tree bc4655e3f3044323c7a93c378140220309fdca86
parent 18b6836b2f6340187a7981c82be9be9d092d36d6
author David Benjamin <davidben@google.com> 1630602444 -0400
committer Adam Langley <agl@google.com> 1630620709 +0000

Fix calculation of draft-13 ECH confirmation signal.

Apparently both we and Go flipped the parameter order for HKDF-Extract
relative to the HKDF spec. (The spec orders the salt before the key.)
Not sure how that happened.

Found doing interop testing with Stephen Farrell's implementation.

https://pkg.go.dev/golang.org/x/crypto/hkdf#Extract
https://datatracker.ietf.org/doc/html/rfc5869#section-2.2
https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-13#section-7.2

Bug: 275
Change-Id: I40a7d53b45cb548e93e6a7ae235e98e55dec4a7a
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/49185
Reviewed-by: Adam Langley <agl@google.com>