SSL.Crypto.TLS12KeySchedule (ex_ssl v1.0.0-rc.9)

Pure TLS 1.2 PRF and master secret derivation for the bounded ECDHE-GCM subset.

Summary

Functions

derive(id, premaster, transcript, client_random, server_random)

derive_legacy(id, premaster, client_random, server_random)

Derives the RFC 5246 master and record states for a full handshake without EMS.

finished(id, master, role, transcript)

prf(hash, secret, label, seed, length)

resume(id, master, client_random, server_random)

Derives fresh record states from a master and this connection's randoms.

suite(id)

Functions

derive(id, premaster, transcript, client_random, server_random)

@spec derive(term(), binary(), binary(), binary(), binary()) ::
  {:ok,
   %{
     master_secret: binary(),
     read_state: SSL.Protocol.TLS12Record.t(),
     write_state: SSL.Protocol.TLS12Record.t()
   }}
  | {:error, term()}

derive_legacy(id, premaster, client_random, server_random)

@spec derive_legacy(term(), binary(), binary(), binary()) ::
  {:ok,
   %{
     master_secret: binary(),
     read_state: SSL.Protocol.TLS12Record.t(),
     write_state: SSL.Protocol.TLS12Record.t()
   }}
  | {:error, term()}

Derives the RFC 5246 master and record states for a full handshake without EMS.

The caller must prevent session reuse and application authentication exports from the resulting legacy master secret.

finished(id, master, role, transcript)

@spec finished(term(), binary(), :client | :server, binary()) ::
  {:ok, <<_::96>>} | {:error, term()}

prf(hash, secret, label, seed, length)

@spec prf(:sha256 | :sha384, binary(), binary(), binary(), non_neg_integer()) ::
  {:ok, binary()} | {:error, term()}

resume(id, master, client_random, server_random)

@spec resume(term(), binary(), binary(), binary()) ::
  {:ok,
   %{
     master_secret: binary(),
     read_state: SSL.Protocol.TLS12Record.t(),
     write_state: SSL.Protocol.TLS12Record.t()
   }}
  | {:error, term()}

Derives fresh record states from a master and this connection's randoms.

suite(id)

@spec suite(term()) ::
  {:error, {:unsupported_cipher_suite, term()}}
  | {:ok,
     %{
       :id => term(),
       :key_exchange => :ecdsa | :rsa,
       :version => 771,
       optional(term()) => term()
     }}