1779370 - ECH client - On HRR overwrites CHInner.random with CHOuter.random before sending CH2

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P1)

Description

[Leander Schwarz]

nightly-only

When NSS ECH client handles HRR it overwrites CHInner.random with CHOuter.random in tls13_MaybeHandleEchSignal() before sending CH2. CH2 therefore contains CHOuter and CHInner with equal random values.

The behavior was detected in BoringSSL test runner (bogo) handshake_server.go/decryptClientHello(). The function is called for all client ECH tests.

Comment 1

[Leander Schwarz]

Attachment: Bug 1779370 - Added Bogo shim client HRR test support. Fixed overwriting of CHInner.random on HRR. r?djackson

Depends on D151607

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:beurdouche, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:lschwarz, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 4

[Dennis Jackson]

https://hg.mozilla.org/projects/nss/rev/6723bd6cabcdcbe8d9494ccdfcd01e6b7a61e90c