noxtls 0.2.20

TLS/DTLS protocol and connection state machine for the noxtls Rust stack.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

// Copyright (c) 2019-2026, Argenox Technologies LLC
// All rights reserved.
//
// SPDX-License-Identifier: GPL-2.0-only OR LicenseRef-Argenox-Commercial-License
//
// This file is part of the NoxTLS Library.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by the
// Free Software Foundation; version 2 of the License.
//
// Alternatively, this file may be used under the terms of a commercial
// license from Argenox Technologies LLC.
//
// See `noxtls/LICENSE` and `noxtls/LICENSE.md` in this repository for full details.
// CONTACT: info@argenox.com

//! TLS/DTLS protocol logic: `Connection` state machine, record framing, DTLS datagram helpers, KDF labels,
//! PSK ticket cache, and deterministic key material for tests and tooling.

mod connection;
mod dtls;
mod handshake;
mod kdf;
mod key_provider;
mod keyshare;
#[cfg(feature = "provider-psa")]
mod psa_provider;
mod psk;
mod record;
#[cfg(test)]
mod security_review_tests;
mod state;
mod tls_wire;

pub const NOXTLS_TLS13_NAMED_GROUP_SECP256R1: u16 = 0x0017;
pub const NOXTLS_TLS13_NAMED_GROUP_SECP384R1: u16 = 0x0018;
pub const NOXTLS_TLS13_NAMED_GROUP_SECP521R1: u16 = 0x0019;
pub const NOXTLS_TLS13_NAMED_GROUP_X25519: u16 = 0x001D;
pub const NOXTLS_TLS13_NAMED_GROUP_X448: u16 = 0x001E;
pub const NOXTLS_TLS13_NAMED_GROUP_BRAINPOOLP256R1TLS13: u16 = 0x001F;
pub const NOXTLS_TLS13_NAMED_GROUP_BRAINPOOLP384R1TLS13: u16 = 0x0020;
pub const NOXTLS_TLS13_NAMED_GROUP_BRAINPOOLP512R1TLS13: u16 = 0x0021;
pub const NOXTLS_TLS13_NAMED_GROUP_MLKEM768: u16 = 0x0201;
pub const NOXTLS_TLS13_NAMED_GROUP_SECP256R1_MLKEM768_HYBRID: u16 = 0x11EB;
pub const NOXTLS_TLS13_NAMED_GROUP_X25519_MLKEM768_HYBRID: u16 = 0x11EC;
pub const NOXTLS_TLS13_NAMED_GROUP_SECP384R1_MLKEM1024_HYBRID: u16 = 0x11ED;

pub use connection::{
    noxtls_parse_tls13_ocsp_staple_info, noxtls_verify_tls13_ocsp_staple, ClientHelloExtensions,
    ClientHelloInfo, Connection, DtlsOperationalPolicy, DtlsOperationalProfile, ProtectedRecord,
    Tls13EarlyDataOperationalPolicy, Tls13EarlyDataOperationalProfile, Tls13EarlyDataReplayState,
    Tls13EarlyDataTelemetry, Tls13OcspStapleInfo, Tls13OcspStapleVerification,
    Tls13OcspStapleVerifier, Tls13QuicInitialSecrets, Tls13QuicNextTrafficSecrets,
    Tls13QuicPacketProtectionKeys, Tls13QuicTrafficSecretSnapshot, Tls13ServerIdentity,
    Tls13ServerIdentityKey, TLS13_QUIC_EXPORTER_LABEL_CLIENT_1RTT,
    TLS13_QUIC_EXPORTER_LABEL_SERVER_1RTT,
};
pub use dtls::{
    noxtls_apply_dtls13_ack_ranges, noxtls_dtls13_aes128gcm_record_size,
    noxtls_encode_dtls12_handshake_fragments, noxtls_encode_dtls13_ack,
    noxtls_encode_dtls13_record_header, noxtls_encode_dtls13_record_packet,
    noxtls_encode_dtls_record_header, noxtls_encode_dtls_record_packet,
    noxtls_open_dtls13_aes128gcm_record, noxtls_open_dtls13_unified_aes128gcm_record,
    noxtls_parse_dtls12_handshake_fragment, noxtls_parse_dtls13_ack,
    noxtls_parse_dtls13_record_header, noxtls_parse_dtls13_record_packet,
    noxtls_parse_dtls_record_header, noxtls_parse_dtls_record_packet,
    noxtls_reassemble_dtls12_handshake_fragments, noxtls_seal_dtls13_aes128gcm_record,
    noxtls_seal_dtls13_unified_aes128gcm_record, Dtls13AckRange, Dtls13Flight, Dtls13RecordHeader,
    Dtls13TransportEvent, DtlsEpochReplayTracker, DtlsFlightRecord, DtlsFlightRetransmitTracker,
    DtlsRecordHeader, DtlsReplayWindow,
};
pub use kdf::{
    noxtls_hkdf_extract_for_hash, noxtls_hkdf_extract_with_salt_for_hash,
    noxtls_tls13_expand_label_for_hash, HashAlgorithm,
};
pub use key_provider::{
    ExternalKeyHandle, ExternalKeyProvider, KeyDecryptAlgorithm, KeyDecryptRequest,
    KeyDeriveAlgorithm, KeyDeriveRequest, KeySignAlgorithm, KeySignRequest, SoftwareKeyProvider,
};
pub use keyshare::{
    noxtls_derive_deterministic_p256_private, noxtls_derive_deterministic_x25519_private,
    noxtls_derive_tls13_p256_shared_secret, noxtls_derive_tls13_x25519_shared_secret,
    noxtls_p256_generate_private_key_with_entropy,
    noxtls_tls13_client_hello_offers_supported_key_exchange,
    noxtls_tls13_key_share_group_supported, noxtls_tls13_signature_algorithm_supported,
    noxtls_x25519_generate_private_key_with_entropy,
};
#[cfg(feature = "provider-psa")]
pub use psa_provider::PsaExternalKeyProvider;
pub use psk::{ResumptionTicket, TicketStore, TicketUsagePolicy};
pub use state::{
    AlertDescription, AlertLevel, CipherSuite, HandshakeState, RecordContentType, TlsRole,
    TlsVersion,
};
pub use tls_wire::{
    split_tls13_handshake_payload, TlsRecordDeframer, TLS_MAX_RECORD_PAYLOAD_LEN,
    TLS_RECORD_HEADER_LEN,
};