Re: [TLS] [ECH] Reverting the config ID change

[Ben Schwartz <[e-mail]>]

One interesting property of ECH is that it can enable deniable connection
to the public name for GREASE users.  In other words, a passive onlooker
cannot tell the difference between a GREASE user who is actually connecting
to "www.example.com" and an ECH user whose ECHConfig.public_name is "
www.example.com".  Even an active onlooker cannot be sure that the GREASE
user was really connecting to the specified domain, unless they have
confidence that they have exhaustively enumerated the valid ECHConfigs.  In
some contexts, adding doubt to a user activity attribution can be a
meaningful privacy gain.

Adding visible structure to the config_id has the potential to impair this
privacy gain.  If all known ECHConfig.config_ids for a public_name have
some visible structure, GREASE users will be more readily distinguished
with higher confidence, and have less privacy.

I'd like to avoid inviting significant visible structure in the config_id
field (say, >2 bytes of non-random content) unless we have a compelling use
case in mind.