/// This implements the horrifying TLS1.3 hack where PSK binders have a
/// data dependency on the message they are contained within.
This implements the horrifying TLS1.3 hack where PSK binders have a
data dependency on the message they are contained within.
This implements the horrifying TLS1 . 3 hack where PSK binders have a data dependency on the message they are contained within .
pub fn fill_in_psk_binder(sess: &mut ClientSessionImpl,
                          handshake: &mut HandshakeDetails,
                          hmp: &mut HandshakeMessagePayload) -> KeyScheduleEarly {
    // We need to know the hash function of the suite we're trying to resume into.
    let resuming = handshake.resuming_session.as_ref().unwrap();
    let suite = sess.find_cipher_suite(resuming.cipher_suite).unwrap();
    let hkdf_alg = suite.hkdf_algorithm;
    let suite_hash = suite.get_hash();
    // The binder is calculated over the clienthello, but doesn't include itself or its
    // length, or the length of its container.
    let binder_plaintext = hmp.get_encoding_for_binder_signing();
    let handshake_hash =
        handshake.transcript.get_hash_given(suite_hash, &binder_plaintext);
    // Run a fake key_schedule to simulate what the server will do if it choses
    // to resume.
    let key_schedule = KeyScheduleEarly::new(hkdf_alg, &resuming.master_secret.0);
    let real_binder = key_schedule.resumption_psk_binder_key_and_sign_verify_data(&handshake_hash);
    if let HandshakePayload::ClientHello(ref mut ch) = hmp.payload {
        ch.set_psk_binder(real_binder);
    };
    key_schedule
}
pub fn fill_in_psk_binder ( sess : & mut ClientSessionImpl , handshake : & mut HandshakeDetails , hmp : & mut HandshakeMessagePayload ) -> KeyScheduleEarly { // We need to know the hash function of the suite we're trying to resume into. let resuming = handshake . resuming_session . as_ref ( ) . unwrap ( ) ; let suite = sess . find_cipher_suite ( resuming . cipher_suite ) . unwrap ( ) ; let hkdf_alg = suite . hkdf_algorithm ; let suite_hash = suite . get_hash ( ) ; // The binder is calculated over the clienthello, but doesn't include itself or its // length, or the length of its container. let binder_plaintext = hmp . get_encoding_for_binder_signing ( ) ; let handshake_hash = handshake . transcript . get_hash_given ( suite_hash , & binder_plaintext ) ; // Run a fake key_schedule to simulate what the server will do if it choses // to resume. let key_schedule = KeyScheduleEarly :: new ( hkdf_alg , & resuming . master_secret . 0 ) ; let real_binder = key_schedule . resumption_psk_binder_key_and_sign_verify_data ( & handshake_hash ) ; if let HandshakePayload :: ClientHello ( ref mut ch ) = hmp . payload { ch . set_psk_binder ( real_binder ) ; } ; key_schedule }
This implements the horrifying TLS1.3 hack where PSK binders have a
data dependency on the message they are contained within.
This implements the horrifying TLS1 . 3 hack where PSK binders have a data dependency on the message they are contained within .
sess
&mut ClientSessionImpl
handshake
&mut HandshakeDetails
hmp
&mut HandshakeMessagePayload