DTLS 1.3: use the "dtls13" HKDF label prefix (RFC 9147 5.9), fixes interop with BoringSSL - #1

Closed

JonathanLennox wants to merge 36 commits into

mondain:dtls13/4-post-handshakefrom

JonathanLennox:dtls13-label-prefix

Commits on Sep 12, 2026

Add the DTLS 1.3 reliable handshake and pack handshake flights into datagrams
mondain
committed
4fb0712
Offer DTLS 1.3 from the DTLS client, relates to github #1468.
mondain
committed
96cdc3a
Complete the client half of a DTLS 1.3 handshake, relates to github #1468.
mondain
committed
71f05a3
Hash DTLS 1.3 handshake transcripts without the DTLS message header, relates to github #1468.
mondain
committed
201baad
Fail loudly if a DTLS handshake transcript is read while undecided, relates to github #1468.
mondain
committed
c2c8641
Complete the server half of a DTLS 1.3 handshake, relates to github #1468.
mondain
committed
5d0ed58
Retain the DTLS 1.3 handshake epoch after the handshake completes, relates to github #1468.
mondain
committed
b7423b4
Add an end-to-end DTLS 1.3 handshake test, relates to github #1468.
mondain
committed
e6d24be
Bound the DTLS 1.3 epochs retained after the handshake, relates to github #1468.
mondain
committed
f157aac
Answer only a retransmission of the peer's final flight with an ACK, relates to github #1468.
mondain
committed
df605b7
Test the DTLS 1.3 retransmitted-ACK path with a reordered final flight, relates to github #1468.
mondain
committed
9104436
Re-arm the DTLS 1.3 retained-epoch application data test, relates to github #1468.
mondain
committed
fe48905
Add the DTLS 1.3 HelloRetryRequest and its cookie, relates to github #1468.
mondain
committed
3101e4b
Refuse a DTLS 1.2 HelloVerifyRequest on a DTLS 1.3 handshake, relates to github #1468.
mondain
committed
37e8132
Support DTLS 1.3 client authentication during the handshake, relates to github #1468.
mondain
committed
5e67653
Cover the DTLS 1.3 exporter, use_srtp and version fallback, relates to github #1468.
mondain
committed
2d1709e
Restore the DTLS 1.3 no-CertificateRequest and authenticated-flight coverage, relates to github #1468.
mondain
committed
75d44b4
Drop the DTLS 1.3 authenticated flight deterministically and prove its retransmission, relates to github #1468.
mondain
committed
c992879
Gate the DTLS secure renegotiation notification on the selected version, relates to github #1468.
mondain
committed
d68f631
Assert the HelloRetryRequest synthetic transcript bytes directly, relates to github #1468.
mondain
committed
717a783
Derive the retained handshake epoch and document the DTLS 1.3 epoch retention, relates to github #1468.
mondain
committed
23bcade
Refuse to negotiate DTLS 1.3 behind a HelloVerifyRequest front end, relates to github #1468.
mondain
committed
205b036
Leave generate13EncryptedExtensions without an unused state parameter, relates to github #1468.
mondain
committed
170e6a0
Assert the server's own refusal and the second ClientHello's message_seq, relates to github #1468.
mondain
committed
7947c73
Complete the handshake in the DTLS 1.3 record layer test harness, relates to github #1468.
mondain
committed
14b1741
Let TlsCryptoParameters resolve security parameters after the handshake, relates to github #1468.
mondain
committed
516df10
Route TlsCryptoParameters and Tls13NullCipher through their own accessors, relates to github #1468.
mondain
committed
9d5e887
Resolve DTLS 1.3 read epochs from one ordered live set, relates to github #1468.
mondain
committed
538992f
Hold a derived DTLS 1.3 write epoch before installing it, relates to github #1468.
mondain
committed
5781137
Own DTLS 1.3 post-handshake messages and acknowledgements, relates to github #1468.
mondain
committed
f1f62af
Install a new DTLS 1.3 read epoch on a peer KeyUpdate and retire the old one on first decrypt, relates to github #1468.
mondain
committed
388d09b
Gate the new DTLS 1.3 write epoch on the KeyUpdate acknowledgement, relates to github #1468.
mondain
committed
ef2edaa
Drive a DTLS 1.3 key update through the real client and server, relates to github #1468.
mondain
committed
f032411
Correct the peer-keyed epoch reasoning and apply the branch review, relates to github #1468.
mondain
committed
4d74017
State the peer-keyed nonce reuse precisely and document the lock order, relates to github #1468.
mondain
committed
b022ef2

Commits on Sep 14, 2026

Use the "dtls13" HKDF-Expand-Label prefix for the DTLS 1.3 key schedule (RFC 9147 section 5.9) instead of TLS 1.3's "tls13 ", so DTLS 1.3 traffic keys, record number keys, Finished keys and exporte…
JonathanLennox
committed
bc049ea