{"push_id":1120022195,"size":1,"distinct_size":1,"ref":"refs/heads/dhe-pad2","head":"6af2cd01e8b3109651dcde667aa030b26f459321","before":"1f86a0e0a72da6b4d50c67a141698d3c0202642d","commits":[{"sha":"6af2cd01e8b3109651dcde667aa030b26f459321","author":{"email":"348b1b6801801c3d890b2e1589a8e36441d09fdc@google.com","name":"David Benjamin"},"message":"Preserve leading zeros in Diffie-Hellman secrets.\n\nEvery other use of Diffie-Hellman preserves leading zeros. See PKCS #3 section\n8.3, RFC 2631 section 2.1.2, and SP 800-56A section C.1. I assume X9.42 says\nsomething similar to RFC 2631, but I do not have a copy of it. This discrepancy\nhas caused sporadic interoperability issues in TLS 1.2's DHE construction, so\nclearly it's confusing.\n\nMoreover, having variable-length secrets is generally dubious. It exposes an\nunnecessary side channel.\n\nSince TLS 1.2's server-fiat DHE and TLS 1.3's negotiated DHE are already very\ndifferent animals (1.3 DHE is more like 1.2 ECDHE than anything else), change\nit to the more reasonable scheme going forward. This is not compatible with 1.2\nand does risk a different set of sporadic interop issues if implementations do\nnot realize this changed, but we already have those with 1.2 implementations\ntoday.","distinct":true,"url":"https://api.github.com/repos/davidben/tls13-spec/commits/6af2cd01e8b3109651dcde667aa030b26f459321"}]}