Struct ClientHello 

pub struct ClientHello {
    pub client_key_package: HybridKeyPackage,
    pub client_verify_key: HybridVerifyingKey,
    pub nonce: [u8; 32],
    pub version: u8,
    pub cookie: Option<[u8; 32]>,
    pub pow_solution: Option<PoWSolution>,
    pub resume_session_id: Option<[u8; 32]>,
    pub resumption_binder: Option<[u8; 32]>,
    pub protocol_variant: Vec<u8>,
    pub early_data: Option<Vec<u8>>,
}

Client hello message (initiates handshake).

Carries the client’s hybrid key material, the pinned PROTOCOL_VERSION (transcript-bound), the DoS-gate fields (cookie / PoW), an optional resumption id, the build-side PROTOCOL_VARIANT tag, and an optional AEAD-sealed 0-RTT early_data blob.

Fields

client_key_package: HybridKeyPackage

hybrid public key for key exchange

client_verify_key: HybridVerifyingKey

hybrid verifying key for signatures

nonce: [u8; 32]

Random nonce (32 bytes) for replay protection

version: u8

Protocol version. Pinned to PROTOCOL_VERSION and bound into the signed handshake transcript; the server rejects any other value with HandshakeError::UnsupportedVersion.

cookie: Option<[u8; 32]>

Stateless generic cookie to prove IP ownership

pow_solution: Option<PoWSolution>

Proof-of-Work solution (if required by server)

resume_session_id: Option<[u8; 32]>

Optional session ID for 0-RTT resumption

resumption_binder: Option<[u8; 32]>

Resumption proof-of-possession binder (HS-03). Present iff resume_session_id is — a keyed PRF over resumption_secret || resume_session_id || nonce (see derive_resumption_binder). The server verifies it (constant-time) against the cached ticket’s secret before consuming the one-shot ticket, so a passive observer that copied the cleartext resume_session_id cannot burn a victim’s ticket. Bound into the transcript (the whole ClientHello is signed), so it is also tamper-evident. Placed after resume_session_id and before protocol_variant — borsh field order is wire-load-bearing.

protocol_variant: Vec<u8>

Cleartext copy of PROTOCOL_VARIANT. Lets the server reject a mismatched-mode client up front (before signature verification); the same value is bound into the handshake transcript so an attacker rewriting this field on the wire is still caught by the signature check.

early_data: Option<Vec<u8>>

Optional AEAD-sealed 0-RTT early-data — AES-256-GCM under a key both peers derive from the prior session’s resumption_secret via derive_early_data_keying. None means no 0-RTT data on this connect. The whole ClientHello (this field included) is covered by the transcript signature, so a tampered or stripped blob breaks the server’s signature check (Invariant 7).

Trait Implementations

impl BorshDeserialize for ClientHello

fn deserialize_reader<__R: Read>(reader: &mut __R) -> Result<Self, Error>

fn deserialize(buf: &mut &[u8]) -> Result<Self, Error>

Deserializes this instance from a given slice of bytes. Updates the buffer to point at the remaining bytes.

fn try_from_slice(v: &[u8]) -> Result<Self, Error>

Deserialize this instance from a slice of bytes.

fn try_from_reader<R>(reader: &mut R) -> Result<Self, Error>

where R: Read,

impl BorshSerialize for ClientHello

fn serialize<__W: Write>(&self, writer: &mut __W) -> Result<(), Error>

impl Clone for ClientHello

fn clone(&self) -> ClientHello

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientHello

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.