[TLS] "selected_group" field in HelloRetryRequest in TLS 1.3

[Xuelei Fan <[e-mail]>]

Hi,

What's the consideration to place selected_group out of the extensions
filed in HelloRetryRequest?

      struct {
          ProtocolVersion server_version;
          CipherSuite cipher_suite;
          NamedGroup selected_group;
          Extension extensions<0..2^16-1>;
      } HelloRetryRequest;

vs

      struct {
          ProtocolVersion server_version;
          CipherSuite cipher_suite;
          Extension extensions<0..2^16-1>;   // use key_share (empty share)
or
                                                              //
supported_group for named groups
      } HelloRetryRequest;

The latter may be more friendly for future extensibility, and easier to
implement.  For example, FFDHE may be easy to expose to pre-computation
issues in the future, and dynamic safe prime groups may be expected at that
time.  Having the selected_group as an extension might be more flexible  to
define new replacement.

Thanks,
Xuelei