anchor.diff:      let ca = kefAlg_extended si in
       ExtendedMS (si.pmsId,si.session_hash,ca)
   
  -
  -
  -//type preEpoch =
  -//    | InitEpoch of Role
  -//    | SuccEpoch of crand * srand * SessionInfo * preEpoch
  -
   type abbrInfo = 
       {abbr_crand: crand;
        abbr_srand: srand;
  
positive.code:   csrConn: csrands;
    ext: negotiatedExtensions;
    writer : Role }
  
  //let idInv (i:id):succEpoch = failwith "requires a log, and pointless to implement anyway"
  
  let unAuthIdInv (i:id):epoch = 
  #if verify
  
negative.code: type sessionHash = bytes
  
  // Defined here to not depend on TLSExtension
  type negotiatedExtensions = {ne_extended_ms: bool; ne_extended_padding:bool;
                               ne_renegotiation_info: (cVerifyData * sVerifyData) option }
  
  