cafe 1.0.1

BouncyCastle TLS 1.3 Handshake Flow

Based on BouncyCastle C# source (bc-csharp-master/crypto/src/tls/).

State Machine

Key states defined in TlsProtocol.cs:

Full Handshake Sequence (No HelloRetryRequest)

Client                          Server
  |                               |
  |  1. ClientHello               |
  |------------------------------>|  CS_START -> CS_CLIENT_HELLO
  |                               |  ReceiveClientHelloMessage()
  |                               |  Generate13ServerHello()
  |                               |    - Negotiate version/cipher suite
  |                               |    - ECDHE key exchange (embedded)
  |                               |    - Derive earlySecret, handshakeSecret, masterSecret
  |                               |
  |  2. ServerHello               |
  |<------------------------------|  CS_SERVER_HELLO
  |                               |  SendServerHelloMessage()
  |                               |
  |  [ChangeCipherSpec]           |
  |<------------------------------|  Middlebox compatibility (RFC 8446 D.4)
  |                               |
  |  === Encrypted from here ===  |
  |                               |  Send13ServerHelloCoda()
  |                               |    Establish13PhaseHandshake()
  |                               |      -> derive "c hs traffic", "s hs traffic"
  |                               |    EnablePendingCipherWrite()
  |                               |
  |  3. EncryptedExtensions       |
  |<------------------------------|  CS_SERVER_ENCRYPTED_EXTENSIONS
  |                               |  Send13EncryptedExtensionsMessage()
  |                               |
  |  4. [CertificateRequest]      |
  |<------------------------------|  (optional, client auth)
  |                               |
  |  5. Certificate               |
  |<------------------------------|  CS_SERVER_CERTIFICATE
  |                               |  Establish13ServerCredentials() -> GetCredentials()
  |                               |  Send13CertificateMessage()
  |                               |    Certificate.Encode() requires:
  |                               |      TLS 1.3: certificateRequestContext = EmptyBytes (not null)
  |                               |      TLS 1.2: certificateRequestContext = null
  |                               |
  |  6. CertificateVerify         |
  |<------------------------------|  Generate13CertificateVerify()
  |                               |    TLS 1.3 only allows RSA-PSS (not PKCS#1 v1.5)
  |                               |    SignatureAndHashAlgorithm must use Intrinsic hash
  |                               |
  |  7. Finished                  |
  |<------------------------------|  CS_SERVER_FINISHED
  |                               |  Send13FinishedMessage()
  |                               |  Establish13PhaseApplication()
  |                               |    -> derive "c ap traffic", "s ap traffic"
  |                               |  EnablePendingCipherWrite()
  |                               |
  |  8. [Certificate]             |
  |------------------------------>|  (only if CertificateRequest was sent)
  |  9. [CertificateVerify]       |
  |------------------------------>|
  |                               |
  |  10. Finished                 |
  |------------------------------>|  CS_CLIENT_FINISHED
  |                               |  Receive13ClientFinished()
  |                               |    Verify client's verify_data
  |                               |  EnablePendingCipherRead()
  |                               |  CompleteHandshake()
  |                               |
  | <==== Application Data ====> |  CS_END

Key Exchange (ECDHE)

TLS 1.3 key exchange happens inside Generate13ServerHello(), NOT via the m_keyExchange object:

1. SelectKeyShareGroup() - negotiate ECDH group from client/server supported groups
2. FindEarlyKeyShare() - check if client sent a share for the negotiated group
3. If no match → trigger HelloRetryRequest
4. If match → create TlsAgreement:
   • agreement.ReceivePeerValue(clientShare.KeyExchange) - feed client's public key
   • agreement.GenerateEphemeral() - generate server ephemeral key pair
   • agreement.CalculateSecret() - compute shared secret

Secret Derivation

Three phases of key derivation via HKDF:

0-RTT:  earlySecret = HKDF-Extract(0, PSK_or_0)
                              |
Handshake: handshakeSecret = HKDF-Extract(derivedSecret, sharedSecret)
                              |
App:       masterSecret = HKDF-Extract(derivedSecret, 0)

• Establish13PhaseSecrets() - derives all three phase secrets
• Establish13PhaseHandshake() - derives handshake traffic keys from handshakeSecret
• Establish13PhaseApplication() - derives application traffic keys from masterSecret

TLS 1.3 vs TLS 1.2 Differences in BouncyCastle

Pitfalls Encountered

1. KeyExchangeAlgorithm.NULL (0)

TLS 1.3 cipher suites map to KeyExchangeAlgorithm.NULL = 0. DefaultTlsServer.GetCredentials() doesn't handle this case, throws internal_error. Fix: override GetCredentials() to handle NULL.

2. Certificate.Encode() certificateRequestContext

Certificate constructed via new Certificate(TlsCertificate[]) sets certificateRequestContext = null. TLS 1.3's Encode() asserts it must be non-null. Fix: for TLS 1.3, reconstruct with new Certificate(TlsUtilities.EmptyBytes, entries).

3. RSA-PSS SignatureAndHashAlgorithm

GetInstance(HashAlgorithm.sha256, SignatureAlgorithm.rsa_pss_rsae_sha256) creates a wrong instance (hash=4). The correct instance has hash=8 (Intrinsic). Fix: use SignatureAndHashAlgorithm.rsa_pss_rsae_sha256 static field. TLS 1.3 clients reject PKCS#1 v1.5 in CertificateVerify with illegal_parameter(47).