Export handshake Finished base keys

Co-authored-by: Julia <supa@juliaelena.ro>
Co-authored-by: Julia <git@juliapixel.com>
Co-authored-by: Jade <jadey@tutanota.com>

Author: 4 people

internal/handshake/traffic_secrets.go

@@ -341,6 +341,32 @@ func ensureMasterSecret(state *dtlsstate.State13) ([]byte, error) {
 	return masterSecret, nil
 }
 
+// ClientHandshakeFinishedBaseKey returns the client handshake traffic secret,
+// which is the TLS 1.3 Finished base key for the client's Finished message.
+func ClientHandshakeFinishedBaseKey(state *dtlsstate.State13) ([]byte, error) {
+	if state == nil {
+		return nil, dtlserrors.ErrCipherSuiteNotSet
+	}
+	if len(state.KeySchedule.HandshakeTraffic.Client) == 0 {
+		return nil, dtlserrors.ErrLengthMismatch
+	}
+
+	return state.KeySchedule.HandshakeTraffic.Client, nil
+}
+
+// ServerHandshakeFinishedBaseKey returns the server handshake traffic secret,
+// which is the TLS 1.3 Finished base key for the server's Finished message.
+func ServerHandshakeFinishedBaseKey(state *dtlsstate.State13) ([]byte, error) {
+	if state == nil {
+		return nil, dtlserrors.ErrCipherSuiteNotSet
+	}
+	if len(state.KeySchedule.HandshakeTraffic.Server) == 0 {
+		return nil, dtlserrors.ErrLengthMismatch
+	}
+
+	return state.KeySchedule.HandshakeTraffic.Server, nil
+}
+
 // CertificateVerifyInputFromTranscript returns the TLS 1.3 CertificateVerify
 // input for the current transcript snapshot.
 func CertificateVerifyInputFromTranscript(
@@ -462,8 +488,7 @@ func verifyFinishedData(hashFunc func() hash.Hash, baseKey, transcriptHash, veri
 }
 
 // VerifyFinishedDataFromTranscript verifies TLS 1.3 Finished verify_data
-// against the current transcript snapshot. It does not commit the Finished
-// message to the transcript.
+// against the current transcript snapshot.
 func VerifyFinishedDataFromTranscript(
 	hashFunc func() hash.Hash,
 	baseKey []byte,

internal/handshake/transcript_test.go

@@ -865,6 +865,29 @@ func TestCertificateVerifyInput13ServerAndClient(t *testing.T) {
 	assert.NotEqual(t, serverInput, clientInput)
 }
 
+func TestHandshakeFinishedBaseKeys13(t *testing.T) {
+	clientSecret := bytes.Repeat([]byte{0x11}, sha256.Size)
+	serverSecret := bytes.Repeat([]byte{0x22}, sha256.Size)
+	state := newTestState13(false)
+	state.KeySchedule.HandshakeTraffic = dtlsstate.TrafficSecrets{
+		Client: clientSecret,
+		Server: serverSecret,
+	}
+
+	clientBaseKey, err := ClientHandshakeFinishedBaseKey(state)
+	require.NoError(t, err)
+	assert.Equal(t, clientSecret, clientBaseKey)
+
+	serverBaseKey, err := ServerHandshakeFinishedBaseKey(state)
+	require.NoError(t, err)
+	assert.Equal(t, serverSecret, serverBaseKey)
+
+	_, err = ClientHandshakeFinishedBaseKey(newTestState13(false))
+	assert.ErrorIs(t, err, dtlserrors.ErrLengthMismatch)
+	_, err = ServerHandshakeFinishedBaseKey(newTestState13(false))
+	assert.ErrorIs(t, err, dtlserrors.ErrLengthMismatch)
+}
+
 func TestFinishedVerifyData13(t *testing.T) {
 	baseKey := bytes.Repeat([]byte{0x11}, sha256.Size)
 	transcriptHash := bytes.Repeat([]byte{0x22}, sha256.Size)