handshake: fix timing of sending early data

Previously, the client was sending early data after receiving a Server
Hello message, which not only negates the benefit of 0-RTT, but also
was a logic error as it can only be decrypted by the server when the
initial handshake and the resuming handshake agree on the same
ciphersuites.  This fixes that behavior in the following ways:

- extend the session data format to include the selected ciphersuites,
  even in TLS 1.3
- setup the epoch for early data, right before the client sending
  early data (also right after the server deciding to accept early
  data).
- extend the test case to use different ciphersuites in the initial
  and resuming handshakes

Signed-off-by: Daiki Ueno <ueno@gnu.org>

1 files changed, 5 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index 8b3538d05d..f4ebe43ffb 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,11 @@ See the end for copying conditions.
    This can be enabled with --enable-afalg configure option, when libkcapi
    package is installed (#308).
 
+** libgnutls: Fixed timing of early data exchange. Previously, the client was
+   sending early data after receiving Server Hello, which not only negates the
+   benefit of 0-RTT, but also works under certain assumptions hold (e.g., the
+   same ciphersuite is selected in initial and resumption handshake) (#1146).
+
 * Version 3.7.1 (released 2021-03-10)
 
 ** libgnutls: Fixed potential use-after-free in sending "key_share"