initial.h File Reference

RFC 9001 5.2: Initial packet protection keys derived from the client's Destination Connection ID. More...

#include "common/bytes/span/span.h"
#include "crypto/kdf/hkdf/hkdf.h"
#include "transport/version/version/version.h"

Go to the source code of this file.

Data Structures
struct	quic_initial_keys
	One direction's packet protection keys (RFC 9001 5.1/5.2). More...

Macros
#define	QUIC_INITIAL_KEY   16
	AES-128-GCM packet protection key length in bytes (Initial, always).
#define	QUIC_AEAD_KEY_MAX   32
	Largest AEAD key this SDK derives (ChaCha20-Poly1305, RFC 8446 5.3).
#define	QUIC_INITIAL_IV   12
	AEAD IV length in bytes.
#define	QUIC_INITIAL_HP   16
	Header protection key length in bytes for AES; ChaCha20 HP also uses a 32-byte key (RFC 9001 5.4.3), so hp[] is sized QUIC_AEAD_KEY_MAX too.

Functions
void	quic_initial_derive (quic_span dcid, int is_server, u32 version, quic_initial_keys *out)
	Derive the client (is_server=0) or server (is_server=1) Initial keys from the Destination Connection ID of the client's first Initial packet, using the Initial salt and HKDF-Expand-Label prefix for version (RFC 9001 5.2 for v1, RFC 9369 3.3.1 for v2).

Detailed Description

RFC 9001 5.2: Initial packet protection keys derived from the client's Destination Connection ID.

Initial is always AES-128-GCM, so key=16, iv=12, hp=16. Handshake/1-RTT levels reuse this same struct (RFC 9001 5.1) and may instead be negotiated to ChaCha20-Poly1305 (RFC 8446 B.4 0x1303), whose key is 32 bytes – key[] is sized QUIC_AEAD_KEY_MAX to hold either.

Function Documentation

quic_initial_derive()

void quic_initial_derive	(	quic_span	dcid,
		int	is_server,
		u32	version,
		quic_initial_keys *	out )

Derive the client (is_server=0) or server (is_server=1) Initial keys from the Destination Connection ID of the client's first Initial packet, using the Initial salt and HKDF-Expand-Label prefix for version (RFC 9001 5.2 for v1, RFC 9369 3.3.1 for v2).

An unknown version falls back to the v1 salt/prefix (RFC 9000 17.2 invariants still apply before a version is negotiated).

Parameters

dcid	the Destination Connection ID of the client's first Initial
is_server	1 for the server keys, 0 for the client keys
version	the QUIC version whose salt/label prefix to use
out	receives the derived keys