TLS 1.3: the key_share in a ClientHello after a HelloRetryRequest In TLS 1.3 draft-21, if there is a ClientHello with a key_share, say, $(G_1, g^x)$, the server can send a HelloRetryRequest to request a new key_share value, e.g. ($G_2, g^y)$. 

My questions are: 


When the client send the second ClientHello, does it replace the old key_share with the new one? i.e, does the new key_share in the second ClientHello becomes $(G_2, g^x)$ or becomes $[(G_1, g^x), (G_2, g^y)]$?
When the server ask for a new key_share in the HelloRetryRequest, does it send its public value with $(G_2, g^y)$ it or just the Group $(G_2)$?
What does the key_share contain? it is confusing. In some cases I get the impression it is the group and the public-key $(G_1, g^x)$, in others, like in the HelloRetryRequest, I get the impression it is only the group $(G_2)$. 


Need more clarification on what is supposed to be sent in the key_share in both: ClientHello, HelloRetryRequest, and the second ClientHello after the HelloRetryRequest.
Yes. When the client sends a new ClientHello after a HelloRetryRequest, it replaces the old KeyShare with the one the server requested in the HelloRetryRequest. This is according to my interpretation for the following text in the TLS 1.3 draft 21 here:


  the new ClientHello, the client MUST    replace the original
  "key_share" extension with one containing only a    new KeyShareEntry
  for the group indicated in the selected_group field    of the
  triggering HelloRetryRequest.


If you have any comments to confirm or correct me, please post before I accept my answer.