迷你密钥日程

/// RFC 5869 HKDF-Extract: PRK = HMAC-Hash(salt, IKM).
///
/// An absent salt is "HashLen zeros"; HMAC pads its key with zeros to the block size,
/// so an empty salt gives the same PRK and needs no special case.
pub fn hkdf_extract(hash: Hash, salt: &[u8], ikm: &[u8]) -> Vec<u8> {
  hash.hmac(salt, &[ikm])
}

/// RFC 5869 HKDF-Expand: T(i) = HMAC-Hash(PRK, T(i-1) | info | i), output = T(1) | T(2) | ...
///
/// `info` is passed as parts, like rustls does, so the label is never concatenated.
pub fn hkdf_expand(hash: Hash, prk: &[u8], info: &[&[u8]], len: usize) -> Vec<u8> {
  assert!(len <= 255 * hash.len(), "RFC 5869: L must be <= 255 * HashLen");
  let blocks = len.div_ceil(hash.len());
  let mut out = Vec::with_capacity(blocks * hash.len());
  let mut previous: Vec<u8> = Vec::new();
  for i in 1..(blocks + 1) {
    let counter = [i as u8];
    let mut parts: Vec<&[u8]> = Vec::with_capacity(info.len() + 2);
    parts.push(&previous);
    parts.extend_from_slice(info);
    parts.push(&counter);
    previous = hash.hmac(prk, &parts);
    out.extend_from_slice(&previous);
  }
  out.truncate(len);
  out
}

pub fn hkdf_expand_label(hash: Hash, secret: &[u8], label: &str, context: &[u8], len: usize) -> Vec<u8> {
  const PREFIX: &[u8] = b"tls13 ";
  let length = (len as u16).to_be_bytes();
  let label_len = [(PREFIX.len() + label.len()) as u8];
  let context_len = [context.len() as u8];
  let info: [&[u8]; 6] = [&length, &label_len, PREFIX, label.as_bytes(), &context_len, context];
  hkdf_expand(hash, secret, &info, len)
}

/// Derive-Secret(Secret, Label, Messages), given Transcript-Hash(Messages) directly.
pub fn derive_secret(hash: Hash, secret: &[u8], label: &str, transcript_hash: &[u8]) -> Vec<u8> {
  hkdf_expand_label(hash, secret, label, transcript_hash, hash.len())
}

/// One rung of the ladder: a PRK plus the hash it belongs to.
struct Rung {
  hash: Hash,
  secret: Vec<u8>,
}

impl Rung {
  fn derive(&self, label: &str, transcript_hash: &[u8]) -> Vec<u8> {
    derive_secret(self.hash, &self.secret, label, transcript_hash)
  }

  /// HKDF-Extract(salt = Derive-Secret(., "derived", ""), ikm): the step between rungs.
  fn next(self, ikm: &[u8]) -> Rung {
    let salt = self.derive("derived", &self.hash.hash(b""));
    Rung { hash: self.hash, secret: hkdf_extract(self.hash, &salt, ikm) }
  }
}

pub struct EarlySecret(Rung);
pub struct HandshakeSecret(Rung);
pub struct MasterSecret(Rung);

impl EarlySecret {
  pub fn new(hash: Hash, psk: Option<&[u8]>) -> Self {
    let zeros = vec![0u8; hash.len()];
    let ikm = psk.unwrap_or(&zeros);
    EarlySecret(Rung { hash, secret: hkdf_extract(hash, &zeros, ikm) })
  }

  /// "ext binder" for an external PSK, "res binder" for a resumption PSK.
  pub fn binder_key(&self, external: bool) -> Vec<u8> {
    let label = if external { "ext binder" } else { "res binder" };
    self.0.derive(label, &self.0.hash.hash(b""))
  }

  pub fn client_early_traffic_secret(&self, client_hello_hash: &[u8]) -> Vec<u8> {
    self.0.derive("c e traffic", client_hello_hash)
  }
  // ... early_exporter_master_secret: "e exp master"

  /// Consumes the early secret: it cannot be used after the (EC)DHE input.
  pub fn into_handshake(self, ecdhe_shared_secret: &[u8]) -> HandshakeSecret {
    HandshakeSecret(self.0.next(ecdhe_shared_secret))
  }
}

impl HandshakeSecret {
  /// `hello_hash` = Transcript-Hash(ClientHello..ServerHello).
  pub fn client_handshake_traffic_secret(&self, hello_hash: &[u8]) -> Vec<u8> {
    self.0.derive("c hs traffic", hello_hash)
  }
  // ... server_handshake_traffic_secret: "s hs traffic"

  pub fn into_master(self) -> MasterSecret {
    let zeros = vec![0u8; self.0.hash.len()];
    MasterSecret(self.0.next(&zeros))
  }
}
// ... impl MasterSecret: "c ap traffic", "s ap traffic", "exp master", "res master"

pub fn finished_verify_data(hash: Hash, base_key: &[u8], transcript_hash: &[u8]) -> Vec<u8> {
  let finished_key = hkdf_expand_label(hash, base_key, "finished", b"", hash.len());
  hash.hmac(&finished_key, &[transcript_hash])
}

/// Checks a received Finished in constant time (ring::hmac::verify).
pub fn verify_finished(hash: Hash, base_key: &[u8], transcript_hash: &[u8], received: &[u8]) -> bool {
  let finished_key = hkdf_expand_label(hash, base_key, "finished", b"", hash.len());
  hmac::verify(&hash.hmac_key(&finished_key), transcript_hash, received).is_ok()
}

impl TrafficKeys {
  pub fn derive(hash: Hash, aead: Aead, traffic_secret: &[u8]) -> Self {
    let key = hkdf_expand_label(hash, traffic_secret, "key", b"", aead.key_len());
    let mut iv = [0u8; 12];
    iv.copy_from_slice(&hkdf_expand_label(hash, traffic_secret, "iv", b"", 12));
    TrafficKeys { aead, key, iv }
  }
}

  pub fn open(&self, seq: u64, record: &[u8]) -> Result<(u8, Vec<u8>), OpenError> {
    if record.len() < 5 {
      return Err(OpenError::Truncated);
    }
    let (header, body) = record.split_at(5);
    // per-record nonce = iv XOR seq, seq left-padded to 12 bytes
    let mut nonce = self.iv;
    for (n, s) in nonce[4..].iter_mut().zip(seq.to_be_bytes()) {
      *n ^= s;
    }
    let key = aead::UnboundKey::new(self.aead.algorithm(), &self.key).map_err(|_| OpenError::BadKey)?;
    let key = aead::LessSafeKey::new(key);
    let mut buf = body.to_vec();
    let plain = key
      .open_in_place(aead::Nonce::assume_unique_for_key(nonce), aead::Aad::from(header), &mut buf)
      .map_err(|_| OpenError::Decrypt)?;
    // TLSInnerPlaintext = content | ContentType | zeros
    let end = plain.iter().rposition(|&b| b != 0).ok_or(OpenError::NoContentType)?;
    Ok((plain[end], plain[..end].to_vec()))
  }

  let mut transcript = Vec::new();
  let mut hashes = Vec::new();
  for r in &randoms {
    transcript.extend_from_slice(r);
    hashes.push(Hash::Sha256.hash(&transcript));
  }

running 7 tests
test finished_round_trip_and_tamper ... ok
test draft07_traffic_key ... ok
test acvp_full_chain ... ok
test rfc5869_a1 ... ok
test acvp_flipped_dhe_breaks_only_later_secrets ... ok
test rfc5869_a3_empty_salt_and_info ... ok
test rustls_openssl_vectors ... ok

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

test acvp_flipped_dhe_breaks_only_later_secrets ... FAILED
test acvp_full_chain ... FAILED
test draft07_traffic_key ... FAILED
test finished_round_trip_and_tamper ... ok
test rfc5869_a1 ... ok
test rfc5869_a3_empty_salt_and_info ... ok
test rustls_openssl_vectors ... FAILED
...
test result: FAILED. 3 passed; 4 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

record 4: inner type 22, 509 bytes
  handshake type 8 (10 bytes)
  handshake type 11 (367 bytes)
  handshake type 15 (80 bytes)
  Finished(52) server verify_data matches: true
record 6: inner type 22, Finished(52) client verify_data matches: true
  same check with the transcript cut before server Finished: false
record 7: SERVER_TRAFFIC_SECRET_0 seq 0 -> inner type 22, 162 bytes
record 8: CLIENT_TRAFFIC_SECRET_0 seq 0 -> inner type 23, "ping"
record 9: SERVER_TRAFFIC_SECRET_0 seq 1 -> inner type 23, "pong"
record 9 with seq 0 instead: Some("record 9: Decrypt")

test acvp_flipped_dhe_breaks_only_later_secrets ... ok
test draft07_traffic_key ... ok
test finished_round_trip_and_tamper ... ok
test rfc5869_a1 ... ok
test rfc5869_a3_empty_salt_and_info ... ok
test rustls_openssl_vectors ... FAILED
test acvp_full_chain ... FAILED
thread 'rustls_openssl_vectors' (7545574) panicked at tests/vectors.rs:126:5:
...
thread 'acvp_full_chain' (7545569) panicked at tests/vectors.rs:91:5:
assertion `left == right` failed: client_handshake_traffic_secret
...
test result: FAILED. 5 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s