[TLS] Pre-master secret formatting for master secret calculation with DH in TLS 1.x

[Andrey Jivsov <[e-mail]>]

I ran into an interoperability problem between our TLS implementation 
and another very popular one.

The question is what exactly is the formatting  for the RFC224 sec. 
8.1.2 "Diffie-Hellman" shared secret 'Z' ?

The problem arises when the most significant byte of the Z is zero. 
Let's say that the field prime's size is 256. There are two possibilities:

1. export the Z in the big endian format, padding it to 256 (first byte 
in the buffer is zero)
2. export the Z in the big endian format, placing the result in a 255 
byte buffer.

I would say that this should be #1, because it is the natural 
representation of the Z. If there is a language specifying the canonical 
encoding for the Z, I would appreciate the reference.

( Apparently, this problem doesn't clearly manifest itself in real 
deployments because ~ the 1/256 failure rate is masked by 
re-negotiations at the higher protocol level. )

Thank you.