Function ExpandLabel

tls13/tls13.go:20–41

We don't set the service indicator in this package but we delegate that to the underlying functions because the TLS 1.3 KDF does not have a standard of its own. ExpandLabel implements HKDF-Expand-Label from RFC 8446, Section 7.1.

(hash func() H, secret []byte, label string, context []byte, length int)

// ExpandLabel implements HKDF-Expand-Label from RFC 8446, Section 7.1.
func ExpandLabel[H hash.Hash](hash func() H, secret []byte, label string, context []byte, length int) []byte {
	if len("tls13 ")+len(label) > 255 || len(context) > 255 {
		// It should be impossible for this to panic: labels are fixed strings,
		// and context is either a fixed-length computed hash, or parsed from a
		// field which has the same length limitation.
		//
		// Another reasonable approach might be to return a randomized slice if
		// we encounter an error, which would break the connection, but avoid
		// panicking. This would perhaps be safer but significantly more
		// confusing to users.
		panic("tls13: label or context too long")
	}
	hkdfLabel := make([]byte, 0, 2+1+len("tls13 ")+len(label)+1+len(context))
	hkdfLabel = binary.BigEndian.AppendUint16(hkdfLabel, uint16(length))
	hkdfLabel = append(hkdfLabel, byte(len("tls13 ")+len(label)))
	hkdfLabel = append(hkdfLabel, "tls13 "...)
	hkdfLabel = append(hkdfLabel, label...)
	hkdfLabel = append(hkdfLabel, byte(len(context)))
	hkdfLabel = append(hkdfLabel, context...)
	b, _ := hkdf.Expand(hash, secret, string(hkdfLabel), length)
	return b
}

func extract[H hash.Hash](hash func() H, newSecret, currentSecret []byte) []byte {
	if newSecret == nil {