Method SSL.Connection()->new_traffic_state()

class SSL.Connection

Method new_traffic_state

State new_traffic_state(string(8bit) secret, bool for_write, KeySchedule|void ks)

Description

TLS 1.3 and later: build a fresh State keyed from a traffic secret (RFC 8446 section 7.3), for immediate use as either current_read_state or current_write_state.

Unlike TLS 1.0-1.2 (Session.generate_keys()/new_cipher_states(), where keys are only taken into use when a PACKET_change_cipher_spec is seen), TLS 1.3 rekeys at fixed protocol points, so the caller assigns the result directly rather than queuing it in pending_read_state/pending_write_state.

Parameter secret

A traffic secret from key_schedule, eg key_schedule->client_handshake_traffic_secret.

Parameter for_write

True to set up an encrypting (write) state, false for a decrypting (read) state.

Parameter ks

TLS 1.3 0-RTT only: an explicit KeySchedule to use instead of key_schedule -- needed because ClientConnection.client_hello() derives client_early_traffic_secret (RFC 8446 section 7.1) from a throwaway, PSK-binder-only key schedule object, before the real key_schedule field exists (that isn't built until the ServerHello arrives). traffic_key_iv() only depends on the key schedule's hash algorithm, which is identical either way (see client_hello()'s own reasoning for reusing a throwaway object for the PSK binder in the first place), so this is safe.