Module channel_binding 

TLS channel binding for session proofs (anti-relay).

A pairing session runs inside a TLS connection, but the cryptographic proofs it carries (the AEAD-sealed crate::envelope::Envelopes) are, by themselves, transport-agnostic: a proof captured on one TLS connection and replayed onto a different TLS connection would still open, because nothing ties the proof to the channel it was minted on. That is the classic relay / MITM attack — an attacker terminates the victim’s TLS session, lifts a valid proof off it, and presents it on its own session to a third party.

The fix is channel binding: fold a per-connection secret that only the two TLS endpoints know into the proof, so a proof minted on channel A cannot be opened on channel B. The secret is the TLS exporter — exported keying material per RFC 5705 (TLS ≤1.2) / RFC 8446 §7.5 (TLS 1.3), using the RFC 9266 tls-exporter label. Both endpoints of a TLS connection derive the same exporter value; two independent connections derive different values. Folding it into the envelope key (and AAD) makes the proof open only on the channel that minted it. This is the same shape as token-binding (RFC 8471) and DPoP (RFC 9449): a possession proof scoped to its transport.

Wire / interop parameters (NORMATIVE)

• Label: TLS_EXPORTER_LABEL = EXPORTER-Channel-Binding (RFC 9266 §3). This is the registered label a stock TLS stack uses for the tls-exporter channel binding; matching it byte-for-byte is what lets an auths endpoint interoperate with any RFC 9266 peer.
• Context: absent (not empty). RFC 5705 distinguishes an absent context from a zero-length one; RFC 9266 specifies the exporter with no context value, so the adapter MUST pass “no context”, not b"".
• Length: TLS_EXPORTER_LEN = 32 bytes.

Ports and adapters

This crate is transport-agnostic (no TLS stack dependency). The act of extracting the exporter from a live connection is therefore a port: ChannelBindingProvider. The TLS-aware crates (the pairing daemon, the CLI LAN server, the mobile client) implement it as a thin adapter over their concrete stack’s export_keying_material — rustls’s ConnectionCommon::export_keying_material, OpenSSL’s SslRef::export_keying_material, Go’s ConnectionState.ExportKeyingMaterial. The core protocol only ever sees a parsed ChannelBinding.

Structs

ChannelBinding

A parsed TLS channel binding: the RFC 9266 tls-exporter keying material for one connection.

Enums

ChannelBindingError

Errors from parsing a channel binding or extracting one from a transport.

Constants

CHANNEL_BINDING_INFO

HKDF info domain separator for folding a channel binding into a derived key. Distinct from every other label in crate::domain_separation so a channel-bound key can never collide with an unbound one.

TLS_EXPORTER_LABEL

RFC 9266 §3 exporter label for the tls-exporter channel binding.

TLS_EXPORTER_LEN

Length, in bytes, of the exported keying material used as the binding.

Traits

ChannelBindingProvider

Port: extract the channel binding from a live transport.