Pick up the GREASE ECH config ID from grease_seed.

This avoids an unnecessary one-byte RAND_bytes call.

Bug: 275
Change-Id: Idf5bfb17401441f2af7b3c784f7b5d876d005165
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/47989
Reviewed-by: Adam Langley <agl@google.com>

ssl/internal.h

diff --git a/ssl/internal.h b/ssl/internal.h
index 7d84312..b3e702b 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -1575,7 +1575,8 @@
   ssl_grease_extension2,
   ssl_grease_version,
   ssl_grease_ticket_extension,
-  ssl_grease_last_index = ssl_grease_ticket_extension,
+  ssl_grease_ech_config_id,
+  ssl_grease_last_index = ssl_grease_ech_config_id,
 };
 
 enum tls12_server_hs_state_t {

ssl/t1_lib.cc

diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc
index e1d699e..865d33a 100644
--- a/ssl/t1_lib.cc
+++ b/ssl/t1_lib.cc
@@ -624,8 +624,9 @@
   const uint16_t aead_id = EVP_has_aes_hardware() ? EVP_HPKE_AES_128_GCM
                                                   : EVP_HPKE_CHACHA20_POLY1305;
   constexpr size_t kAEADOverhead = 16;  // Both AEADs have a 16-byte tag.
-  uint8_t ech_config_id;
-  RAND_bytes(&ech_config_id, 1);
+  static_assert(ssl_grease_ech_config_id < sizeof(hs->grease_seed),
+                "hs->grease_seed is too small");
+  uint8_t ech_config_id = hs->grease_seed[ssl_grease_ech_config_id];
 
   uint8_t ech_enc[X25519_PUBLIC_VALUE_LEN];
   uint8_t private_key_unused[X25519_PRIVATE_KEY_LEN];