[TLS] CH padding extension

[Christopher Wood <[e-mail]>]

Hi folks,

In Section 4.2 of the latest TLS 1.3 draft [1], the padding(21)
extension is restricted to the CH and no other handshake messages.
Another plausible spot for this extension is in the Certificate
message. Specifically, although we're encrypting this message, we may
not want to reveal its length. Adding a padding extension seems to
address that problem. Granted, RFC7685 [2] clearly indicates that this
padding is for the CH, and that server "MUST NOT echo the extension."
However, I don't think that rules out server-chosen padding for the
Certificate.

What do others think? Is this worth a change?

Best,
Chris

[1] https://tools.ietf.org/html/draft-ietf-tls-tls13-28#section-4.2
[2] https://tools.ietf.org/html/rfc7685