key_exchange_info was a mistake and makes TLS 1.3 rather messy to route the key exchange out of. The value cannot be interpreted without first querying the cipher suite due to it having different semantics on all sides. Most consumers actually want the ECDHE curve and it's not reasonable for every consumer to know:
- First you look up the cipher suite.
- Now you check if it's ECDHE. If yes, you definitely have an ECDHE curve.
- Otherwise, check if it's a TLS 1.3 AEAD/PRF-only cipher suite. If yes, the value is EITHER an ECDHE curve OR zero if ECDHE wasn't used (pure PSK resumption).
- Otherwise, it is not safe to interpret the value because it's some garbage from legacy ciphers.
We've largely purged it from BoringSSL now but for lingering serialization quirks we're now stuck with. We should to purge it from Chromium too, otherwise every layer's version of net::SSLInfo needs to expose that same check to callers.
The plain RSA branch of it is gone now as the consuming UMA is gone. The DHE branch is only used by a UMA value. Once the DHE removal has stuck we can definitely take that out. Layers beyond net::SSLStatus will need to be converted to ecdhe_curve now or we can't show TLS 1.3's details in DevTools sanely.
Comment 1 by davidben@chromium.org
, Aug 25 2016