pqaudit 0.2.0

TLS post-quantum readiness auditor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

/// Fixed SHA-256("HelloRetryRequest") value from RFC 8446 ยง4.1.3
/// Used to detect HelloRetryRequests disguised as ServerHellos
const HRR_RANDOM: [u8; 32] = [
    0xCF, 0x21, 0xAD, 0x74, 0xE5, 0x9A, 0x61, 0x11, 0xBE, 0x1D, 0x8C, 0x02, 0x1E, 0x65, 0xB8, 0x91,
    0xC2, 0xA2, 0x11, 0x16, 0x7A, 0xBB, 0x8C, 0x5E, 0x07, 0x9E, 0x09, 0xE2, 0xC8, 0xA8, 0x33, 0x9C,
];

/// Checks whether a ServerHello's random bytes indicate a HelloRetryRequest.
/// Returns `true` if this is an HRR, `false` otherwise.
pub fn is_hrr(server_random: &[u8]) -> bool {
    server_random.len() == 32 && server_random == HRR_RANDOM
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn hrr_random_detected() {
        assert!(is_hrr(&HRR_RANDOM));
    }

    #[test]
    fn normal_random_not_hrr() {
        let normal = [0u8; 32];
        assert!(!is_hrr(&normal));
    }

    #[test]
    fn short_bytes_not_hrr() {
        assert!(!is_hrr(&[0x01, 0x02]));
    }
}