grpc 1.68.1 → 1.71.0

data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc

@@ -1,16 +1,16 @@
-/* Copyright (c) 2016, Google Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+// Copyright 2016 The BoringSSL Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 #include <openssl/ssl.h>
 
@@ -18,10 +18,13 @@
 #include <string.h>
 
 #include <algorithm>
+#include <string_view>
 #include <utility>
 
 #include <openssl/aead.h>
+#include <openssl/aes.h>
 #include <openssl/bytestring.h>
+#include <openssl/chacha.h>
 #include <openssl/digest.h>
 #include <openssl/hkdf.h>
 #include <openssl/hmac.h>
@@ -41,9 +44,8 @@ static bool init_key_schedule(SSL_HANDSHAKE *hs, SSLTranscript *transcript,
   }
 
   // Initialize the secret to the zero key.
-  hs->ResizeSecrets(transcript->DigestLen());
-  OPENSSL_memset(hs->secret().data(), 0, hs->secret().size());
-
+  hs->secret.clear();
+  hs->secret.Resize(transcript->DigestLen());
   return true;
 }
 
@@ -51,11 +53,11 @@ static bool hkdf_extract_to_secret(SSL_HANDSHAKE *hs,
                                    const SSLTranscript &transcript,
                                    Span<const uint8_t> in) {
   size_t len;
-  if (!HKDF_extract(hs->secret().data(), &len, transcript.Digest(), in.data(),
-                    in.size(), hs->secret().data(), hs->secret().size())) {
+  if (!HKDF_extract(hs->secret.data(), &len, transcript.Digest(), in.data(),
+                    in.size(), hs->secret.data(), hs->secret.size())) {
     return false;
   }
-  assert(len == hs->secret().size());
+  assert(len == hs->secret.size());
   return true;
 }
 
@@ -83,20 +85,14 @@ bool tls13_init_early_key_schedule(SSL_HANDSHAKE *hs,
   return init_key_schedule(hs, transcript,
                            ssl_session_protocol_version(session),
                            session->cipher) &&
-         hkdf_extract_to_secret(
-             hs, *transcript,
-             MakeConstSpan(session->secret, session->secret_length));
-}
-
-static Span<const char> label_to_span(const char *label) {
-  return MakeConstSpan(label, strlen(label));
+         hkdf_extract_to_secret(hs, *transcript, session->secret);
 }
 
 static bool hkdf_expand_label_with_prefix(Span<uint8_t> out,
                                           const EVP_MD *digest,
                                           Span<const uint8_t> secret,
-                                          Span<const uint8_t> label_prefix,
-                                          Span<const char> label,
+                                          std::string_view label_prefix,
+                                          std::string_view label,
                                           Span<const uint8_t> hash) {
   // This is a copy of CRYPTO_tls13_hkdf_expand_label, but modified to take an
   // arbitrary prefix for the label instead of using the hardcoded "tls13 "
@@ -109,7 +105,9 @@ static bool hkdf_expand_label_with_prefix(Span<uint8_t> out,
                 2 + 1 + label_prefix.size() + label.size() + 1 + hash.size()) ||
       !CBB_add_u16(&cbb, out.size()) ||
       !CBB_add_u8_length_prefixed(&cbb, &child) ||
-      !CBB_add_bytes(&child, label_prefix.data(), label_prefix.size()) ||
+      !CBB_add_bytes(&child,
+                     reinterpret_cast<const uint8_t *>(label_prefix.data()),
+                     label_prefix.size()) ||
       !CBB_add_bytes(&child, reinterpret_cast<const uint8_t *>(label.data()),
                      label.size()) ||
       !CBB_add_u8_length_prefixed(&cbb, &child) ||
@@ -127,19 +125,16 @@ static bool hkdf_expand_label_with_prefix(Span<uint8_t> out,
 
 static bool hkdf_expand_label(Span<uint8_t> out, const EVP_MD *digest,
                               Span<const uint8_t> secret,
-                              Span<const char> label, Span<const uint8_t> hash,
+                              std::string_view label, Span<const uint8_t> hash,
                               bool is_dtls) {
   if (is_dtls) {
-    static const uint8_t kDTLS13LabelPrefix[] = "dtls13";
-    return hkdf_expand_label_with_prefix(
-        out, digest, secret,
-        MakeConstSpan(kDTLS13LabelPrefix, sizeof(kDTLS13LabelPrefix) - 1),
-        label, hash);
+    return hkdf_expand_label_with_prefix(out, digest, secret, "dtls13", label,
+                                         hash);
   }
   return CRYPTO_tls13_hkdf_expand_label(
-      out.data(), out.size(), digest, secret.data(), secret.size(),
-      reinterpret_cast<const uint8_t *>(label.data()), label.size(),
-      hash.data(), hash.size()) == 1;
+             out.data(), out.size(), digest, secret.data(), secret.size(),
+             reinterpret_cast<const uint8_t *>(label.data()), label.size(),
+             hash.data(), hash.size()) == 1;
 }
 
 static const char kTLS13LabelDerived[] = "derived";
@@ -149,33 +144,35 @@ bool tls13_advance_key_schedule(SSL_HANDSHAKE *hs, Span<const uint8_t> in) {
   unsigned derive_context_len;
   return EVP_Digest(nullptr, 0, derive_context, &derive_context_len,
                     hs->transcript.Digest(), nullptr) &&
-         hkdf_expand_label(hs->secret(), hs->transcript.Digest(), hs->secret(),
-                           label_to_span(kTLS13LabelDerived),
-                           MakeConstSpan(derive_context, derive_context_len),
+         hkdf_expand_label(Span(hs->secret), hs->transcript.Digest(),
+                           hs->secret, kTLS13LabelDerived,
+                           Span(derive_context, derive_context_len),
                            SSL_is_dtls(hs->ssl)) &&
          hkdf_extract_to_secret(hs, hs->transcript, in);
 }
 
-// derive_secret_with_transcript derives a secret of length |out.size()| and
-// writes the result in |out| with the given label, the current base secret, and
-// the state of |transcript|. It returns true on success and false on error.
-static bool derive_secret_with_transcript(const SSL_HANDSHAKE *hs,
-                                          Span<uint8_t> out,
-                                          const SSLTranscript &transcript,
-                                          Span<const char> label) {
+// derive_secret_with_transcript derives a secret of length
+// |transcript.DigestLen()| and writes the result in |out| with the given label,
+// the current base secret, and the state of |transcript|. It returns true on
+// success and false on error.
+static bool derive_secret_with_transcript(
+    const SSL_HANDSHAKE *hs, InplaceVector<uint8_t, SSL_MAX_MD_SIZE> *out,
+    const SSLTranscript &transcript, std::string_view label) {
   uint8_t context_hash[EVP_MAX_MD_SIZE];
   size_t context_hash_len;
   if (!transcript.GetHash(context_hash, &context_hash_len)) {
     return false;
   }
 
-  return hkdf_expand_label(out, transcript.Digest(), hs->secret(), label,
-                           MakeConstSpan(context_hash, context_hash_len),
+  out->ResizeForOverwrite(transcript.DigestLen());
+  return hkdf_expand_label(Span(*out), transcript.Digest(), hs->secret, label,
+                           Span(context_hash, context_hash_len),
                            SSL_is_dtls(hs->ssl));
 }
 
-static bool derive_secret(SSL_HANDSHAKE *hs, Span<uint8_t> out,
-                          Span<const char> label) {
+static bool derive_secret(SSL_HANDSHAKE *hs,
+                          InplaceVector<uint8_t, SSL_MAX_MD_SIZE> *out,
+                          std::string_view label) {
   return derive_secret_with_transcript(hs, out, hs->transcript, label);
 }
 
@@ -187,93 +184,162 @@ bool tls13_set_traffic_key(SSL *ssl, enum ssl_encryption_level_t level,
   const EVP_MD *digest = ssl_session_get_digest(session);
   bool is_dtls = SSL_is_dtls(ssl);
   UniquePtr<SSLAEADContext> traffic_aead;
-  Span<const uint8_t> secret_for_quic;
-  if (ssl->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     // Install a placeholder SSLAEADContext so that SSL accessors work. The
     // encryption itself will be handled by the SSL_QUIC_METHOD.
-    traffic_aead =
-        SSLAEADContext::CreatePlaceholderForQUIC(version, session->cipher);
-    secret_for_quic = traffic_secret;
+    traffic_aead = SSLAEADContext::CreatePlaceholderForQUIC(session->cipher);
   } else {
     // Look up cipher suite properties.
     const EVP_AEAD *aead;
     size_t discard;
     if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, session->cipher,
-                                 version, is_dtls)) {
-      return false;
-    }
-
-    // Derive the key.
-    size_t key_len = EVP_AEAD_key_length(aead);
-    uint8_t key_buf[EVP_AEAD_MAX_KEY_LENGTH];
-    auto key = MakeSpan(key_buf, key_len);
-    if (!hkdf_expand_label(key, digest, traffic_secret, label_to_span("key"),
-                           {}, is_dtls)) {
+                                 version)) {
       return false;
     }
 
-    // Derive the IV.
-    size_t iv_len = EVP_AEAD_nonce_length(aead);
-    uint8_t iv_buf[EVP_AEAD_MAX_NONCE_LENGTH];
-    auto iv = MakeSpan(iv_buf, iv_len);
-    if (!hkdf_expand_label(iv, digest, traffic_secret, label_to_span("iv"), {},
-                           is_dtls)) {
+    // Derive the key and IV.
+    uint8_t key_buf[EVP_AEAD_MAX_KEY_LENGTH], iv_buf[EVP_AEAD_MAX_NONCE_LENGTH];
+    auto key = Span(key_buf).first(EVP_AEAD_key_length(aead));
+    auto iv = Span(iv_buf).first(EVP_AEAD_nonce_length(aead));
+    if (!hkdf_expand_label(key, digest, traffic_secret, "key", {}, is_dtls) ||
+        !hkdf_expand_label(iv, digest, traffic_secret, "iv", {}, is_dtls)) {
       return false;
     }
 
-    traffic_aead =
-        SSLAEADContext::Create(direction, session->ssl_version, is_dtls,
-                               session->cipher, key, Span<const uint8_t>(), iv);
+    traffic_aead = SSLAEADContext::Create(direction, session->ssl_version,
+                                          session->cipher, key, {}, iv);
   }
 
   if (!traffic_aead) {
     return false;
   }
 
-  if (is_dtls) {
-    RecordNumberEncrypter *rn_encrypter =
-        traffic_aead->GetRecordNumberEncrypter();
-    if (!rn_encrypter) {
+  if (direction == evp_aead_open) {
+    if (!ssl->method->set_read_state(ssl, level, std::move(traffic_aead),
+                                     traffic_secret)) {
       return false;
     }
-    Array<uint8_t> rne_key;
-    if (!rne_key.Init(rn_encrypter->KeySize()) ||
-        !hkdf_expand_label(MakeSpan(rne_key), digest, traffic_secret,
-                           label_to_span("sn"), {}, is_dtls) ||
-        !rn_encrypter->SetKey(MakeSpan(rne_key))) {
+    ssl->s3->read_traffic_secret.CopyFrom(traffic_secret);
+  } else {
+    if (!ssl->method->set_write_state(ssl, level, std::move(traffic_aead),
+                                      traffic_secret)) {
       return false;
     }
+    ssl->s3->write_traffic_secret.CopyFrom(traffic_secret);
   }
 
-  if (traffic_secret.size() >
-          OPENSSL_ARRAY_SIZE(ssl->s3->read_traffic_secret) ||
-      traffic_secret.size() >
-          OPENSSL_ARRAY_SIZE(ssl->s3->write_traffic_secret)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
+  return true;
+}
+
+namespace {
+
+class AESRecordNumberEncrypter : public RecordNumberEncrypter {
+ public:
+  bool SetKey(Span<const uint8_t> key) override {
+    return AES_set_encrypt_key(key.data(), key.size() * 8, &key_) == 0;
   }
 
-  if (direction == evp_aead_open) {
-    if (!ssl->method->set_read_state(ssl, level, std::move(traffic_aead),
-                                     secret_for_quic)) {
+  bool GenerateMask(Span<uint8_t> out, Span<const uint8_t> sample) override {
+    if (sample.size() < AES_BLOCK_SIZE || out.size() > AES_BLOCK_SIZE) {
       return false;
     }
-    OPENSSL_memmove(ssl->s3->read_traffic_secret, traffic_secret.data(),
-                    traffic_secret.size());
-    ssl->s3->read_traffic_secret_len = traffic_secret.size();
-  } else {
-    if (!ssl->method->set_write_state(ssl, level, std::move(traffic_aead),
-                                      secret_for_quic)) {
+    uint8_t mask[AES_BLOCK_SIZE];
+    AES_encrypt(sample.data(), mask, &key_);
+    OPENSSL_memcpy(out.data(), mask, out.size());
+    return true;
+  }
+
+ private:
+  AES_KEY key_;
+};
+
+class AES128RecordNumberEncrypter : public AESRecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return 16; }
+};
+
+class AES256RecordNumberEncrypter : public AESRecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return 32; }
+};
+
+class ChaChaRecordNumberEncrypter : public RecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return kKeySize; }
+
+  bool SetKey(Span<const uint8_t> key) override {
+    if (key.size() != kKeySize) {
       return false;
     }
-    OPENSSL_memmove(ssl->s3->write_traffic_secret, traffic_secret.data(),
-                    traffic_secret.size());
-    ssl->s3->write_traffic_secret_len = traffic_secret.size();
+    OPENSSL_memcpy(key_, key.data(), key.size());
+    return true;
   }
 
-  return true;
-}
+  bool GenerateMask(Span<uint8_t> out, Span<const uint8_t> sample) override {
+    // RFC 9147 section 4.2.3 uses the first 4 bytes of the sample as the
+    // counter and the next 12 bytes as the nonce. If we have less than 4+12=16
+    // bytes in the sample, then we'll read past the end of the |sample| buffer.
+    // The counter is interpreted as little-endian per RFC 8439.
+    if (sample.size() < 16) {
+      return false;
+    }
+    uint32_t counter = CRYPTO_load_u32_le(sample.data());
+    Span<const uint8_t> nonce = sample.subspan(4);
+    OPENSSL_memset(out.data(), 0, out.size());
+    CRYPTO_chacha_20(out.data(), out.data(), out.size(), key_, nonce.data(),
+                     counter);
+    return true;
+  }
 
+ private:
+  static constexpr size_t kKeySize = 32;
+  uint8_t key_[kKeySize];
+};
+
+#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
+class NullRecordNumberEncrypter : public RecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return 0; }
+  bool SetKey(Span<const uint8_t> key) override { return true; }
+  bool GenerateMask(Span<uint8_t> out, Span<const uint8_t> sample) override {
+    OPENSSL_memset(out.data(), 0, out.size());
+    return true;
+  }
+};
+#endif  // BORINGSSL_UNSAFE_FUZZER_MODE
+
+}  // namespace
+
+UniquePtr<RecordNumberEncrypter> RecordNumberEncrypter::Create(
+    const SSL_CIPHER *cipher, Span<const uint8_t> traffic_secret) {
+  const EVP_MD *digest = ssl_get_handshake_digest(TLS1_3_VERSION, cipher);
+  UniquePtr<RecordNumberEncrypter> ret;
+#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
+  ret = MakeUnique<NullRecordNumberEncrypter>();
+#else
+  if (cipher->algorithm_enc == SSL_AES128GCM) {
+    ret = MakeUnique<AES128RecordNumberEncrypter>();
+  } else if (cipher->algorithm_enc == SSL_AES256GCM) {
+    ret = MakeUnique<AES256RecordNumberEncrypter>();
+  } else if (cipher->algorithm_enc == SSL_CHACHA20POLY1305) {
+    ret = MakeUnique<ChaChaRecordNumberEncrypter>();
+  } else {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+  }
+#endif  // BORINGSSL_UNSAFE_FUZZER_MODE
+  if (ret == nullptr) {
+    return nullptr;
+  }
+
+  uint8_t rne_key_buf[RecordNumberEncrypter::kMaxKeySize];
+  auto rne_key = Span(rne_key_buf).first(ret->KeySize());
+  if (!hkdf_expand_label(rne_key, digest, traffic_secret, "sn", {},
+                         /*is_dtls=*/true) ||
+      !ret->SetKey(rne_key)) {
+    return nullptr;
+  }
+  return ret;
+}
 
 static const char kTLS13LabelExporter[] = "exp master";
 
@@ -290,11 +356,10 @@ bool tls13_derive_early_secret(SSL_HANDSHAKE *hs) {
   const SSLTranscript &transcript = (!ssl->server && hs->selected_ech_config)
                                         ? hs->inner_transcript
                                         : hs->transcript;
-  if (!derive_secret_with_transcript(
-          hs, hs->early_traffic_secret(), transcript,
-          label_to_span(kTLS13LabelClientEarlyTraffic)) ||
+  if (!derive_secret_with_transcript(hs, &hs->early_traffic_secret, transcript,
+                                     kTLS13LabelClientEarlyTraffic) ||
       !ssl_log_secret(ssl, "CLIENT_EARLY_TRAFFIC_SECRET",
-                      hs->early_traffic_secret())) {
+                      hs->early_traffic_secret)) {
     return false;
   }
   return true;
@@ -302,14 +367,14 @@ bool tls13_derive_early_secret(SSL_HANDSHAKE *hs) {
 
 bool tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (!derive_secret(hs, hs->client_handshake_secret(),
-                     label_to_span(kTLS13LabelClientHandshakeTraffic)) ||
+  if (!derive_secret(hs, &hs->client_handshake_secret,
+                     kTLS13LabelClientHandshakeTraffic) ||
       !ssl_log_secret(ssl, "CLIENT_HANDSHAKE_TRAFFIC_SECRET",
-                      hs->client_handshake_secret()) ||
-      !derive_secret(hs, hs->server_handshake_secret(),
-                     label_to_span(kTLS13LabelServerHandshakeTraffic)) ||
+                      hs->client_handshake_secret) ||
+      !derive_secret(hs, &hs->server_handshake_secret,
+                     kTLS13LabelServerHandshakeTraffic) ||
       !ssl_log_secret(ssl, "SERVER_HANDSHAKE_TRAFFIC_SECRET",
-                      hs->server_handshake_secret())) {
+                      hs->server_handshake_secret)) {
     return false;
   }
 
@@ -318,21 +383,16 @@ bool tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) {
 
 bool tls13_derive_application_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  ssl->s3->exporter_secret_len = hs->transcript.DigestLen();
-  if (!derive_secret(hs, hs->client_traffic_secret_0(),
-                     label_to_span(kTLS13LabelClientApplicationTraffic)) ||
+  if (!derive_secret(hs, &hs->client_traffic_secret_0,
+                     kTLS13LabelClientApplicationTraffic) ||
       !ssl_log_secret(ssl, "CLIENT_TRAFFIC_SECRET_0",
-                      hs->client_traffic_secret_0()) ||
-      !derive_secret(hs, hs->server_traffic_secret_0(),
-                     label_to_span(kTLS13LabelServerApplicationTraffic)) ||
+                      hs->client_traffic_secret_0) ||
+      !derive_secret(hs, &hs->server_traffic_secret_0,
+                     kTLS13LabelServerApplicationTraffic) ||
       !ssl_log_secret(ssl, "SERVER_TRAFFIC_SECRET_0",
-                      hs->server_traffic_secret_0()) ||
-      !derive_secret(
-          hs, MakeSpan(ssl->s3->exporter_secret, ssl->s3->exporter_secret_len),
-          label_to_span(kTLS13LabelExporter)) ||
-      !ssl_log_secret(ssl, "EXPORTER_SECRET",
-                      MakeConstSpan(ssl->s3->exporter_secret,
-                                    ssl->s3->exporter_secret_len))) {
+                      hs->server_traffic_secret_0) ||
+      !derive_secret(hs, &ssl->s3->exporter_secret, kTLS13LabelExporter) ||
+      !ssl_log_secret(ssl, "EXPORTER_SECRET", ssl->s3->exporter_secret)) {
     return false;
   }
 
@@ -342,19 +402,14 @@ bool tls13_derive_application_secrets(SSL_HANDSHAKE *hs) {
 static const char kTLS13LabelApplicationTraffic[] = "traffic upd";
 
 bool tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) {
-  Span<uint8_t> secret;
-  if (direction == evp_aead_open) {
-    secret = MakeSpan(ssl->s3->read_traffic_secret,
-                      ssl->s3->read_traffic_secret_len);
-  } else {
-    secret = MakeSpan(ssl->s3->write_traffic_secret,
-                      ssl->s3->write_traffic_secret_len);
-  }
+  Span<uint8_t> secret = direction == evp_aead_open
+                             ? Span(ssl->s3->read_traffic_secret)
+                             : Span(ssl->s3->write_traffic_secret);
 
   const SSL_SESSION *session = SSL_get_session(ssl);
   const EVP_MD *digest = ssl_session_get_digest(session);
   return hkdf_expand_label(secret, digest, secret,
-                           label_to_span(kTLS13LabelApplicationTraffic), {},
+                           kTLS13LabelApplicationTraffic, {},
                            SSL_is_dtls(ssl)) &&
          tls13_set_traffic_key(ssl, ssl_encryption_application, direction,
                                session, secret);
@@ -363,14 +418,7 @@ bool tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) {
 static const char kTLS13LabelResumption[] = "res master";
 
 bool tls13_derive_resumption_secret(SSL_HANDSHAKE *hs) {
-  if (hs->transcript.DigestLen() > SSL_MAX_MASTER_KEY_LENGTH) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
-  }
-  hs->new_session->secret_length = hs->transcript.DigestLen();
-  return derive_secret(
-      hs, MakeSpan(hs->new_session->secret, hs->new_session->secret_length),
-      label_to_span(kTLS13LabelResumption));
+  return derive_secret(hs, &hs->new_session->secret, kTLS13LabelResumption);
 }
 
 static const char kTLS13LabelFinished[] = "finished";
@@ -383,10 +431,10 @@ static bool tls13_verify_data(uint8_t *out, size_t *out_len,
                               Span<const uint8_t> secret,
                               Span<const uint8_t> context, bool is_dtls) {
   uint8_t key_buf[EVP_MAX_MD_SIZE];
-  auto key = MakeSpan(key_buf, EVP_MD_size(digest));
+  auto key = Span(key_buf, EVP_MD_size(digest));
   unsigned len;
-  if (!hkdf_expand_label(key, digest, secret,
-                         label_to_span(kTLS13LabelFinished), {}, is_dtls) ||
+  if (!hkdf_expand_label(key, digest, secret, kTLS13LabelFinished, {},
+                         is_dtls) ||
       HMAC(digest, key.data(), key.size(), context.data(), context.size(), out,
            &len) == nullptr) {
     return false;
@@ -398,14 +446,14 @@ static bool tls13_verify_data(uint8_t *out, size_t *out_len,
 bool tls13_finished_mac(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len,
                         bool is_server) {
   Span<const uint8_t> traffic_secret =
-      is_server ? hs->server_handshake_secret() : hs->client_handshake_secret();
+      is_server ? hs->server_handshake_secret : hs->client_handshake_secret;
 
   uint8_t context_hash[EVP_MAX_MD_SIZE];
   size_t context_hash_len;
   if (!hs->transcript.GetHash(context_hash, &context_hash_len) ||
       !tls13_verify_data(out, out_len, hs->transcript.Digest(),
-                         hs->ssl->version, traffic_secret,
-                         MakeConstSpan(context_hash, context_hash_len),
+                         hs->ssl->s3->version, traffic_secret,
+                         Span(context_hash, context_hash_len),
                          SSL_is_dtls(hs->ssl))) {
     return false;
   }
@@ -419,17 +467,16 @@ bool tls13_derive_session_psk(SSL_SESSION *session, Span<const uint8_t> nonce,
   const EVP_MD *digest = ssl_session_get_digest(session);
   // The session initially stores the resumption_master_secret, which we
   // override with the PSK.
-  auto session_secret = MakeSpan(session->secret, session->secret_length);
-  return hkdf_expand_label(session_secret, digest, session_secret,
-                           label_to_span(kTLS13LabelResumptionPSK), nonce,
-                           is_dtls);
+  assert(session->secret.size() == EVP_MD_size(digest));
+  return hkdf_expand_label(Span(session->secret), digest, session->secret,
+                           kTLS13LabelResumptionPSK, nonce, is_dtls);
 }
 
 static const char kTLS13LabelExportKeying[] = "exporter";
 
 bool tls13_export_keying_material(SSL *ssl, Span<uint8_t> out,
                                   Span<const uint8_t> secret,
-                                  Span<const char> label,
+                                  std::string_view label,
                                   Span<const uint8_t> context) {
   if (secret.empty()) {
     assert(0);
@@ -450,15 +497,14 @@ bool tls13_export_keying_material(SSL *ssl, Span<uint8_t> out,
     return false;
   }
 
-  auto hash = MakeConstSpan(hash_buf, hash_len);
-  auto export_context = MakeConstSpan(export_context_buf, export_context_len);
+  auto hash = Span(hash_buf, hash_len);
+  auto export_context = Span(export_context_buf, export_context_len);
   uint8_t derived_secret_buf[EVP_MAX_MD_SIZE];
-  auto derived_secret = MakeSpan(derived_secret_buf, EVP_MD_size(digest));
+  auto derived_secret = Span(derived_secret_buf, EVP_MD_size(digest));
   return hkdf_expand_label(derived_secret, digest, secret, label,
                            export_context, SSL_is_dtls(ssl)) &&
-         hkdf_expand_label(out, digest, derived_secret,
-                           label_to_span(kTLS13LabelExportKeying), hash,
-                           SSL_is_dtls(ssl));
+         hkdf_expand_label(out, digest, derived_secret, kTLS13LabelExportKeying,
+                           hash, SSL_is_dtls(ssl));
 }
 
 static const char kTLS13LabelPSKBinder[] = "res binder";
@@ -479,15 +525,16 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
   uint8_t early_secret[EVP_MAX_MD_SIZE] = {0};
   size_t early_secret_len;
   uint8_t binder_key_buf[EVP_MAX_MD_SIZE] = {0};
-  auto binder_key = MakeSpan(binder_key_buf, EVP_MD_size(digest));
+  auto binder_key = Span(binder_key_buf, EVP_MD_size(digest));
   if (!EVP_Digest(nullptr, 0, binder_context, &binder_context_len, digest,
                   nullptr) ||
-      !HKDF_extract(early_secret, &early_secret_len, digest, session->secret,
-                    session->secret_length, nullptr, 0) ||
-      !hkdf_expand_label(
-          binder_key, digest, MakeConstSpan(early_secret, early_secret_len),
-          label_to_span(kTLS13LabelPSKBinder),
-          MakeConstSpan(binder_context, binder_context_len), is_dtls)) {
+      !HKDF_extract(early_secret, &early_secret_len, digest,
+                    session->secret.data(), session->secret.size(), nullptr,
+                    0) ||
+      !hkdf_expand_label(binder_key, digest,
+                         Span(early_secret, early_secret_len),
+                         kTLS13LabelPSKBinder,
+                         Span(binder_context, binder_context_len), is_dtls)) {
     return false;
   }
 
@@ -500,15 +547,33 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
   uint8_t context[EVP_MAX_MD_SIZE];
   unsigned context_len;
   ScopedEVP_MD_CTX ctx;
-  if (!transcript.CopyToHashContext(ctx.get(), digest) ||
-      !EVP_DigestUpdate(ctx.get(), truncated.data(),
-                        truncated.size()) ||
-      !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
-    return false;
+  if (!is_dtls) {
+    if (!transcript.CopyToHashContext(ctx.get(), digest) ||
+        !EVP_DigestUpdate(ctx.get(), truncated.data(), truncated.size()) ||
+        !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
+      return false;
+    }
+  } else {
+    // In DTLS 1.3, the transcript hash is computed over only the TLS 1.3
+    // handshake messages (i.e. only type and length in the header), not the
+    // full DTLSHandshake messages that are in |truncated|. This code pulls
+    // the header and body out of the truncated ClientHello and writes those
+    // to the hash context so the correct binder value is computed.
+    if (truncated.size() < DTLS1_HM_HEADER_LENGTH) {
+      return false;
+    }
+    auto header = truncated.subspan(0, 4);
+    auto body = truncated.subspan(12);
+    if (!transcript.CopyToHashContext(ctx.get(), digest) ||
+        !EVP_DigestUpdate(ctx.get(), header.data(), header.size()) ||
+        !EVP_DigestUpdate(ctx.get(), body.data(), body.size()) ||
+        !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
+      return false;
+    }
   }
 
   if (!tls13_verify_data(out, out_len, digest, session->ssl_version, binder_key,
-                         MakeConstSpan(context, context_len), is_dtls)) {
+                         Span(context, context_len), is_dtls)) {
     return false;
   }
 
@@ -596,12 +661,19 @@ bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
     return false;
   }
 
-  auto before_zeros = msg.subspan(0, offset);
+  // We represent DTLS messages with the longer DTLS 1.2 header, but DTLS 1.3
+  // removes the extra fields from the transcript.
+  auto header = msg.subspan(0, SSL3_HM_HEADER_LENGTH);
+  size_t full_header_len =
+      SSL_is_dtls(hs->ssl) ? DTLS1_HM_HEADER_LENGTH : SSL3_HM_HEADER_LENGTH;
+  auto before_zeros = msg.subspan(full_header_len, offset - full_header_len);
   auto after_zeros = msg.subspan(offset + ECH_CONFIRMATION_SIGNAL_LEN);
+
   uint8_t context[EVP_MAX_MD_SIZE];
   unsigned context_len;
   ScopedEVP_MD_CTX ctx;
   if (!transcript.CopyToHashContext(ctx.get(), transcript.Digest()) ||
+      !EVP_DigestUpdate(ctx.get(), header.data(), header.size()) ||
       !EVP_DigestUpdate(ctx.get(), before_zeros.data(), before_zeros.size()) ||
       !EVP_DigestUpdate(ctx.get(), kZeros, ECH_CONFIRMATION_SIGNAL_LEN) ||
       !EVP_DigestUpdate(ctx.get(), after_zeros.data(), after_zeros.size()) ||
@@ -619,10 +691,9 @@ bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
 
   assert(out.size() == ECH_CONFIRMATION_SIGNAL_LEN);
   return hkdf_expand_label(
-      out, transcript.Digest(), MakeConstSpan(secret, secret_len),
-      is_hrr ? label_to_span("hrr ech accept confirmation")
-             : label_to_span("ech accept confirmation"),
-      MakeConstSpan(context, context_len), SSL_is_dtls(hs->ssl));
+      out, transcript.Digest(), Span(secret, secret_len),
+      is_hrr ? "hrr ech accept confirmation" : "ech accept confirmation",
+      Span(context, context_len), SSL_is_dtls(hs->ssl));
 }
 
 BSSL_NAMESPACE_END