ekmFromMasterSecret generates exported keying material as defined in RFC 5705.

explicitNonceLen returns the number of bytes of explicit nonce or IV included in each record. Explicit nonces are present only in CBC modes after TLS

explicitNonceLen returns the number of bytes of explicit nonce included in each record. This is eight for older AEADs and zero for modern ones.

exportKeyingMaterial implements RFC5705 exporters for TLS 1.3 according to RFC 8446, Section 7.5.

getCertificate returns the best certificate for the given ClientHelloInfo, defaulting to the first element of c.Certificates.

Does the handshake, either a full one or resumes old session. Requires hs.c, hs.hello, hs.serverHello, and, optionally, hs.session to be set.

hashForClientCertificate returns the handshake messages so far, pre-hashed if necessary, suitable for signing by a TLS client certificate.

hashForServerKeyExchange hashes the given slices and returns their digest using the given hash function (for >= TLS 1.2) or using a default based on t

initLegacySessionTicketKeyRLocked ensures the legacy SessionTicketKey field is randomized if empty, and that sessionTicketKeys is populated from it ot

keysFromMasterSecret generates the connection keys from the master secret, given the lengths of the MAC key, cipher key and IV, as defined in RFC 2246

leaf returns the parsed leaf certificate, either from c.Leaf or by parsing the corresponding c.Certificate[0].

masterFromPreMasterSecret generates the master secret from the pre-master secret. See RFC 5246, Section 8.1.

negotiateALPN picks a shared ALPN protocol that both sides support in server preference order. If ALPN is not configured or the peer doesn't support i

nextTrafficSecret generates the next traffic secret, given the current one, according to RFC 8446, Section 7.2.

prf12 implements the TLS 1.2 pseudo-random function, as defined in RFC 5246, Section 5.

readFromUntil reads from r into c.rawInput until c.rawInput contains at least n bytes or else returns an error.

readUint64 decodes a big-endian, 64-bit value into out and advances over it. It reports whether the read was successful.

sendDummyChangeCipherSpec sends a ChangeCipherSpec record for compatibility with middleboxes that didn't implement TLS correctly. See RFC 8446, Append

sendDummyChangeCipherSpec sends a ChangeCipherSpec record for compatibility with middleboxes that didn't implement TLS correctly. See RFC 8446, Append

serverSum returns the contents of the verify_data member of a server's Finished message.

sha1Hash calculates a SHA1 hash over the given byte slices.

supportedVersionsFromMax returns a list of supported versions derived from a legacy maximum version value. Note that only versions supported by this l

supportsECDHE returns whether ECDHE key exchanges can be used with this pre-TLS 1.3 client.

updateBinders updates the m.pskBinders field, if necessary updating the cached marshaled representation. The supplied binders must have the same lengt

verifyServerCertificate parses and verifies the provided chain, setting c.verifiedChains and c.peerCertificates or sending the appropriate alert.

CipherSuites returns a list of cipher suites currently implemented by this package, excluding those with security issues, which are returned by Insecu

Client returns a new TLS client side connection using conn as the underlying transport. The config cannot be nil: users must set either ServerName or

Clone returns a shallow clone of c or nil if c is nil. It is safe to clone a Config that is being used concurrently by a TLS client or server.

DialWithDialer connects to the given network address using dialer.Dial and then initiates a TLS handshake, returning the resulting TLS connection. Any

InsecureCipherSuites returns a list of cipher suites currently implemented by this package and which have security issues. Most applications should n

NewListener creates a Listener which accepts connections from an inner Listener and wraps each connection with Server. The configuration config must b

Server returns a new TLS server side connection using conn as the underlying transport. The configuration config must be non-nil and must include at l

X509KeyPair parses a public/private key pair from a pair of PEM encoded data. On successful return, Certificate.Leaf will be nil because the parsed fo

certificateRequestInfoFromMsg generates a CertificateRequestInfo from a TLS <= 1.2 CertificateRequest, making an effort to fill in missing information

checkForResumption reports whether we should perform resumption on this connection.

cloneHash uses the encoding.BinaryMarshaler and encoding.BinaryUnmarshaler interfaces implemented by standard library hashes to clone the state of in

decrypt authenticates and decrypts the record if protection is active at this stage. The returned plaintext might overlap with the input.

encrypt encrypts payload, adding the appropriate nonce and/or MAC, and appends it to record, which must already contain the record header.

extractPadding returns, in constant time, the length of the padding to remove from the end of payload. It also returns a byte which is equal to 255 if

On the server side, the first two methods are called in order. In the case that the key agreement protocol doesn't use a ServerKeyExchange message, ge

handlePostHandshakeMessage processes a handshake message arrived after the handshake is complete. Up to TLS 1.2, it indicates the start of a renegotia

handleRenegotiation processes a HelloRequest handshake message.

hostnameInSNI converts name into an appropriate hostname for SNI. Literal IP addresses and absolute FQDNs are not permitted as SNI values. See RFC 606

illegalClientHelloChange reports whether the two ClientHello messages are different, with the exception of the changes allowed before and after a Hell

maxPayloadSizeForWrite returns the maximum TLS payload size to use for the next application data record. There is the following trade-off: - For late

md5SHA1Hash implements TLS 1.0's hybrid hash function which consists of the concatenation of an MD5 and SHA1 hash.

Attempt to parse the given private key DER block. OpenSSL 0.9.8 generates PKCS #1 private keys by default, while OpenSSL 1.0.0 generates PKCS #8 keys.