1927351 - SSLKEYLOG support for Encrypted Client Hello

Status: UNCONFIRMED

(NSS :: Libraries, enhancement)

Description

[Yaroslav Rosomakho]

Steps to reproduce:

Using NSS based client or server with Encrypted Client Hello and generate SSLKEYLOG for diagnostics

Actual results:

SSLKEYLOGFILE contains entries prefixed with Random from Inner ClientHello, so it cannot be used for TLS sessions with Encrypted Client Hello.

Expected results:

NSS should generate ECH_CONFIG and ECH_SECRET SSLKEYLOG records according to draft-ietf-tls-ech-keylogfile.

I will be shortly submitting a patch to implement this capability.

Comment 1

[Yaroslav Rosomakho]

Attachment: Bug 1927351 - add ECH_SECRET and ECH_CONFIG to SSLKEYLOG for both client and server. r=#nss-reviewers