grpc 1.69.0 → 1.70.1

data/third_party/boringssl-with-bazel/src/ssl/tls13_enc.cc

@@ -1,4 +1,4 @@
-/* Copyright (c) 2016, Google Inc.
+/* Copyright 2016 The BoringSSL Authors
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -21,7 +21,9 @@
 #include <utility>
 
 #include <openssl/aead.h>
+#include <openssl/aes.h>
 #include <openssl/bytestring.h>
+#include <openssl/chacha.h>
 #include <openssl/digest.h>
 #include <openssl/hkdf.h>
 #include <openssl/hmac.h>
@@ -41,9 +43,8 @@ static bool init_key_schedule(SSL_HANDSHAKE *hs, SSLTranscript *transcript,
   }
 
   // Initialize the secret to the zero key.
-  hs->ResizeSecrets(transcript->DigestLen());
-  OPENSSL_memset(hs->secret().data(), 0, hs->secret().size());
-
+  hs->secret.clear();
+  hs->secret.Resize(transcript->DigestLen());
   return true;
 }
 
@@ -51,11 +52,11 @@ static bool hkdf_extract_to_secret(SSL_HANDSHAKE *hs,
                                    const SSLTranscript &transcript,
                                    Span<const uint8_t> in) {
   size_t len;
-  if (!HKDF_extract(hs->secret().data(), &len, transcript.Digest(), in.data(),
-                    in.size(), hs->secret().data(), hs->secret().size())) {
+  if (!HKDF_extract(hs->secret.data(), &len, transcript.Digest(), in.data(),
+                    in.size(), hs->secret.data(), hs->secret.size())) {
     return false;
   }
-  assert(len == hs->secret().size());
+  assert(len == hs->secret.size());
   return true;
 }
 
@@ -83,9 +84,7 @@ bool tls13_init_early_key_schedule(SSL_HANDSHAKE *hs,
   return init_key_schedule(hs, transcript,
                            ssl_session_protocol_version(session),
                            session->cipher) &&
-         hkdf_extract_to_secret(
-             hs, *transcript,
-             MakeConstSpan(session->secret, session->secret_length));
+         hkdf_extract_to_secret(hs, *transcript, session->secret);
 }
 
 static Span<const char> label_to_span(const char *label) {
@@ -137,9 +136,9 @@ static bool hkdf_expand_label(Span<uint8_t> out, const EVP_MD *digest,
         label, hash);
   }
   return CRYPTO_tls13_hkdf_expand_label(
-      out.data(), out.size(), digest, secret.data(), secret.size(),
-      reinterpret_cast<const uint8_t *>(label.data()), label.size(),
-      hash.data(), hash.size()) == 1;
+             out.data(), out.size(), digest, secret.data(), secret.size(),
+             reinterpret_cast<const uint8_t *>(label.data()), label.size(),
+             hash.data(), hash.size()) == 1;
 }
 
 static const char kTLS13LabelDerived[] = "derived";
@@ -149,32 +148,34 @@ bool tls13_advance_key_schedule(SSL_HANDSHAKE *hs, Span<const uint8_t> in) {
   unsigned derive_context_len;
   return EVP_Digest(nullptr, 0, derive_context, &derive_context_len,
                     hs->transcript.Digest(), nullptr) &&
-         hkdf_expand_label(hs->secret(), hs->transcript.Digest(), hs->secret(),
-                           label_to_span(kTLS13LabelDerived),
+         hkdf_expand_label(MakeSpan(hs->secret), hs->transcript.Digest(),
+                           hs->secret, label_to_span(kTLS13LabelDerived),
                            MakeConstSpan(derive_context, derive_context_len),
                            SSL_is_dtls(hs->ssl)) &&
          hkdf_extract_to_secret(hs, hs->transcript, in);
 }
 
-// derive_secret_with_transcript derives a secret of length |out.size()| and
-// writes the result in |out| with the given label, the current base secret, and
-// the state of |transcript|. It returns true on success and false on error.
-static bool derive_secret_with_transcript(const SSL_HANDSHAKE *hs,
-                                          Span<uint8_t> out,
-                                          const SSLTranscript &transcript,
-                                          Span<const char> label) {
+// derive_secret_with_transcript derives a secret of length
+// |transcript.DigestLen()| and writes the result in |out| with the given label,
+// the current base secret, and the state of |transcript|. It returns true on
+// success and false on error.
+static bool derive_secret_with_transcript(
+    const SSL_HANDSHAKE *hs, InplaceVector<uint8_t, SSL_MAX_MD_SIZE> *out,
+    const SSLTranscript &transcript, Span<const char> label) {
   uint8_t context_hash[EVP_MAX_MD_SIZE];
   size_t context_hash_len;
   if (!transcript.GetHash(context_hash, &context_hash_len)) {
     return false;
   }
 
-  return hkdf_expand_label(out, transcript.Digest(), hs->secret(), label,
-                           MakeConstSpan(context_hash, context_hash_len),
+  out->ResizeForOverwrite(transcript.DigestLen());
+  return hkdf_expand_label(MakeSpan(*out), transcript.Digest(), hs->secret,
+                           label, MakeConstSpan(context_hash, context_hash_len),
                            SSL_is_dtls(hs->ssl));
 }
 
-static bool derive_secret(SSL_HANDSHAKE *hs, Span<uint8_t> out,
+static bool derive_secret(SSL_HANDSHAKE *hs,
+                          InplaceVector<uint8_t, SSL_MAX_MD_SIZE> *out,
                           Span<const char> label) {
   return derive_secret_with_transcript(hs, out, hs->transcript, label);
 }
@@ -187,93 +188,164 @@ bool tls13_set_traffic_key(SSL *ssl, enum ssl_encryption_level_t level,
   const EVP_MD *digest = ssl_session_get_digest(session);
   bool is_dtls = SSL_is_dtls(ssl);
   UniquePtr<SSLAEADContext> traffic_aead;
-  Span<const uint8_t> secret_for_quic;
-  if (ssl->quic_method != nullptr) {
+  if (SSL_is_quic(ssl)) {
     // Install a placeholder SSLAEADContext so that SSL accessors work. The
     // encryption itself will be handled by the SSL_QUIC_METHOD.
-    traffic_aead =
-        SSLAEADContext::CreatePlaceholderForQUIC(version, session->cipher);
-    secret_for_quic = traffic_secret;
+    traffic_aead = SSLAEADContext::CreatePlaceholderForQUIC(session->cipher);
   } else {
     // Look up cipher suite properties.
     const EVP_AEAD *aead;
     size_t discard;
     if (!ssl_cipher_get_evp_aead(&aead, &discard, &discard, session->cipher,
-                                 version, is_dtls)) {
+                                 version)) {
       return false;
     }
 
-    // Derive the key.
-    size_t key_len = EVP_AEAD_key_length(aead);
-    uint8_t key_buf[EVP_AEAD_MAX_KEY_LENGTH];
-    auto key = MakeSpan(key_buf, key_len);
+    // Derive the key and IV.
+    uint8_t key_buf[EVP_AEAD_MAX_KEY_LENGTH], iv_buf[EVP_AEAD_MAX_NONCE_LENGTH];
+    auto key = MakeSpan(key_buf).first(EVP_AEAD_key_length(aead));
+    auto iv = MakeSpan(iv_buf).first(EVP_AEAD_nonce_length(aead));
     if (!hkdf_expand_label(key, digest, traffic_secret, label_to_span("key"),
-                           {}, is_dtls)) {
-      return false;
-    }
-
-    // Derive the IV.
-    size_t iv_len = EVP_AEAD_nonce_length(aead);
-    uint8_t iv_buf[EVP_AEAD_MAX_NONCE_LENGTH];
-    auto iv = MakeSpan(iv_buf, iv_len);
-    if (!hkdf_expand_label(iv, digest, traffic_secret, label_to_span("iv"), {},
+                           {}, is_dtls) ||
+        !hkdf_expand_label(iv, digest, traffic_secret, label_to_span("iv"), {},
                            is_dtls)) {
       return false;
     }
 
-    traffic_aead =
-        SSLAEADContext::Create(direction, session->ssl_version, is_dtls,
-                               session->cipher, key, Span<const uint8_t>(), iv);
+    traffic_aead = SSLAEADContext::Create(direction, session->ssl_version,
+                                          session->cipher, key, {}, iv);
   }
 
   if (!traffic_aead) {
     return false;
   }
 
-  if (is_dtls) {
-    RecordNumberEncrypter *rn_encrypter =
-        traffic_aead->GetRecordNumberEncrypter();
-    if (!rn_encrypter) {
+  if (direction == evp_aead_open) {
+    if (!ssl->method->set_read_state(ssl, level, std::move(traffic_aead),
+                                     traffic_secret)) {
       return false;
     }
-    Array<uint8_t> rne_key;
-    if (!rne_key.Init(rn_encrypter->KeySize()) ||
-        !hkdf_expand_label(MakeSpan(rne_key), digest, traffic_secret,
-                           label_to_span("sn"), {}, is_dtls) ||
-        !rn_encrypter->SetKey(MakeSpan(rne_key))) {
+    ssl->s3->read_traffic_secret.CopyFrom(traffic_secret);
+  } else {
+    if (!ssl->method->set_write_state(ssl, level, std::move(traffic_aead),
+                                      traffic_secret)) {
       return false;
     }
+    ssl->s3->write_traffic_secret.CopyFrom(traffic_secret);
   }
 
-  if (traffic_secret.size() >
-          OPENSSL_ARRAY_SIZE(ssl->s3->read_traffic_secret) ||
-      traffic_secret.size() >
-          OPENSSL_ARRAY_SIZE(ssl->s3->write_traffic_secret)) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
+  return true;
+}
+
+namespace {
+
+class AESRecordNumberEncrypter : public RecordNumberEncrypter {
+ public:
+  bool SetKey(Span<const uint8_t> key) override {
+    return AES_set_encrypt_key(key.data(), key.size() * 8, &key_) == 0;
   }
 
-  if (direction == evp_aead_open) {
-    if (!ssl->method->set_read_state(ssl, level, std::move(traffic_aead),
-                                     secret_for_quic)) {
+  bool GenerateMask(Span<uint8_t> out, Span<const uint8_t> sample) override {
+    if (sample.size() < AES_BLOCK_SIZE || out.size() > AES_BLOCK_SIZE) {
       return false;
     }
-    OPENSSL_memmove(ssl->s3->read_traffic_secret, traffic_secret.data(),
-                    traffic_secret.size());
-    ssl->s3->read_traffic_secret_len = traffic_secret.size();
-  } else {
-    if (!ssl->method->set_write_state(ssl, level, std::move(traffic_aead),
-                                      secret_for_quic)) {
+    uint8_t mask[AES_BLOCK_SIZE];
+    AES_encrypt(sample.data(), mask, &key_);
+    OPENSSL_memcpy(out.data(), mask, out.size());
+    return true;
+  }
+
+ private:
+  AES_KEY key_;
+};
+
+class AES128RecordNumberEncrypter : public AESRecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return 16; }
+};
+
+class AES256RecordNumberEncrypter : public AESRecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return 32; }
+};
+
+class ChaChaRecordNumberEncrypter : public RecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return kKeySize; }
+
+  bool SetKey(Span<const uint8_t> key) override {
+    if (key.size() != kKeySize) {
       return false;
     }
-    OPENSSL_memmove(ssl->s3->write_traffic_secret, traffic_secret.data(),
-                    traffic_secret.size());
-    ssl->s3->write_traffic_secret_len = traffic_secret.size();
+    OPENSSL_memcpy(key_, key.data(), key.size());
+    return true;
   }
 
-  return true;
-}
+  bool GenerateMask(Span<uint8_t> out, Span<const uint8_t> sample) override {
+    // RFC 9147 section 4.2.3 uses the first 4 bytes of the sample as the
+    // counter and the next 12 bytes as the nonce. If we have less than 4+12=16
+    // bytes in the sample, then we'll read past the end of the |sample| buffer.
+    // The counter is interpreted as little-endian per RFC 8439.
+    if (sample.size() < 16) {
+      return false;
+    }
+    uint32_t counter = CRYPTO_load_u32_le(sample.data());
+    Span<const uint8_t> nonce = sample.subspan(4);
+    OPENSSL_memset(out.data(), 0, out.size());
+    CRYPTO_chacha_20(out.data(), out.data(), out.size(), key_, nonce.data(),
+                     counter);
+    return true;
+  }
+
+ private:
+  static constexpr size_t kKeySize = 32;
+  uint8_t key_[kKeySize];
+};
+
+#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
+class NullRecordNumberEncrypter : public RecordNumberEncrypter {
+ public:
+  size_t KeySize() override { return 0; }
+  bool SetKey(Span<const uint8_t> key) override { return true; }
+  bool GenerateMask(Span<uint8_t> out, Span<const uint8_t> sample) override {
+    OPENSSL_memset(out.data(), 0, out.size());
+    return true;
+  }
+};
+#endif  // BORINGSSL_UNSAFE_FUZZER_MODE
+
+}  // namespace
+
+UniquePtr<RecordNumberEncrypter> RecordNumberEncrypter::Create(
+    const SSL_CIPHER *cipher, Span<const uint8_t> traffic_secret) {
+  const EVP_MD *digest = ssl_get_handshake_digest(TLS1_3_VERSION, cipher);
+  UniquePtr<RecordNumberEncrypter> ret;
+#if defined(BORINGSSL_UNSAFE_FUZZER_MODE)
+  ret = MakeUnique<NullRecordNumberEncrypter>();
+#else
+  if (cipher->algorithm_enc == SSL_AES128GCM) {
+    ret = MakeUnique<AES128RecordNumberEncrypter>();
+  } else if (cipher->algorithm_enc == SSL_AES256GCM) {
+    ret = MakeUnique<AES256RecordNumberEncrypter>();
+  } else if (cipher->algorithm_enc == SSL_CHACHA20POLY1305) {
+    ret = MakeUnique<ChaChaRecordNumberEncrypter>();
+  } else {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+  }
+#endif  // BORINGSSL_UNSAFE_FUZZER_MODE
+  if (ret == nullptr) {
+    return nullptr;
+  }
 
+  uint8_t rne_key_buf[RecordNumberEncrypter::kMaxKeySize];
+  auto rne_key = MakeSpan(rne_key_buf).first(ret->KeySize());
+  if (!hkdf_expand_label(rne_key, digest, traffic_secret, label_to_span("sn"),
+                         {}, /*is_dtls=*/true) ||
+      !ret->SetKey(rne_key)) {
+    return nullptr;
+  }
+  return ret;
+}
 
 static const char kTLS13LabelExporter[] = "exp master";
 
@@ -291,10 +363,10 @@ bool tls13_derive_early_secret(SSL_HANDSHAKE *hs) {
                                         ? hs->inner_transcript
                                         : hs->transcript;
   if (!derive_secret_with_transcript(
-          hs, hs->early_traffic_secret(), transcript,
+          hs, &hs->early_traffic_secret, transcript,
           label_to_span(kTLS13LabelClientEarlyTraffic)) ||
       !ssl_log_secret(ssl, "CLIENT_EARLY_TRAFFIC_SECRET",
-                      hs->early_traffic_secret())) {
+                      hs->early_traffic_secret)) {
     return false;
   }
   return true;
@@ -302,14 +374,14 @@ bool tls13_derive_early_secret(SSL_HANDSHAKE *hs) {
 
 bool tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (!derive_secret(hs, hs->client_handshake_secret(),
+  if (!derive_secret(hs, &hs->client_handshake_secret,
                      label_to_span(kTLS13LabelClientHandshakeTraffic)) ||
       !ssl_log_secret(ssl, "CLIENT_HANDSHAKE_TRAFFIC_SECRET",
-                      hs->client_handshake_secret()) ||
-      !derive_secret(hs, hs->server_handshake_secret(),
+                      hs->client_handshake_secret) ||
+      !derive_secret(hs, &hs->server_handshake_secret,
                      label_to_span(kTLS13LabelServerHandshakeTraffic)) ||
       !ssl_log_secret(ssl, "SERVER_HANDSHAKE_TRAFFIC_SECRET",
-                      hs->server_handshake_secret())) {
+                      hs->server_handshake_secret)) {
     return false;
   }
 
@@ -318,21 +390,17 @@ bool tls13_derive_handshake_secrets(SSL_HANDSHAKE *hs) {
 
 bool tls13_derive_application_secrets(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  ssl->s3->exporter_secret_len = hs->transcript.DigestLen();
-  if (!derive_secret(hs, hs->client_traffic_secret_0(),
+  if (!derive_secret(hs, &hs->client_traffic_secret_0,
                      label_to_span(kTLS13LabelClientApplicationTraffic)) ||
       !ssl_log_secret(ssl, "CLIENT_TRAFFIC_SECRET_0",
-                      hs->client_traffic_secret_0()) ||
-      !derive_secret(hs, hs->server_traffic_secret_0(),
+                      hs->client_traffic_secret_0) ||
+      !derive_secret(hs, &hs->server_traffic_secret_0,
                      label_to_span(kTLS13LabelServerApplicationTraffic)) ||
       !ssl_log_secret(ssl, "SERVER_TRAFFIC_SECRET_0",
-                      hs->server_traffic_secret_0()) ||
-      !derive_secret(
-          hs, MakeSpan(ssl->s3->exporter_secret, ssl->s3->exporter_secret_len),
-          label_to_span(kTLS13LabelExporter)) ||
-      !ssl_log_secret(ssl, "EXPORTER_SECRET",
-                      MakeConstSpan(ssl->s3->exporter_secret,
-                                    ssl->s3->exporter_secret_len))) {
+                      hs->server_traffic_secret_0) ||
+      !derive_secret(hs, &ssl->s3->exporter_secret,
+                     label_to_span(kTLS13LabelExporter)) ||
+      !ssl_log_secret(ssl, "EXPORTER_SECRET", ssl->s3->exporter_secret)) {
     return false;
   }
 
@@ -342,14 +410,9 @@ bool tls13_derive_application_secrets(SSL_HANDSHAKE *hs) {
 static const char kTLS13LabelApplicationTraffic[] = "traffic upd";
 
 bool tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) {
-  Span<uint8_t> secret;
-  if (direction == evp_aead_open) {
-    secret = MakeSpan(ssl->s3->read_traffic_secret,
-                      ssl->s3->read_traffic_secret_len);
-  } else {
-    secret = MakeSpan(ssl->s3->write_traffic_secret,
-                      ssl->s3->write_traffic_secret_len);
-  }
+  Span<uint8_t> secret = direction == evp_aead_open
+                             ? MakeSpan(ssl->s3->read_traffic_secret)
+                             : MakeSpan(ssl->s3->write_traffic_secret);
 
   const SSL_SESSION *session = SSL_get_session(ssl);
   const EVP_MD *digest = ssl_session_get_digest(session);
@@ -363,14 +426,8 @@ bool tls13_rotate_traffic_key(SSL *ssl, enum evp_aead_direction_t direction) {
 static const char kTLS13LabelResumption[] = "res master";
 
 bool tls13_derive_resumption_secret(SSL_HANDSHAKE *hs) {
-  if (hs->transcript.DigestLen() > SSL_MAX_MASTER_KEY_LENGTH) {
-    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
-    return false;
-  }
-  hs->new_session->secret_length = hs->transcript.DigestLen();
-  return derive_secret(
-      hs, MakeSpan(hs->new_session->secret, hs->new_session->secret_length),
-      label_to_span(kTLS13LabelResumption));
+  return derive_secret(hs, &hs->new_session->secret,
+                       label_to_span(kTLS13LabelResumption));
 }
 
 static const char kTLS13LabelFinished[] = "finished";
@@ -398,13 +455,13 @@ static bool tls13_verify_data(uint8_t *out, size_t *out_len,
 bool tls13_finished_mac(SSL_HANDSHAKE *hs, uint8_t *out, size_t *out_len,
                         bool is_server) {
   Span<const uint8_t> traffic_secret =
-      is_server ? hs->server_handshake_secret() : hs->client_handshake_secret();
+      is_server ? hs->server_handshake_secret : hs->client_handshake_secret;
 
   uint8_t context_hash[EVP_MAX_MD_SIZE];
   size_t context_hash_len;
   if (!hs->transcript.GetHash(context_hash, &context_hash_len) ||
       !tls13_verify_data(out, out_len, hs->transcript.Digest(),
-                         hs->ssl->version, traffic_secret,
+                         hs->ssl->s3->version, traffic_secret,
                          MakeConstSpan(context_hash, context_hash_len),
                          SSL_is_dtls(hs->ssl))) {
     return false;
@@ -419,8 +476,8 @@ bool tls13_derive_session_psk(SSL_SESSION *session, Span<const uint8_t> nonce,
   const EVP_MD *digest = ssl_session_get_digest(session);
   // The session initially stores the resumption_master_secret, which we
   // override with the PSK.
-  auto session_secret = MakeSpan(session->secret, session->secret_length);
-  return hkdf_expand_label(session_secret, digest, session_secret,
+  assert(session->secret.size() == EVP_MD_size(digest));
+  return hkdf_expand_label(MakeSpan(session->secret), digest, session->secret,
                            label_to_span(kTLS13LabelResumptionPSK), nonce,
                            is_dtls);
 }
@@ -482,8 +539,9 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
   auto binder_key = MakeSpan(binder_key_buf, EVP_MD_size(digest));
   if (!EVP_Digest(nullptr, 0, binder_context, &binder_context_len, digest,
                   nullptr) ||
-      !HKDF_extract(early_secret, &early_secret_len, digest, session->secret,
-                    session->secret_length, nullptr, 0) ||
+      !HKDF_extract(early_secret, &early_secret_len, digest,
+                    session->secret.data(), session->secret.size(), nullptr,
+                    0) ||
       !hkdf_expand_label(
           binder_key, digest, MakeConstSpan(early_secret, early_secret_len),
           label_to_span(kTLS13LabelPSKBinder),
@@ -500,11 +558,29 @@ static bool tls13_psk_binder(uint8_t *out, size_t *out_len,
   uint8_t context[EVP_MAX_MD_SIZE];
   unsigned context_len;
   ScopedEVP_MD_CTX ctx;
-  if (!transcript.CopyToHashContext(ctx.get(), digest) ||
-      !EVP_DigestUpdate(ctx.get(), truncated.data(),
-                        truncated.size()) ||
-      !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
-    return false;
+  if (!is_dtls) {
+    if (!transcript.CopyToHashContext(ctx.get(), digest) ||
+        !EVP_DigestUpdate(ctx.get(), truncated.data(), truncated.size()) ||
+        !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
+      return false;
+    }
+  } else {
+    // In DTLS 1.3, the transcript hash is computed over only the TLS 1.3
+    // handshake messages (i.e. only type and length in the header), not the
+    // full DTLSHandshake messages that are in |truncated|. This code pulls
+    // the header and body out of the truncated ClientHello and writes those
+    // to the hash context so the correct binder value is computed.
+    if (truncated.size() < DTLS1_HM_HEADER_LENGTH) {
+      return false;
+    }
+    auto header = truncated.subspan(0, 4);
+    auto body = truncated.subspan(12);
+    if (!transcript.CopyToHashContext(ctx.get(), digest) ||
+        !EVP_DigestUpdate(ctx.get(), header.data(), header.size()) ||
+        !EVP_DigestUpdate(ctx.get(), body.data(), body.size()) ||
+        !EVP_DigestFinal_ex(ctx.get(), context, &context_len)) {
+      return false;
+    }
   }
 
   if (!tls13_verify_data(out, out_len, digest, session->ssl_version, binder_key,
@@ -596,12 +672,19 @@ bool ssl_ech_accept_confirmation(const SSL_HANDSHAKE *hs, Span<uint8_t> out,
     return false;
   }
 
-  auto before_zeros = msg.subspan(0, offset);
+  // We represent DTLS messages with the longer DTLS 1.2 header, but DTLS 1.3
+  // removes the extra fields from the transcript.
+  auto header = msg.subspan(0, SSL3_HM_HEADER_LENGTH);
+  size_t full_header_len =
+      SSL_is_dtls(hs->ssl) ? DTLS1_HM_HEADER_LENGTH : SSL3_HM_HEADER_LENGTH;
+  auto before_zeros = msg.subspan(full_header_len, offset - full_header_len);
   auto after_zeros = msg.subspan(offset + ECH_CONFIRMATION_SIGNAL_LEN);
+
   uint8_t context[EVP_MAX_MD_SIZE];
   unsigned context_len;
   ScopedEVP_MD_CTX ctx;
   if (!transcript.CopyToHashContext(ctx.get(), transcript.Digest()) ||
+      !EVP_DigestUpdate(ctx.get(), header.data(), header.size()) ||
       !EVP_DigestUpdate(ctx.get(), before_zeros.data(), before_zeros.size()) ||
       !EVP_DigestUpdate(ctx.get(), kZeros, ECH_CONFIRMATION_SIGNAL_LEN) ||
       !EVP_DigestUpdate(ctx.get(), after_zeros.data(), after_zeros.size()) ||