writeonce

shoney/writeonce

Fork 0

Commit graph

Author	SHA1	Message	Date
shoney.arickathil	25dda4cb2f	feat(tls): TLS 1.3 key schedule (rv2 9 phase F2) - wo_tls_derive_handshake: Early/Handshake/Master secrets + client/server handshake-traffic secrets from the ECDHE shared secret and the ClientHello..ServerHello transcript hash (RFC 8446 §7.1) - wo_tls_derive_application: client/server application-traffic secrets from master_secret + the ClientHello..server-Finished transcript hash - wo_tls_traffic_keys: record key + IV via HKDF-Expand-Label "key"/"iv" - wo_tls_finished_verify: finished_key = Expand-Label(base,"finished"), verify_data = HMAC(finished_key, transcript_hash) - all over phase-B HKDF (Extract/Expand-Label) + Derive-Secret helper - KAT vs RFC 8448 §3 "Simple 1-RTT Handshake" byte-for-byte: c/s hs traffic, master, c/s ap traffic, server hs key+iv. Also validates the phase-B "tls13 " Expand-Label. test_tls 58 pass, ASan/UBSan clean Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> (cherry picked from commit 417fcc16f80c1dd31e84a0336944573902fde06e)	2026-09-15 01:15:31 +02:00
shoney.arickathil	7e71c1a171	feat(tls): TLS 1.3 record layer (rv2 9 phase F1) - new tls.c/tls.h on the crypto ladder: wo_tls_record_seal/open (RFC 8446 §5.2) — TLSInnerPlaintext (content\|\|type, no padding), 5-byte header as AEAD additional-data, per-record nonce = iv XOR seq big-endian (§5.3) - suite dispatch: TLS_AES_128_GCM_SHA256 (mandatory) + TLS_CHACHA20_POLY1305_SHA256 (AES-NI-less fallback), over phase-A AEAD - open() strips trailing zero padding to recover the inner content type; rejects a length-field lie before the AEAD, and auth failure after - KAT vs python AEAD oracle (test/gen_tls_record.py): sealed record byte-for-byte both suites, open() recovers it, 5-seq round-trip, tamper + wrong-seq + bad-suite rejected. test_tls 51 pass, ASan/UBSan Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> (cherry picked from commit 5021a99f8359f78a642bb0cc2b28ab66f6b624e2)	2026-09-15 01:15:31 +02:00

Author

SHA1

Message

Date

shoney.arickathil

25dda4cb2f

feat(tls): TLS 1.3 key schedule (rv2 9 phase F2)

- wo_tls_derive_handshake: Early/Handshake/Master secrets + client/server
  handshake-traffic secrets from the ECDHE shared secret and the
  ClientHello..ServerHello transcript hash (RFC 8446 §7.1)
- wo_tls_derive_application: client/server application-traffic secrets
  from master_secret + the ClientHello..server-Finished transcript hash
- wo_tls_traffic_keys: record key + IV via HKDF-Expand-Label "key"/"iv"
- wo_tls_finished_verify: finished_key = Expand-Label(base,"finished"),
  verify_data = HMAC(finished_key, transcript_hash)
- all over phase-B HKDF (Extract/Expand-Label) + Derive-Secret helper
- KAT vs RFC 8448 §3 "Simple 1-RTT Handshake" byte-for-byte: c/s hs
  traffic, master, c/s ap traffic, server hs key+iv. Also validates the
  phase-B "tls13 " Expand-Label. test_tls 58 pass, ASan/UBSan clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 417fcc16f80c1dd31e84a0336944573902fde06e)

2026-09-15 01:15:31 +02:00

shoney.arickathil

7e71c1a171

feat(tls): TLS 1.3 record layer (rv2 9 phase F1)

- new tls.c/tls.h on the crypto ladder: wo_tls_record_seal/open
  (RFC 8446 §5.2) — TLSInnerPlaintext (content||type, no padding),
  5-byte header as AEAD additional-data, per-record nonce = iv XOR
  seq big-endian (§5.3)
- suite dispatch: TLS_AES_128_GCM_SHA256 (mandatory) +
  TLS_CHACHA20_POLY1305_SHA256 (AES-NI-less fallback), over phase-A AEAD
- open() strips trailing zero padding to recover the inner content type;
  rejects a length-field lie before the AEAD, and auth failure after
- KAT vs python AEAD oracle (test/gen_tls_record.py): sealed record
  byte-for-byte both suites, open() recovers it, 5-seq round-trip,
  tamper + wrong-seq + bad-suite rejected. test_tls 51 pass, ASan/UBSan

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 5021a99f8359f78a642bb0cc2b28ab66f6b624e2)

2026-09-15 01:15:31 +02:00

2 commits