me, please post before I accept my answer.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.