Hiya, To date, my ESNI code [1] has been dealing with files containing the binary encoding of ESNIKeys and a separate PEM file containing the related private key.
As part of getting nginx to work with ESNI [2], it'd be easier for me to deal with a single file containing both private key and the ESNIKeys (or ESNIConfig) value. (One of the upstream maintainers didn't like how I handled configuring ESNI, so the change is really to make him happier, but I think it's likely a generally useful thing:-) Since mixing binary and PEM encoding in one file would be ickky, it'd be nice if we had a PEM file convention for the public keys used in ESNI. And of course, it'd be much nicer if everyone did the same thing here. What I'm coding up now would handle files like: " -----BEGIN ESNIKEY----- /wGeNLTKACQAHQAg/JLBUtPE5wp4CU2bbTihSPeP3113kz1J80X/Iy1Y2EYAAhMBAQQAAAAAXO6j /gAAAABc995+AAA= -----END ENSIKEY----- " ...where the content is (unsurprisingly:-) a base64 encoded ESNIKeys. And if both the private and public components are in one file, it'd look like: " ----BEGIN PRIVATE KEY----- MC4CAQAwBQYDK2VuBCIEICAHxXknil9tI2qZ+USRouNwXp0LxlUB85l0/xbhZ4Va -----END PRIVATE KEY----- -----BEGIN ESNIKEY----- /wGeNLTKACQAHQAg/JLBUtPE5wp4CU2bbTihSPeP3113kz1J80X/Iy1Y2EYAAhMBAQQAAAAAXO6j /gAAAABc995+AAA= -----END ENSIKEY----- " I'd be happy to change that however increases the probability that other code bases do the same thing. If this is useful, I could do up a PR with a bit of text saying to use "ESNIKEY" (or whatever) as the label when storing these things in PEM files. Given RFC7468 documents other PEM file things, it seems reasonable to do the same for ESNI. Cheers, S. [1] https://github.com/sftcd/openssl/tree/master/esnistuff [2] https://github.com/sftcd/nginx
0x5AB2FAF17B172BEA.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
_______________________________________________ TLS mailing list [email protected] https://www.ietf.org/mailman/listinfo/tls
