moontls
moontls — the TLS 1.3 protocol state machine for MoonBit (RFC 8446): record layer, handshake and key schedule, bytes in and events out. No sockets, no cryptography of its own: the algorithms are mooncrypt's and certificate reading is mooncred's.
tls
tls13
rfc8446
handshake
moonbit
Author
Version
0.1.0
License
Apache-2.0
Repository
Last updated
last month
Downloads
332
#moontls
The TLS 1.3 protocol state machine for MoonBit (RFC 8446) — bytes in, events out. No sockets, and not one line of cryptography of its own: the algorithms are mooncrypt's and certificate reading is mooncred's.
// The key schedule of RFC 8446 §7.1, one step at a time.
let early = @keys.early() // no PSK
let handshake = @keys.handshake(early[:], ecdhe[:]) // salted by ECDHE
let master = @keys.master(handshake[:])
let transcript = @keys.Transcript::new()
transcript.add(client_hello[:])
transcript.add(server_hello[:])
let secret = @keys.client_handshake(handshake[:], transcript.hash()[:])
let ok = @keys.finished_ok(secret[:], transcript.hash()[:], verify_data[:])Run moon run examples/tour for the whole surface in one go.
#Packages
| Specification | State | |
|---|---|---|
| keys | §7.1 key schedule, §4.4.1 transcript hash, §4.4.4 Finished | 0.1.0 |
| record | §5 record layer and alerts | next |
| ext | §4.2 extensions: ALPN, SNI, key_share, supported_versions | next |
| hs | §4 handshake state machine, ClientHello to Finished | after those |
#The digest is a parameter
RFC 8446 writes the whole ladder over Hash, the hash the negotiated cipher suite names. So every function here takes digest, and every output length follows from it:
@keys.early() // SHA-256, the suite RFC 8446 §9.1 makes mandatory
@keys.early(digest=Sha384) // 48 octets instead of 32, all the way down@keys.digest is the preset, and it is Sha256 because TLS_AES_128_GCM_SHA256 is the one implementation is required to provide.
#What is not here
Sockets. Certificate chain validation — that is mooncred. Cryptographic algorithms — those are mooncrypt. QUIC's transport layer — that is moonquic, which borrows this handshake and reuses this key schedule verbatim (RFC 9001 §5.2). Session resumption, 0-RTT and client certificates are not implemented yet.
#Verification
The key schedule is checked against RFC 8446 §7.1 written out over Python's own HMAC — an implementation sharing no code with this one. The Early Secret for a zero PSK comes out 33ad0a1c…f170f92a, which is the value RFC 8448 publishes, so the ladder is anchored to the RFC's trace and not only to our own arithmetic.
The gate is moon clean → moon fmt → moon check --target all --deny-warn → moon build --target all → moon test --target all, across wasm, wasm-gc, js and native.
#License
Apache-2.0.
Install
Download zipmoontls — the TLS 1.3 protocol state machine for MoonBit (RFC 8446): record layer, handshake and key schedule, bytes in and events out. No sockets, no cryptography of its own: the algorithms are mooncrypt's and certificate reading is mooncred's.
tlstls13rfc8446handshakemoonbit
Apache-2.0
Updated last month
332 downloads