Add initial TLS 1.3 key schedule support with basic regress tests

ok jsing@ tb@

5 files changed, 685 insertions, 2 deletions

diff --git a/src/lib/libssl/Makefile b/src/lib/libssl/Makefile
index e912562a75..762ca0d18d 100644
--- a/src/lib/libssl/Makefile
+++ b/src/lib/libssl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.40 2018/11/05 05:45:15 jsing Exp $
+# $OpenBSD: Makefile,v 1.41 2018/11/07 19:43:12 beck Exp $
 
 .include <bsd.own.mk>
 .ifndef NOMAN
@@ -33,7 +33,8 @@ SRCS= \
         ssl_ciph.c ssl_stat.c ssl_rsa.c \
         ssl_asn1.c ssl_txt.c ssl_algs.c \
         bio_ssl.c ssl_err.c ssl_methods.c \
-        ssl_packet.c ssl_tlsext.c ssl_versions.c pqueue.c ssl_init.c
+        ssl_packet.c ssl_tlsext.c ssl_versions.c pqueue.c ssl_init.c \
+        tls13_key_schedule.c
 SRCS+=  s3_cbc.c
 SRCS+=  bs_ber.c bs_cbb.c bs_cbs.c
 
diff --git a/src/lib/libssl/tls13_internal.h b/src/lib/libssl/tls13_internal.h
new file mode 100644
index 0000000000..b1d24ef02b
--- /dev/null
+++ b/src/lib/libssl/tls13_internal.h
@@ -0,0 +1,58 @@
+/* $OpenBSD: tls13_internal.h,v 1.1 2018/11/07 19:43:12 beck Exp $ */
+/* Copyright (c) 2018, Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+struct tls13_secret {
+        uint8_t *data;
+        size_t len;
+};
+
+/* RFC 8446 Section 7.1  Page 92 */
+struct tls13_secrets {
+        int resumption;
+        int init_done;
+        int early_done;
+        int handshake_done;
+        int schedule_done;
+        int insecure; /* Set by tests */
+        struct tls13_secret zeros;
+        struct tls13_secret extracted_early;
+        struct tls13_secret binder_key;
+        struct tls13_secret client_early_traffic;
+        struct tls13_secret early_exporter_master;
+        struct tls13_secret derived_early;
+        struct tls13_secret extracted_handshake;
+        struct tls13_secret client_handshake_traffic;
+        struct tls13_secret server_handshake_traffic;
+        struct tls13_secret derived_handshake;
+        struct tls13_secret extracted_master;
+        struct tls13_secret client_application_traffic;
+        struct tls13_secret server_application_traffic;
+        struct tls13_secret exporter_master;
+        struct tls13_secret resumption_master;
+};
+
+struct tls13_secrets *tls13_secrets_new(size_t hash_length);
+void tls13_secrets_init(struct tls13_secrets *secrets, int resumption);
+void tls13_secrets_destroy(struct tls13_secrets *secrets);
+
+int tls13_derive_early_secrets(struct tls13_secrets *secrets,
+    const EVP_MD *digest,uint8_t *psk, size_t psk_len,
+    const struct tls13_secret *context);
+int tls13_derive_handshake_secrets(struct tls13_secrets *secrets,
+    const EVP_MD *digest, const uint8_t *ecdhe, size_t ecdhe_len,
+    const struct tls13_secret *context);
+int tls13_derive_application_secrets(struct tls13_secrets *secrets,
+    const EVP_MD *digest, const struct tls13_secret *context);
diff --git a/src/lib/libssl/tls13_key_schedule.c b/src/lib/libssl/tls13_key_schedule.c
new file mode 100644
index 0000000000..6aa8b65e70
--- /dev/null
+++ b/src/lib/libssl/tls13_key_schedule.c
@@ -0,0 +1,375 @@
+/* $OpenBSD: tls13_key_schedule.c,v 1.1 2018/11/07 19:43:12 beck Exp $ */
+/* Copyright (c) 2018, Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <string.h>
+#include <stdlib.h>
+
+#include <openssl/evp.h>
+#include <openssl/hkdf.h>
+
+#include "bytestring.h"
+#include "tls13_internal.h"
+
+void
+tls13_secrets_destroy(struct tls13_secrets *secrets)
+{
+        if (secrets == NULL)
+                return;
+
+        /* you can never be too sure :) */
+        freezero(secrets->zeros.data, secrets->zeros.len); 
+
+        freezero(secrets->extracted_early.data,
+            secrets->extracted_early.len);
+        freezero(secrets->binder_key.data,
+            secrets->binder_key.len);
+        freezero(secrets->client_early_traffic.data,
+            secrets->client_early_traffic.len);
+        freezero(secrets->early_exporter_master.data,
+            secrets->early_exporter_master.len);
+        freezero(secrets->derived_early.data,
+            secrets->derived_early.len);
+        freezero(secrets->extracted_handshake.data,
+            secrets->extracted_handshake.len);
+        freezero(secrets->client_handshake_traffic.data,
+            secrets->client_handshake_traffic.len);
+        freezero(secrets->server_handshake_traffic.data,
+            secrets->server_handshake_traffic.len);
+        freezero(secrets->derived_handshake.data,
+            secrets->derived_handshake.len);
+        freezero(secrets->extracted_master.data,
+            secrets->extracted_master.len);
+        freezero(secrets->client_application_traffic.data,
+            secrets->client_application_traffic.len);
+        freezero(secrets->server_application_traffic.data,
+            secrets->server_application_traffic.len);
+        freezero(secrets->exporter_master.data,
+            secrets->exporter_master.len);
+        freezero(secrets->resumption_master.data,
+            secrets->resumption_master.len);
+
+        freezero(secrets, sizeof(struct tls13_secrets));
+}
+
+/*
+ * Allocate a set of secrets for a key schedule using
+ * a size of hash_length from RFC 8446 section 7.1
+ */
+struct tls13_secrets *
+tls13_secrets_new(size_t hash_length)
+{
+        struct tls13_secrets *secrets = NULL;
+
+        if ((secrets = calloc(1, sizeof(struct tls13_secrets))) == NULL)
+                goto err;
+        if ((secrets->zeros.data = calloc(hash_length, sizeof(uint8_t))) == NULL)
+                goto err;
+        secrets->zeros.len = hash_length;
+
+        if ((secrets->extracted_early.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->extracted_early.len = hash_length;
+        if ((secrets->binder_key.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->binder_key.len = hash_length;
+        if ((secrets->client_early_traffic.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->client_early_traffic.len = hash_length;
+        if ((secrets->early_exporter_master.data = malloc(hash_length)) ==
+            NULL)
+                goto err;
+        secrets->early_exporter_master.len = hash_length;
+        if ((secrets->derived_early.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->derived_early.len = hash_length;
+        if ((secrets->extracted_handshake.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->extracted_handshake.len = hash_length;
+        if ((secrets->extracted_handshake.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->extracted_handshake.len = hash_length;
+        if ((secrets->client_handshake_traffic.data = malloc(hash_length))
+            == NULL)
+                goto err;
+        secrets->client_handshake_traffic.len = hash_length;
+        if ((secrets->server_handshake_traffic.data = malloc(hash_length))
+            == NULL)
+                goto err;
+        secrets->server_handshake_traffic.len = hash_length;
+        if ((secrets->derived_handshake.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->derived_handshake.len = hash_length;
+        if ((secrets->extracted_master.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->extracted_master.len = hash_length;
+        if ((secrets->client_application_traffic.data = malloc(hash_length)) ==
+            NULL)
+                goto err;
+        secrets->client_application_traffic.len = hash_length;
+        if ((secrets->server_application_traffic.data = malloc(hash_length)) ==
+            NULL)
+                goto err;
+        secrets->server_application_traffic.len = hash_length;
+        if ((secrets->exporter_master.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->exporter_master.len = hash_length;
+        if ((secrets->resumption_master.data = malloc(hash_length)) == NULL)
+                goto err;
+        secrets->resumption_master.len = hash_length;
+
+        return secrets;
+ err:
+        tls13_secrets_destroy(secrets);
+        return NULL;
+}
+
+void
+tls13_secrets_init(struct tls13_secrets *secrets, int resumption)
+{
+        secrets->resumption = resumption;
+        secrets->init_done = 1;
+}
+
+static int
+tls13_hkdf_expand_label(struct tls13_secret *out, const EVP_MD *digest,
+    const struct tls13_secret *secret, const char *label,
+    const struct tls13_secret *context)
+{
+        const char tls13_plabel[] = "tls13 ";
+        uint8_t *hkdf_label;
+        size_t hkdf_label_len;
+        CBB cbb, child;
+        int ret;
+
+        if (!CBB_init(&cbb, 256))
+                return 0;
+        if (!CBB_add_u16(&cbb, out->len))
+                goto err;
+        if (!CBB_add_u8_length_prefixed(&cbb, &child))
+                goto err;
+        if (!CBB_add_bytes(&child, tls13_plabel, strlen(tls13_plabel)))
+                goto err;
+        if (!CBB_add_bytes(&child, label, strlen(label)))
+                goto err;
+        if (!CBB_add_u8_length_prefixed(&cbb, &child))
+                goto err;
+        if (!CBB_add_bytes(&child, context->data, context->len))
+                goto err;
+        if (!CBB_finish(&cbb, &hkdf_label, &hkdf_label_len))
+                goto err;
+
+        ret = HKDF_expand(out->data, out->len, digest, secret->data,
+            secret->len, hkdf_label, hkdf_label_len);
+        free(hkdf_label);
+        return(ret);
+ err:
+        CBB_cleanup(&cbb);
+        return(0);
+}
+
+static int
+tls13_derive_secret(struct tls13_secret *out, const EVP_MD *digest,
+    const struct tls13_secret *secret, const char *label,
+    const struct tls13_secret *context)
+{
+        return tls13_hkdf_expand_label(out, digest, secret, label, context);
+}
+
+
+int
+tls13_derive_early_secrets(struct tls13_secrets *secrets,  const EVP_MD *digest,
+    uint8_t *psk, size_t psk_len, const struct tls13_secret *context)
+{
+        struct tls13_secret binder_context;
+        uint8_t binder_context_data[EVP_MAX_MD_SIZE] = { 0 };
+        unsigned binder_context_len;
+        EVP_MD_CTX *mdctx;
+
+        if (!secrets->init_done || secrets->early_done)
+                return 0;
+
+        if ((mdctx = EVP_MD_CTX_new()) == NULL)
+                return 0;
+
+        if (!EVP_DigestInit_ex(mdctx, digest, NULL) ||
+            !EVP_DigestUpdate(mdctx, secrets->zeros.data, secrets->zeros.len) ||
+            !EVP_DigestFinal_ex(mdctx, binder_context_data,
+                &binder_context_len)) {
+                EVP_MD_CTX_free(mdctx);
+                return 0;
+        }
+        binder_context.data = binder_context_data;
+        binder_context.len = binder_context_len;
+        EVP_MD_CTX_free(mdctx);
+
+        /* If these don't match, we were initialized with the wrong length */
+        if (binder_context_len != secrets->zeros.len)
+                return 0;
+
+        if (!HKDF_extract(secrets->extracted_early.data,
+            &secrets->extracted_early.len, digest, psk, psk_len,
+            secrets->zeros.data, secrets->zeros.len))
+                return 0;
+
+        if (secrets->extracted_early.len != secrets->zeros.len)
+                return 0;
+
+        if (!tls13_derive_secret(&secrets->binder_key,
+            digest, &secrets->extracted_early,
+            secrets->resumption ? "res binder" : "ext binder",
+            &binder_context))
+                return 0;
+
+        if (!tls13_derive_secret(&secrets->client_early_traffic,
+            digest, &secrets->extracted_early, "c e traffic", context))
+                return 0;
+
+        if (!tls13_derive_secret(&secrets->early_exporter_master,
+            digest, &secrets->extracted_early, "e exp master", context))
+                return 0;
+
+        if (!tls13_derive_secret(&secrets->derived_early,
+            digest, &secrets->extracted_early, "derived", context))
+                return 0;
+
+        /* RFC 8446 recommends */
+        if (!secrets->insecure)
+                explicit_bzero(secrets->extracted_early.data,
+                    secrets->extracted_early.len);
+        secrets->early_done = 1;
+        return 1;
+}
+
+int
+tls13_derive_handshake_secrets(struct tls13_secrets *secrets,
+    const EVP_MD *digest, const uint8_t *ecdhe, size_t ecdhe_len,
+    const struct tls13_secret *context)
+{
+        if (!secrets->init_done || !secrets->early_done ||
+            secrets->handshake_done)
+                return 0;
+
+        if (!HKDF_extract(secrets->extracted_handshake.data,
+            &secrets->extracted_handshake.len,
+            digest, ecdhe, ecdhe_len, secrets->derived_early.data,
+            secrets->derived_early.len))
+                return 0;
+
+        if (secrets->extracted_handshake.len != secrets->zeros.len)
+                return 0;
+
+        /* XXX */
+        if (!secrets->insecure)
+                explicit_bzero(secrets->derived_early.data,
+                    secrets->derived_early.len);
+
+        if (!tls13_derive_secret(&secrets->client_handshake_traffic,
+            digest, &secrets->extracted_handshake, "c hs traffic", context))
+                return 0;
+        if (!tls13_derive_secret(&secrets->server_handshake_traffic,
+            digest, &secrets->extracted_handshake, "s hs traffic", context))
+                return 0;
+        if (!tls13_derive_secret(&secrets->derived_handshake,
+            digest, &secrets->extracted_handshake, "derived", context))
+                return 0;
+
+        /* RFC 8446 recommends */
+        if (!secrets->insecure)
+                explicit_bzero(secrets->extracted_handshake.data,
+                    secrets->extracted_handshake.len);
+        secrets->handshake_done = 1;
+        return 1;
+}
+
+int
+tls13_derive_application_secrets(struct tls13_secrets *secrets,
+    const EVP_MD *digest, const struct tls13_secret *context)
+{
+        if (!secrets->init_done || !secrets->early_done ||
+            !secrets->handshake_done || secrets->schedule_done)
+                return 0;
+
+        if (!HKDF_extract(secrets->extracted_master.data,
+                &secrets->extracted_master.len,
+                digest, secrets->zeros.data, secrets->zeros.len, // XXX ?
+                secrets->derived_handshake.data,
+                secrets->derived_handshake.len))
+                return 0;
+
+        if (secrets->extracted_master.len != secrets->zeros.len)
+                return 0;
+
+        /* XXX */
+        if (!secrets->insecure)
+                explicit_bzero(secrets->derived_handshake.data,
+                    secrets->derived_handshake.len);
+
+        if (!tls13_derive_secret(&secrets->client_application_traffic,
+            digest, &secrets->extracted_master, "c ap traffic", context))
+                return 0;
+        if (!tls13_derive_secret(&secrets->server_application_traffic,
+            digest, &secrets->extracted_master, "s ap traffic", context))
+                return 0;
+        if (!tls13_derive_secret(&secrets->exporter_master,
+            digest, &secrets->extracted_master, "exp master", context))
+                return 0;
+        if (!tls13_derive_secret(&secrets->resumption_master,
+            digest, &secrets->extracted_master, "res master", context))
+                return 0;
+
+        /* RFC 8446 recommends */
+        if (!secrets->insecure)
+                explicit_bzero(secrets->extracted_master.data,
+                    secrets->extracted_master.len);
+        secrets->schedule_done = 1;
+        return 1;
+}
+
+int
+tls13_update_client_traffic_secret(struct tls13_secrets *secrets,
+    const EVP_MD *digest)
+{
+        const struct tls13_secret empty = {
+                .data = "",
+                .len = 0,
+        };
+
+        if (!secrets->init_done || !secrets->early_done ||
+            !secrets->handshake_done || !secrets->schedule_done)
+                return 0;
+
+        return tls13_hkdf_expand_label(&secrets->client_application_traffic,
+            digest, &secrets->client_application_traffic, "traffic upd",
+            &empty);
+}
+
+int
+tls13_update_server_traffic_secret(struct tls13_secrets *secrets,
+    const EVP_MD *digest)
+{
+        const struct tls13_secret empty = {
+                .data = "",
+                .len = 0,
+        };
+
+        if (!secrets->init_done || !secrets->early_done ||
+            !secrets->handshake_done || !secrets->schedule_done)
+                return 0;
+
+        return tls13_hkdf_expand_label(&secrets->server_application_traffic,
+            digest, &secrets->server_application_traffic, "traffic upd",
+            &empty);
+}
diff --git a/src/regress/lib/libssl/key_schedule/Makefile b/src/regress/lib/libssl/key_schedule/Makefile
new file mode 100644
index 0000000000..24e12b7c36
--- /dev/null
+++ b/src/regress/lib/libssl/key_schedule/Makefile
@@ -0,0 +1,9 @@
+# $OpenBSD: Makefile,v 1.1 2018/11/07 19:43:12 beck Exp $
+
+PROG=   key_schedule
+LDADD=  ${SSL_INT} -lcrypto
+DPADD=  ${LIBCRYPTO} ${LIBSSL}
+WARNINGS=       Yes
+CFLAGS+=        -DLIBRESSL_INTERNAL -Wundef -Werror -I$(BSDSRCDIR)/lib/libssl
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/key_schedule/key_schedule.c b/src/regress/lib/libssl/key_schedule/key_schedule.c
new file mode 100644
index 0000000000..c6d420ae56
--- /dev/null
+++ b/src/regress/lib/libssl/key_schedule/key_schedule.c
@@ -0,0 +1,240 @@
+/* $OpenBSD: key_schedule.c,v 1.1 2018/11/07 19:43:12 beck Exp $ */
+/*
+ * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <err.h>
+
+#include "ssl_locl.h"
+
+#include "bytestring.h"
+#include "ssl_tlsext.h"
+#include "tls13_internal.h"
+
+static int failures = 0;
+
+static void
+hexdump(const unsigned char *buf, size_t len)
+{
+        size_t i;
+
+        for (i = 1; i <= len; i++)
+                fprintf(stderr, " 0x%02hhx,%s", buf[i - 1], i % 8 ? "" : "\n");
+
+        fprintf(stderr, "\n");
+}
+
+static void
+compare_data(const uint8_t *recv, size_t recv_len, const uint8_t *expect,
+    size_t expect_len)
+{
+        fprintf(stderr, "received:\n");
+        hexdump(recv, recv_len);
+
+        fprintf(stderr, "test data:\n");
+        hexdump(expect, expect_len);
+}
+
+#define FAIL(msg, ...)                                          \
+do {                                                            \
+        fprintf(stderr, "[%s:%d] FAIL: ", __FILE__, __LINE__);  \
+        fprintf(stderr, msg, ##__VA_ARGS__);                    \
+        failures++;                                             \
+} while(0)
+
+/* Hashes and secrets from test vector */
+
+uint8_t chello[] = {
+        0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14,
+        0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24,
+        0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
+        0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55
+};
+const struct tls13_secret chello_hash = {
+        .data = chello,
+        .len = 32,
+};
+
+uint8_t cshello [] = {
+        0x86, 0x0c, 0x06, 0xed, 0xc0, 0x78, 0x58, 0xee,
+        0x8e, 0x78, 0xf0, 0xe7, 0x42, 0x8c, 0x58, 0xed,
+        0xd6, 0xb4, 0x3f, 0x2c, 0xa3, 0xe6, 0xe9, 0x5f,
+        0x02, 0xed, 0x06, 0x3c, 0xf0, 0xe1, 0xca, 0xd8
+};
+
+const struct tls13_secret cshello_hash = {
+        .data = cshello,
+        .len = 32,
+};
+
+const uint8_t ecdhe [] = {
+        0x8b, 0xd4, 0x05, 0x4f, 0xb5, 0x5b, 0x9d, 0x63,
+        0xfd, 0xfb, 0xac, 0xf9, 0xf0, 0x4b, 0x9f, 0x0d,
+        0x35, 0xe6, 0xd6, 0x3f, 0x53, 0x75, 0x63, 0xef,
+        0xd4, 0x62, 0x72, 0x90, 0x0f, 0x89, 0x49, 0x2d
+};
+
+/* Expected Values */
+
+uint8_t expected_extracted_early[] = {
+        0x33, 0xad, 0x0a, 0x1c, 0x60, 0x7e, 0xc0, 0x3b,
+        0x09, 0xe6, 0xcd, 0x98, 0x93, 0x68, 0x0c, 0xe2,
+        0x10, 0xad, 0xf3, 0x00, 0xaa, 0x1f, 0x26, 0x60,
+        0xe1, 0xb2, 0x2e, 0x10, 0xf1, 0x70, 0xf9, 0x2a
+};
+uint8_t expected_derived_early[] = {
+        0x6f, 0x26, 0x15, 0xa1, 0x08, 0xc7, 0x02, 0xc5,
+        0x67, 0x8f, 0x54, 0xfc, 0x9d, 0xba, 0xb6, 0x97,
+        0x16, 0xc0, 0x76, 0x18, 0x9c, 0x48, 0x25, 0x0c,
+        0xeb, 0xea, 0xc3, 0x57, 0x6c, 0x36, 0x11, 0xba
+};
+uint8_t expected_extracted_handshake[] = {
+        0x1d, 0xc8, 0x26, 0xe9, 0x36, 0x06, 0xaa, 0x6f,
+        0xdc, 0x0a, 0xad, 0xc1, 0x2f, 0x74, 0x1b, 0x01,
+        0x04, 0x6a, 0xa6, 0xb9, 0x9f, 0x69, 0x1e, 0xd2,
+        0x21, 0xa9, 0xf0, 0xca, 0x04, 0x3f, 0xbe, 0xac
+};
+uint8_t expected_client_handshake_traffic[] = {
+        0xb3, 0xed, 0xdb, 0x12, 0x6e, 0x06, 0x7f, 0x35,
+        0xa7, 0x80, 0xb3, 0xab, 0xf4, 0x5e, 0x2d, 0x8f,
+        0x3b, 0x1a, 0x95, 0x07, 0x38, 0xf5, 0x2e, 0x96,
+        0x00, 0x74, 0x6a, 0x0e, 0x27, 0xa5, 0x5a, 0x21
+};
+
+uint8_t expected_server_handshake_traffic[] = {
+        0xb6, 0x7b, 0x7d, 0x69, 0x0c, 0xc1, 0x6c, 0x4e,
+        0x75, 0xe5, 0x42, 0x13, 0xcb, 0x2d, 0x37, 0xb4,
+        0xe9, 0xc9, 0x12, 0xbc, 0xde, 0xd9, 0x10, 0x5d,
+        0x42, 0xbe, 0xfd, 0x59, 0xd3, 0x91, 0xad, 0x38
+};
+
+uint8_t expected_derived_handshake[] = {
+        0x43, 0xde, 0x77, 0xe0, 0xc7, 0x77, 0x13, 0x85,
+        0x9a, 0x94, 0x4d, 0xb9, 0xdb, 0x25, 0x90, 0xb5,
+        0x31, 0x90, 0xa6, 0x5b, 0x3e, 0xe2, 0xe4, 0xf1,
+        0x2d, 0xd7, 0xa0, 0xbb, 0x7c, 0xe2, 0x54, 0xb4
+};
+
+uint8_t expected_extracted_master[] = {
+        0x18, 0xdf, 0x06, 0x84, 0x3d, 0x13, 0xa0, 0x8b,
+        0xf2, 0xa4, 0x49, 0x84, 0x4c, 0x5f, 0x8a, 0x47,
+        0x80, 0x01, 0xbc, 0x4d, 0x4c, 0x62, 0x79, 0x84,
+        0xd5, 0xa4, 0x1d, 0xa8, 0xd0, 0x40, 0x29, 0x19
+};
+
+int main () {
+        struct tls13_secrets *secrets;
+
+        secrets = tls13_secrets_new(32);
+
+        if (tls13_derive_early_secrets(secrets, EVP_sha256(),
+            secrets->zeros.data, secrets->zeros.len, &chello_hash))
+                FAIL("derive_early_secrets worked when it shouldn't\n");
+
+        tls13_secrets_init(secrets, 0);
+        secrets->insecure = 1; /* don't explicit_bzero when done */
+
+        if (tls13_derive_handshake_secrets(secrets, EVP_sha256(), ecdhe,
+            32, &cshello_hash))
+                FAIL("derive_handshake_secrets worked when it shouldn't\n");
+        if (tls13_derive_application_secrets(secrets, EVP_sha256(),
+            &chello_hash))
+                FAIL("derive_application_secrets worked when it shouldn't\n");
+
+        if (!tls13_derive_early_secrets(secrets, EVP_sha256(),
+            secrets->zeros.data, secrets->zeros.len, &chello_hash))
+                FAIL("derive_early_secrets failed\n");
+        if (tls13_derive_early_secrets(secrets, EVP_sha256(),
+            secrets->zeros.data, secrets->zeros.len, &chello_hash))
+                FAIL("derive_early_secrets worked when it shouldn't(2)\n");
+
+        if (!tls13_derive_handshake_secrets(secrets, EVP_sha256(), ecdhe,
+            32, &cshello_hash))
+                FAIL("derive_handshake_secrets failed\n");
+        if (tls13_derive_handshake_secrets(secrets, EVP_sha256(), ecdhe,
+            32, &cshello_hash))
+                FAIL("derive_handshake_secrets worked when it shouldn't(2)\n");
+
+        /* XXX XXX this should get fixed when test vectors clarified */
+        memcpy(secrets->derived_handshake.data, expected_derived_handshake,
+            32);
+        /* XXX fix hash here once test vector sorted */
+        if (!tls13_derive_application_secrets(secrets, EVP_sha256(),
+            &chello_hash))
+                FAIL("derive_application_secrets failed\n");
+        if (tls13_derive_application_secrets(secrets, EVP_sha256(),
+            &chello_hash))
+                FAIL("derive_application_secrets worked when it "
+                    "shouldn't(2)\n");
+
+        fprintf(stderr, "extracted_early:\n");
+        compare_data(secrets->extracted_early.data, 32,
+            expected_extracted_early, 32);
+        if (memcmp(secrets->extracted_early.data,
+            expected_extracted_early, 32) != 0)
+                FAIL("extracted_early does not match\n");
+
+        fprintf(stderr, "derived_early:\n");
+        compare_data(secrets->derived_early.data, 32,
+            expected_derived_early, 32);
+        if (memcmp(secrets->derived_early.data,
+            expected_derived_early, 32) != 0)
+                FAIL("derived_early does not match\n");
+
+        fprintf(stderr, "extracted_handshake:\n");
+        compare_data(secrets->extracted_handshake.data, 32,
+            expected_extracted_handshake, 32);
+        if (memcmp(secrets->extracted_handshake.data,
+            expected_extracted_handshake, 32) != 0)
+                FAIL("extracted_handshake does not match\n");
+
+        fprintf(stderr, "client_handshake_traffic:\n");
+        compare_data(secrets->client_handshake_traffic.data, 32,
+            expected_client_handshake_traffic, 32);
+        if (memcmp(secrets->client_handshake_traffic.data,
+            expected_client_handshake_traffic, 32) != 0)
+                FAIL("client_handshake_traffic does not match\n");
+
+        fprintf(stderr, "server_handshake_traffic:\n");
+        compare_data(secrets->server_handshake_traffic.data, 32,
+            expected_server_handshake_traffic, 32);
+        if (memcmp(secrets->server_handshake_traffic.data,
+            expected_server_handshake_traffic, 32) != 0)
+                FAIL("server_handshake_traffic does not match\n");
+
+        fprintf(stderr, "derived_early:\n");
+        compare_data(secrets->derived_early.data, 32,
+            expected_derived_early, 32);
+        if (memcmp(secrets->derived_early.data,
+            expected_derived_early, 32) != 0)
+                FAIL("derived_early does not match\n");
+
+        /* XXX this is currently totally volkswagened from above */
+        fprintf(stderr, "derived_handshake:\n");
+        compare_data(secrets->derived_handshake.data, 32,
+            expected_derived_handshake, 32);
+        if (memcmp(secrets->derived_handshake.data,
+            expected_derived_handshake, 32) != 0)
+                FAIL("derived_handshake does not match\n");
+
+        fprintf(stderr, "extracted_master:\n");
+        compare_data(secrets->extracted_master.data, 32,
+            expected_extracted_master, 32);
+        if (memcmp(secrets->extracted_master.data,
+            expected_extracted_master, 32) != 0)
+                FAIL("extracted_master does not match\n");
+
+        return(failures);
+}