{"action":"created","issue":{"url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni/issues/67","repository_url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni","labels_url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni/issues/67/labels{/name}","comments_url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni/issues/67/comments","events_url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni/issues/67/events","html_url":"https://github.com/ekr/draft-rescorla-tls-esni/issues/67","id":338429358,"node_id":"MDU6SXNzdWUzMzg0MjkzNTg=","number":67,"title":"Use different client key shares for ESNI and TLS KE?","user":{"login":"ekr","id":1111457,"node_id":"MDQ6VXNlcjExMTE0NTc=","avatar_url":"https://avatars0.githubusercontent.com/u/1111457?v=4","gravatar_id":"","url":"https://api.github.com/users/ekr","html_url":"https://github.com/ekr","followers_url":"https://api.github.com/users/ekr/followers","following_url":"https://api.github.com/users/ekr/following{/other_user}","gists_url":"https://api.github.com/users/ekr/gists{/gist_id}","starred_url":"https://api.github.com/users/ekr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ekr/subscriptions","organizations_url":"https://api.github.com/users/ekr/orgs","repos_url":"https://api.github.com/users/ekr/repos","events_url":"https://api.github.com/users/ekr/events{/privacy}","received_events_url":"https://api.github.com/users/ekr/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-07-05T05:14:20Z","updated_at":"2018-07-05T06:20:02Z","closed_at":null,"author_association":"OWNER","body":"Using the same key share looked like a good idea, but it's actually a real pain to implement because you need to get pretty involved with the TLS 1.3 key exchange.\r\n\r\nAnother approach would be to have separate keys but bind the ClientHello.KeyShare extension into the ESNI extension. I had thought of putting a hash in the extension plaintext but @martinthomson points out that if you use it as AAD, then the client-facing server will automatically detect mismatch\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni/issues/comments/402617657","html_url":"https://github.com/ekr/draft-rescorla-tls-esni/issues/67#issuecomment-402617657","issue_url":"https://api.github.com/repos/ekr/draft-rescorla-tls-esni/issues/67","id":402617657,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMjYxNzY1Nw==","user":{"login":"kazuho","id":41567,"node_id":"MDQ6VXNlcjQxNTY3","avatar_url":"https://avatars2.githubusercontent.com/u/41567?v=4","gravatar_id":"","url":"https://api.github.com/users/kazuho","html_url":"https://github.com/kazuho","followers_url":"https://api.github.com/users/kazuho/followers","following_url":"https://api.github.com/users/kazuho/following{/other_user}","gists_url":"https://api.github.com/users/kazuho/gists{/gist_id}","starred_url":"https://api.github.com/users/kazuho/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazuho/subscriptions","organizations_url":"https://api.github.com/users/kazuho/orgs","repos_url":"https://api.github.com/users/kazuho/repos","events_url":"https://api.github.com/users/kazuho/events{/privacy}","received_events_url":"https://api.github.com/users/kazuho/received_events","type":"User","site_admin":false},"created_at":"2018-07-05T06:20:02Z","updated_at":"2018-07-05T06:20:02Z","author_association":"COLLABORATOR","body":"> I had thought of putting a hash in the extension plaintext but @martinthomson points out that if you use it as AAD, then the client-facing server will automatically detect mismatch\r\n\r\n:+1:"}}
{"actor":{"display_login":"kazuho"}}