[TLS] ESNI PEM files

[Stephen Farrell <[e-mail]>]

Hiya,

To date, my ESNI code [1] has been dealing with files containing
the binary encoding of ESNIKeys and a separate PEM file containing
the related private key.

As part of getting nginx to work with ESNI [2], it'd be easier
for me to deal with a single file containing both private key
and the ESNIKeys (or ESNIConfig) value. (One of the upstream
maintainers didn't like how I handled configuring ESNI, so the
change is really to make him happier, but I think it's likely
a generally useful thing:-)

Since mixing binary and PEM encoding in one file would be ickky,
it'd be nice if we had a PEM file convention for the public keys
used in ESNI. And of course, it'd be much nicer if everyone did
the same thing here.

What I'm coding up now would handle files like:

"
-----BEGIN ESNIKEY-----
/wGeNLTKACQAHQAg/JLBUtPE5wp4CU2bbTihSPeP3113kz1J80X/Iy1Y2EYAAhMBAQQAAAAAXO6j
/gAAAABc995+AAA=
-----END ENSIKEY-----
"

...where the content is (unsurprisingly:-) a base64 encoded ESNIKeys.

And if both the private and public components are in one file,
it'd look like:

"
----BEGIN PRIVATE KEY-----
MC4CAQAwBQYDK2VuBCIEICAHxXknil9tI2qZ+USRouNwXp0LxlUB85l0/xbhZ4Va
-----END PRIVATE KEY-----
-----BEGIN ESNIKEY-----
/wGeNLTKACQAHQAg/JLBUtPE5wp4CU2bbTihSPeP3113kz1J80X/Iy1Y2EYAAhMBAQQAAAAAXO6j
/gAAAABc995+AAA=
-----END ENSIKEY-----
"

I'd be happy to change that however increases the probability
that other code bases do the same thing.

If this is useful, I could do up a PR with a bit of text saying
to use "ESNIKEY" (or whatever) as the label when storing these
things in PEM files. Given RFC7468 documents other PEM file
things, it seems reasonable to do the same for ESNI.

Cheers,
S.

[1] https://github.com/sftcd/openssl/tree/master/esnistuff
[2] https://github.com/sftcd/nginx