[TLS] 1rtt thoughts

[Michael StJohns <[e-mail]>]

The current 1rtt draft uses a ClientHello with a ClientKeyExchange 
embedded in an EarlyData extension of the hello to get around the 
problem of pre-TLS1.3 handshake message ordering.   That solves the 
problem mostly, but at the cost of yet another tweak to message formats 
and slightly more complexity in processing.

Instead, how about simply sending the ClientKeyExchange first and then 
the ClientHello (same TCP/UDP send call, just a different record 
order)?  A TLS1.2 server receiving things in this order discards the 
ClientKeyExchange with an out of sequence error, and then starts the 
handshake normally with the receipt of the ClientHello.   The TLS1.3 
client detects the error report and resends the ClientKeyExchange in the 
appropriate TLS1.2 order.

For Finished message processing, the ClientKeyExchange record is 
included in the hash/mac in its normal location, regardless of when it 
was received.

Mike