keysched Struct Reference

Key schedule state: the current stage, the Master Secret once reached, and the four traffic key sets indexed by the KS_* constants. More...

#include <keyschedule.h>

Data Fields
int	stage
	0=init/early, 1=handshake, 2=master
u8	master [TLS_HASH_MAX]
	Master Secret (derived on reaching stage 1).
initial_keys	keys [4]
	traffic keys indexed by KS_*
u8	client_ap_secret [TLS_HASH_MAX]
	client_application_traffic_secret_0 (RFC 8446 7.1), retained past stage 2 so RFC 9001 6 key updates can derive the next generation from it
u8	server_ap_secret [TLS_HASH_MAX]
	server_application_traffic_secret_0, retained for the same reason on the send side (RFC 9001 6.2)
u8	exporter_secret [TLS_HASH_MAX]
	exporter_master_secret (RFC 8446 7.1/7.5), derived alongside the application traffic secrets on reaching stage 2 so tls_exporter can compute TLS-Exporter values (e.g.
u16	suite
	negotiated TLS 1.3 cipher suite (RFC 8446 B.4) for the Handshake/1-RTT levels this schedule derives; set by keysched_init to AES_128_GCM_SHA256 and overridable via keysched_set_suite before advance_handshake.
u32	version
	QUIC version whose label prefix the Handshake/1-RTT packet-protection expands use ("quic " for v1, "quicv2 " for v2 – RFC 9369 3.3.1); set by keysched_init to VERSION_1 and overridable via keysched_set_version before advance_handshake.

Detailed Description

Key schedule state: the current stage, the Master Secret once reached, and the four traffic key sets indexed by the KS_* constants.

Field Documentation

exporter_secret

u8 keysched::exporter_secret[TLS_HASH_MAX]

exporter_master_secret (RFC 8446 7.1/7.5), derived alongside the application traffic secrets on reaching stage 2 so tls_exporter can compute TLS-Exporter values (e.g.

EXPORTER-WebTransport) once the handshake completes

suite

u16 keysched::suite

negotiated TLS 1.3 cipher suite (RFC 8446 B.4) for the Handshake/1-RTT levels this schedule derives; set by keysched_init to AES_128_GCM_SHA256 and overridable via keysched_set_suite before advance_handshake.

Initial packet protection (RFC 9001 5.2) is unaffected – it derives separately and is always AES-128-GCM.

---

The documentation for this struct was generated from the following file:

• tls/keys/schedule_drive/keyschedule.h