In TLS 1.3 draft-21, if there is a
ClientHello with a
key_share, say, $(G_1, g^x)$, the server can send a
HelloRetryRequest to request a new
key_share value, e.g. ($G_2, g^y)$.
My questions are:
- When the client send the second
ClientHello, does it replace the old
key_sharewith the new one? i.e, does the new
key_sharein the second
ClientHellobecomes $(G_2, g^x)$ or becomes $[(G_1, g^x), (G_2, g^y)]$?
- When the server ask for a new
HelloRetryRequest, does it send its public value with $(G_2, g^y)$ it or just the Group $(G_2)$?
- What does the
key_sharecontain? it is confusing. In some cases I get the impression it is the group and the public-key $(G_1, g^x)$, in others, like in the
HelloRetryRequest, I get the impression it is only the group $(G_2)$.
Need more clarification on what is supposed to be sent in the
key_share in both:
HelloRetryRequest, and the second
ClientHello after the