Script updating gh-pages from 4ef3e0d. [ci skip]

coalesce-retry-vn/draft-ietf-quic-tls.html

@@ -1082,11 +1082,11 @@ <h3 id="rfc.section.5.4.4">
 <a href="#rfc.section.5.4.4">5.4.4.</a> <a href="#hp-chacha" id="hp-chacha">ChaCha20-Based Header Protection</a>
 </h3>
 <p id="rfc.section.5.4.4.p.1">When AEAD_CHACHA20_POLY1305 is in use, header protection uses the raw ChaCha20 function as defined in Section 2.4 of <a href="#CHACHA" class="xref">[CHACHA]</a>.  This uses a 256-bit key and 16 bytes sampled from the packet protection output.</p>
-<p id="rfc.section.5.4.4.p.2">The first 4 bytes of the sampled ciphertext are interpreted as a 32-bit number in little-endian order and are used as the block count; a ChaCha20 implementation might instead take the 4 bytes as an opaque sequence of bytes.  The remaining 12 bytes are used as the nonce.</p>
+<p id="rfc.section.5.4.4.p.2">The first 4 bytes of the sampled ciphertext are interpreted as a 32-bit number in little-endian order and are used as the block count.  The remaining 12 bytes are interpreted as three concatenated 32-bit numbers in little-endian order and used as the nonce.</p>
 <p id="rfc.section.5.4.4.p.3">The encryption mask is produced by invoking ChaCha20 to protect 5 zero bytes. In pseudocode:</p>
 <pre>
 counter = DecodeLE(sample[0..3])
-nonce = sample[4....15]
+nonce = DecodeLE(sample[4..7], sample[8..11], sample[12..15])
 mask = ChaCha20(hp_key, counter, nonce, {0,0,0,0,0})
 </pre>
 <h2 id="rfc.section.5.5">

coalesce-retry-vn/draft-ietf-quic-tls.txt

@@ -1319,15 +1319,15 @@ Internet-Draft          Using TLS to Secure QUIC             August 2019
    256-bit key and 16 bytes sampled from the packet protection output.
 
    The first 4 bytes of the sampled ciphertext are interpreted as a
-   32-bit number in little-endian order and are used as the block count;
-   a ChaCha20 implementation might instead take the 4 bytes as an opaque
-   sequence of bytes.  The remaining 12 bytes are used as the nonce.
+   32-bit number in little-endian order and are used as the block count.
+   The remaining 12 bytes are interpreted as three concatenated 32-bit
+   numbers in little-endian order and used as the nonce.
 
    The encryption mask is produced by invoking ChaCha20 to protect 5
    zero bytes.  In pseudocode:
 
    counter = DecodeLE(sample[0..3])
-   nonce = sample[4....15]
+   nonce = DecodeLE(sample[4..7], sample[8..11], sample[12..15])
    mask = ChaCha20(hp_key, counter, nonce, {0,0,0,0,0})
 
 5.5.  Receiving Protected Packets