tttls1.3 0.2.12 → 0.2.16

data/lib/tttls1.3/client.rb

@@ -43,6 +43,11 @@ module TTTLS13
   ].freeze
   private_constant :DEFAULT_CH_NAMED_GROUP_LIST
 
+  DEFALUT_CH_COMPRESS_CERTIFICATE_ALGORITHMS = [
+    Message::Extension::CertificateCompressionAlgorithm::ZLIB
+  ].freeze
+  private_constant :DEFALUT_CH_COMPRESS_CERTIFICATE_ALGORITHMS
+
   DEFAULT_CLIENT_SETTINGS = {
     ca_file: nil,
     cipher_suites: DEFAULT_CH_CIPHER_SUITES,
@@ -61,6 +66,7 @@ module TTTLS13
     record_size_limit: nil,
     check_certificate_status: false,
     process_certificate_status: nil,
+    compress_certificate_algorithms: DEFALUT_CH_COMPRESS_CERTIFICATE_ALGORITHMS,
     compatibility_mode: true,
     loglevel: Logger::WARN
   }.freeze
@@ -154,8 +160,8 @@ module TTTLS13
 
           extensions, priv_keys = gen_ch_extensions
           binder_key = (use_psk? ? key_schedule.binder_key_res : nil)
-          transcript[CH] = send_client_hello(extensions, binder_key)
-
+          ch = send_client_hello(extensions, binder_key)
+          transcript[CH] = [ch, ch.serialize]
           send_ccs if @settings[:compatibility_mode]
           if use_early_data?
             e_wcipher = gen_cipher(
@@ -170,7 +176,7 @@ module TTTLS13
         when ClientState::WAIT_SH
           logger.debug('ClientState::WAIT_SH')
 
-          sh = transcript[SH] = recv_server_hello
+          sh, = transcript[SH] = recv_server_hello
 
           # downgrade protection
           if !sh.negotiated_tls_1_3? && sh.downgraded?
@@ -187,7 +193,7 @@ module TTTLS13
             unless sh.legacy_compression_method == "\x00"
 
           # validate sh using ch
-          ch = transcript[CH]
+          ch, = transcript[CH]
           terminate(:illegal_parameter) \
             unless sh.legacy_version == ch.legacy_version
           terminate(:illegal_parameter) \
@@ -199,7 +205,7 @@ module TTTLS13
 
           # validate sh using hrr
           if transcript.include?(HRR)
-            hrr = transcript[HRR]
+            hrr, = transcript[HRR]
             terminate(:illegal_parameter) \
               unless sh.cipher_suite == hrr.cipher_suite
 
@@ -212,8 +218,9 @@ module TTTLS13
           # handling HRR
           if sh.hrr?
             terminate(:unexpected_message) if transcript.include?(HRR)
-            ch1 = transcript[CH1] = transcript.delete(CH)
-            hrr = transcript[HRR] = transcript.delete(SH)
+
+            ch1, = transcript[CH1] = transcript.delete(CH)
+            hrr, = transcript[HRR] = transcript.delete(SH)
 
             # validate cookie
             diff_sets = sh.extensions.keys - ch1.extensions.keys
@@ -235,8 +242,9 @@ module TTTLS13
             extensions, pk = gen_newch_extensions(ch1, hrr)
             priv_keys = pk.merge(priv_keys)
             binder_key = (use_psk? ? key_schedule.binder_key_res : nil)
-            transcript[CH] = send_new_client_hello(ch1, hrr, extensions,
-                                                   binder_key)
+            ch = send_new_client_hello(ch1, hrr, extensions, binder_key)
+            transcript[CH] = [ch, ch.serialize]
+
             @state = ClientState::WAIT_SH
             next
           end
@@ -277,37 +285,46 @@ module TTTLS13
         when ClientState::WAIT_EE
           logger.debug('ClientState::WAIT_EE')
 
-          ee = transcript[EE] = recv_encrypted_extensions(hs_rcipher)
+          ee, = transcript[EE] = recv_encrypted_extensions(hs_rcipher)
           terminate(:illegal_parameter) unless ee.appearable_extensions?
 
-          ch = transcript[CH]
+          ch, = transcript[CH]
           terminate(:unsupported_extension) \
             unless (ee.extensions.keys - ch.extensions.keys).empty?
 
           rsl = ee.extensions[Message::ExtensionType::RECORD_SIZE_LIMIT]
           @recv_record_size = rsl.record_size_limit unless rsl.nil?
-
           @succeed_early_data = true \
             if ee.extensions.include?(Message::ExtensionType::EARLY_DATA)
-
           @alpn = ee.extensions[
             Message::ExtensionType::APPLICATION_LAYER_PROTOCOL_NEGOTIATION
           ]&.protocol_name_list&.first
-
           @state = ClientState::WAIT_CERT_CR
           @state = ClientState::WAIT_FINISHED unless psk.nil?
         when ClientState::WAIT_CERT_CR
           logger.debug('ClientState::WAIT_CERT_CR')
 
-          message = recv_message(receivable_ccs: true, cipher: hs_rcipher)
-          if message.msg_type == Message::HandshakeType::CERTIFICATE
-            ct = transcript[CT] = message
-            alert = check_invalid_certificate(ct, transcript[CH])
+          message, orig_msg = recv_message(
+            receivable_ccs: true,
+            cipher: hs_rcipher
+          )
+          case message.msg_type
+          when Message::HandshakeType::CERTIFICATE,
+               Message::HandshakeType::COMPRESSED_CERTIFICATE
+            ct, = transcript[CT] = [message, orig_msg]
+            terminate(:bad_certificate) \
+              if ct.is_a?(Message::CompressedCertificate) &&
+                 !@settings[:compress_certificate_algorithms]
+                 .include?(ct.algorithm)
+
+            ct = ct.certificate_message \
+              if ct.is_a?(Message::CompressedCertificate)
+            alert = check_invalid_certificate(ct, transcript[CH].first)
             terminate(alert) unless alert.nil?
 
             @state = ClientState::WAIT_CV
-          elsif message.msg_type == Message::HandshakeType::CERTIFICATE_REQUEST
-            transcript[CR] = message
+          when Message::HandshakeType::CERTIFICATE_REQUEST
+            transcript[CR] = [message, orig_msg]
             # TODO: client authentication
             @state = ClientState::WAIT_CERT
           else
@@ -316,46 +333,56 @@ module TTTLS13
         when ClientState::WAIT_CERT
           logger.debug('ClientState::WAIT_CERT')
 
-          ct = transcript[CT] = recv_certificate(hs_rcipher)
-          alert = check_invalid_certificate(ct, transcript[CH])
+          ct, = transcript[CT] = recv_certificate(hs_rcipher)
+          if ct.is_a?(Message::CompressedCertificate) &&
+             !@settings[:compress_certificate_algorithms].include?(ct.algorithm)
+            terminate(:bad_certificate)
+          elsif ct.is_a?(Message::CompressedCertificate)
+            ct = ct.certificate_message
+          end
+
+          alert = check_invalid_certificate(ct, transcript[CH].first)
           terminate(alert) unless alert.nil?
 
           @state = ClientState::WAIT_CV
         when ClientState::WAIT_CV
           logger.debug('ClientState::WAIT_CV')
 
-          cv = transcript[CV] = recv_certificate_verify(hs_rcipher)
+          cv, = transcript[CV] = recv_certificate_verify(hs_rcipher)
           digest = CipherSuite.digest(@cipher_suite)
           hash = transcript.hash(digest, CT)
+          ct, = transcript[CT]
+          ct = ct.certificate_message \
+            if ct.is_a?(Message::CompressedCertificate)
           terminate(:decrypt_error) \
-            unless verified_certificate_verify?(transcript[CT], cv, hash)
+            unless verified_certificate_verify?(ct, cv, hash)
 
           @signature_scheme = cv.signature_scheme
-
           @state = ClientState::WAIT_FINISHED
         when ClientState::WAIT_FINISHED
           logger.debug('ClientState::WAIT_FINISHED')
 
-          sf = transcript[SF] = recv_finished(hs_rcipher)
+          sf, = transcript[SF] = recv_finished(hs_rcipher)
           digest = CipherSuite.digest(@cipher_suite)
-          verified = verified_finished?(
+          terminate(:decrypt_error) unless verified_finished?(
             finished: sf,
             digest: digest,
             finished_key: key_schedule.server_finished_key,
             hash: transcript.hash(digest, CV)
           )
-          terminate(:decrypt_error) unless verified
-
-          transcript[EOED] = send_eoed(e_wcipher) \
-            if use_early_data? && succeed_early_data?
 
+          if use_early_data? && succeed_early_data?
+            eoed = send_eoed(e_wcipher)
+            transcript[EOED] = [eoed, eoed.serialize]
+          end
           # TODO: Send Certificate [+ CertificateVerify]
           signature = sign_finished(
             digest: digest,
             finished_key: key_schedule.client_finished_key,
             hash: transcript.hash(digest, EOED)
           )
-          transcript[CF] = send_finished(signature, hs_wcipher)
+          cf = send_finished(signature, hs_wcipher)
+          transcript[CF] = [cf, cf.serialize]
           @alert_wcipher = @ap_wcipher = gen_cipher(
             @cipher_suite,
             key_schedule.client_application_write_key,
@@ -403,23 +430,16 @@ module TTTLS13
     # @return [Boolean]
     #
     # @example
-    #   meth = Client.method(:softfail_check_certificate_status)
+    #   m = Client.method(:softfail_check_certificate_status)
     #   Client.new(
     #     socket,
     #     hostname,
     #     check_certificate_status: true,
-    #     process_certificate_status: meth
+    #     process_certificate_status: m
     #   )
-    # rubocop: disable Metrics/AbcSize
-    # rubocop: disable Metrics/CyclomaticComplexity
-    # rubocop: disable Metrics/PerceivedComplexity
     def self.softfail_check_certificate_status(res, cert, chain)
       ocsp_response = res
-      store = OpenSSL::X509::Store.new
-      store.set_default_paths
-      context = OpenSSL::X509::StoreContext.new(store, cert, chain)
-      context.verify
-      cid = OpenSSL::OCSP::CertificateId.new(cert, context.chain[1])
+      cid = OpenSSL::OCSP::CertificateId.new(cert, chain.first)
 
       # When NOT received OCSPResponse in TLS handshake, this method will
       # send OCSPRequest. If ocsp_uri is NOT presented in Certificate, return
@@ -430,23 +450,25 @@ module TTTLS13
         return true if uri.nil?
 
         begin
-          Timeout.timeout(2) { ocsp_response = send_ocsp_request(cid, uri) }
+          # send OCSP::Request
+          ocsp_request = gen_ocsp_request(cid)
+          Timeout.timeout(2) do
+            ocsp_response = send_ocsp_request(ocsp_request, uri)
+          end
+
+          # check nonce of OCSP::Response
+          check_nonce = ocsp_request.check_nonce(ocsp_response.basic)
+          return true unless [-1, 1].include?(check_nonce)
         rescue StandardError
           return true
         end
       end
-      return false \
+      return true \
         if ocsp_response.status != OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL
 
       status = ocsp_response.basic.status.find { |s| s.first.cmp(cid) }
-      return false if status[1] != OpenSSL::OCSP::V_CERTSTATUS_GOOD
-      return false if !status[3].nil? && status[3] < Time.now
-
-      ocsp_response.basic.verify(chain, store)
+      status[1] != OpenSSL::OCSP::V_CERTSTATUS_REVOKED
     end
-    # rubocop: enable Metrics/AbcSize
-    # rubocop: enable Metrics/CyclomaticComplexity
-    # rubocop: enable Metrics/PerceivedComplexity
 
     private
 
@@ -479,6 +501,9 @@ module TTTLS13
       rsl = @settings[:record_size_limit]
       return false if !rsl.nil? && (rsl < 64 || rsl > 2**14 + 1)
 
+      return false if @settings[:check_certificate_status] &&
+                      @settings[:process_certificate_status].nil?
+
       true
     end
     # rubocop: enable Metrics/AbcSize
@@ -530,7 +555,7 @@ module TTTLS13
     # rubocop: disable Metrics/MethodLength
     # rubocop: disable Metrics/PerceivedComplexity
     def gen_ch_extensions
-      exs = []
+      exs = Message::Extensions.new
       # server_name
       exs << Message::Extension::ServerName.new(@hostname)
 
@@ -580,7 +605,15 @@ module TTTLS13
       exs << Message::Extension::OCSPStatusRequest.new \
         if @settings[:check_certificate_status]
 
-      [Message::Extensions.new(exs), priv_keys]
+      # compress_certificate
+      if !@settings[:compress_certificate_algorithms].nil? &&
+         !@settings[:compress_certificate_algorithms].empty?
+        exs << Message::Extension::CompressCertificate.new(
+          @settings[:compress_certificate_algorithms]
+        )
+      end
+
+      [exs, priv_keys]
     end
     # rubocop: enable Metrics/AbcSize
     # rubocop: enable Metrics/CyclomaticComplexity
@@ -673,7 +706,7 @@ module TTTLS13
     # @return [TTTLS13::Message::Extensions]
     # @return [Hash of NamedGroup => OpenSSL::PKey::EC.$Object]
     def gen_newch_extensions(ch1, hrr)
-      exs = []
+      exs = Message::Extensions.new
       # key_share
       if hrr.extensions.include?(Message::ExtensionType::KEY_SHARE)
         group = hrr.extensions[Message::ExtensionType::KEY_SHARE]
@@ -695,7 +728,7 @@ module TTTLS13
         if hrr.extensions.include?(Message::ExtensionType::COOKIE)
 
       # early_data
-      new_exs = ch1.extensions.merge(Message::Extensions.new(exs))
+      new_exs = ch1.extensions.merge(exs)
       new_exs.delete(Message::ExtensionType::EARLY_DATA)
 
       [new_exs, priv_keys]
@@ -737,11 +770,15 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [TTTLS13::Message::ServerHello]
+    # @return [String]
     def recv_server_hello
-      sh = recv_message(receivable_ccs: true, cipher: Cryptograph::Passer.new)
+      sh, orig_msg = recv_message(
+        receivable_ccs: true,
+        cipher: Cryptograph::Passer.new
+      )
       terminate(:unexpected_message) unless sh.is_a?(Message::ServerHello)
 
-      sh
+      [sh, orig_msg]
     end
 
     # @param cipher [TTTLS13::Cryptograph::Aead]
@@ -749,12 +786,13 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [TTTLS13::Message::EncryptedExtensions]
+    # @return [String]
     def recv_encrypted_extensions(cipher)
-      ee = recv_message(receivable_ccs: true, cipher: cipher)
+      ee, orig_msg = recv_message(receivable_ccs: true, cipher: cipher)
       terminate(:unexpected_message) \
         unless ee.is_a?(Message::EncryptedExtensions)
 
-      ee
+      [ee, orig_msg]
     end
 
     # @param cipher [TTTLS13::Cryptograph::Aead]
@@ -762,11 +800,12 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [TTTLS13::Message::Certificate]
+    # @return [String]
     def recv_certificate(cipher)
-      ct = recv_message(receivable_ccs: true, cipher: cipher)
+      ct, orig_msg = recv_message(receivable_ccs: true, cipher: cipher)
       terminate(:unexpected_message) unless ct.is_a?(Message::Certificate)
 
-      ct
+      [ct, orig_msg]
     end
 
     # @param cipher [TTTLS13::Cryptograph::Aead]
@@ -774,11 +813,12 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [TTTLS13::Message::CertificateVerify]
+    # @return [String]
     def recv_certificate_verify(cipher)
-      cv = recv_message(receivable_ccs: true, cipher: cipher)
+      cv, orig_msg = recv_message(receivable_ccs: true, cipher: cipher)
       terminate(:unexpected_message) unless cv.is_a?(Message::CertificateVerify)
 
-      cv
+      [cv, orig_msg]
     end
 
     # @param cipher [TTTLS13::Cryptograph::Aead]
@@ -786,11 +826,12 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts]
     #
     # @return [TTTLS13::Message::Finished]
+    # @return [String]
     def recv_finished(cipher)
-      sf = recv_message(receivable_ccs: true, cipher: cipher)
+      sf, orig_msg = recv_message(receivable_ccs: true, cipher: cipher)
       terminate(:unexpected_message) unless sf.is_a?(Message::Finished)
 
-      sf
+      [sf, orig_msg]
     end
 
     # @param cipher [TTTLS13::Cryptograph::Aead]

data/lib/tttls1.3/connection.rb

@@ -16,7 +16,7 @@ module TTTLS13
       @ap_wcipher = Cryptograph::Passer.new
       @ap_rcipher = Cryptograph::Passer.new
       @alert_wcipher = Cryptograph::Passer.new
-      @message_queue = [] # Array of TTTLS13::Message::$Object
+      @message_queue = [] # Array of [TTTLS13::Message::$Object, String]
       @binary_buffer = '' # deposit Record.surplus_binary
       @cipher_suite = nil # TTTLS13::CipherSuite
       @named_group = nil # TTTLS13::NamedGroup
@@ -42,7 +42,7 @@ module TTTLS13
 
       message = nil
       loop do
-        message = recv_message(receivable_ccs: false, cipher: @ap_rcipher)
+        message, = recv_message(receivable_ccs: false, cipher: @ap_rcipher)
         # At any time after the server has received the client Finished
         # message, it MAY send a NewSessionTicket message.
         break unless message.is_a?(Message::NewSessionTicket)
@@ -220,13 +220,15 @@ module TTTLS13
     # @raise [TTTLS13::Error::ErrorAlerts
     #
     # @return [TTTLS13::Message::$Object]
+    # @return [String]
     # rubocop: disable Metrics/CyclomaticComplexity
     def recv_message(receivable_ccs:, cipher:)
       return @message_queue.shift unless @message_queue.empty?
 
       messages = nil
+      orig_msgs = []
       loop do
-        record = recv_record(cipher)
+        record, orig_msgs = recv_record(cipher)
         case record.type
         when Message::ContentType::HANDSHAKE,
              Message::ContentType::APPLICATION_DATA
@@ -243,20 +245,22 @@ module TTTLS13
         end
       end
 
-      @message_queue += messages[1..]
+      @message_queue += messages[1..].zip(orig_msgs[1..])
       message = messages.first
+      orig_msg = orig_msgs.first
       if message.is_a?(Message::Alert)
         handle_received_alert(message)
         return nil
       end
 
-      message
+      [message, orig_msg]
     end
     # rubocop: enable Metrics/CyclomaticComplexity
 
     # @param cipher [TTTLS13::Cryptograph::Aead, Passer]
     #
     # @return [TTTLS13::Message::Record]
+    # @return [Array of String]
     def recv_record(cipher)
       binary = @socket.read(5)
       record_len = Convert.bin2i(binary.slice(3, 2))
@@ -264,9 +268,13 @@ module TTTLS13
 
       begin
         buffer = @binary_buffer
-        record = Message::Record.deserialize(binary, cipher, buffer,
-                                             @recv_record_size)
-        @binary_buffer = record.surplus_binary
+        record, orig_msgs, surplus_binary = Message::Record.deserialize(
+          binary,
+          cipher,
+          buffer,
+          @recv_record_size
+        )
+        @binary_buffer = surplus_binary
       rescue Error::ErrorAlerts => e
         terminate(e.message.to_sym)
       end
@@ -278,7 +286,7 @@ module TTTLS13
       end
 
       logger.debug("receive \n" + record.pretty_inspect)
-      record
+      [record, orig_msgs]
     end
 
     # @param ch1 [TTTLS13::Message::ClientHello]
@@ -292,11 +300,9 @@ module TTTLS13
       # TODO: ext binder
       hash_len = OpenSSL::Digest.new(digest).digest_length
       tt = Transcript.new
-      tt.merge!(
-        CH1 => ch1,
-        HRR => hrr,
-        CH => ch
-      )
+      tt[CH1] = [ch1, ch1.serialize] unless ch1.nil?
+      tt[HRR] = [hrr, hrr.serialize] unless hrr.nil?
+      tt[CH] = [ch, ch.serialize]
       # transcript-hash (CH1 + HRR +) truncated-CH
       hash = tt.truncate_hash(digest, CH, hash_len + 3)
       OpenSSL::HMAC.digest(digest, binder_key, hash)
@@ -500,11 +506,10 @@ module TTTLS13
       return false if san.nil?
 
       ostr = OpenSSL::ASN1.decode(san.to_der).value.last
-      matching = OpenSSL::ASN1.decode(ostr.value).map(&:value)
-                              .map { |s| s.gsub('.', '\.').gsub('*', '.*') }
-                              .any? { |s| name.match(/#{s}/) }
-
-      matching
+      OpenSSL::ASN1.decode(ostr.value)
+                   .map(&:value)
+                   .map { |s| s.gsub('.', '\.').gsub('*', '.*') }
+                   .any? { |s| name.match(/#{s}/) }
     end
 
     # @param signature_algorithms [Array of SignatureAlgorithms]
@@ -514,22 +519,22 @@ module TTTLS13
     def do_select_signature_algorithms(signature_algorithms, crt)
       spki = OpenSSL::Netscape::SPKI.new
       spki.public_key = crt.public_key
-      oid_str = spki.to_text.split("\n")
-                    .find { |l| l.include?('Public Key Algorithm:') }
+      pka = OpenSSL::ASN1.decode(spki.to_der)
+                         .value.first.value.first.value.first.value.first.value
       signature_algorithms.select do |sa|
         case sa
         when SignatureScheme::ECDSA_SECP256R1_SHA256,
              SignatureScheme::ECDSA_SECP384R1_SHA384,
              SignatureScheme::ECDSA_SECP521R1_SHA512
-          oid_str.include?('id-ecPublicKey')
+          pka == 'id-ecPublicKey'
         when SignatureScheme::RSA_PSS_PSS_SHA256,
              SignatureScheme::RSA_PSS_PSS_SHA384,
              SignatureScheme::RSA_PSS_PSS_SHA512
-          oid_str.include?('rsassaPss')
+          pka == 'rsassaPss'
         when SignatureScheme::RSA_PSS_RSAE_SHA256,
              SignatureScheme::RSA_PSS_RSAE_SHA384,
              SignatureScheme::RSA_PSS_RSAE_SHA512
-          oid_str.include?('rsaEncryption')
+          pka == 'rsaEncryption'
         else
           # RSASSA-PKCS1-v1_5 algorithms refer solely to signatures which appear
           # in certificates and are not defined for use in signed TLS handshake
@@ -541,19 +546,27 @@ module TTTLS13
 
     class << self
       # @param cid [OpenSSL::OCSP::CertificateId]
-      # @param uri [String]
       #
-      # @return [OpenSSL::OCSP::Response]
-      def send_ocsp_request(cid, uri)
-        # generate OCSPRequest
+      # @return [OpenSSL::OCSP::Request]
+      def gen_ocsp_request(cid)
         ocsp_request = OpenSSL::OCSP::Request.new
         ocsp_request.add_certid(cid)
         ocsp_request.add_nonce
+        ocsp_request
+      end
+
+      # @param ocsp_request [OpenSSL::OCSP::Request]
+      # @param uri_string [String]
+      #
+      # @raise [Net::OpenTimeout, OpenSSL::OCSP::OCSPError, URI::$Exception]
+      #
+      # @return [OpenSSL::OCSP::Response, n
+      def send_ocsp_request(ocsp_request, uri_string)
         # send HTTP POST
-        uri = URI.parse(uri)
+        uri = URI.parse(uri_string)
         path = uri.path
         path = '/' if path.nil? || path.empty?
-        http_response = Net::HTTP.start uri.host, uri.port do |http|
+        http_response = Net::HTTP.start(uri.host, uri.port) do |http|
           http.post(
             path,
             ocsp_request.to_der,

data/lib/tttls1.3/cryptograph/aead.rb

@@ -44,8 +44,7 @@ module TTTLS13
       #
       # @return [String]
       def encrypt(content, type)
-        reset_cipher
-        cipher = @cipher.encrypt
+        cipher = reset_cipher
         plaintext = content + type + "\x00" * @length_of_padding
         cipher.auth_data = additional_data(plaintext.length)
         encrypted_data = cipher.update(plaintext) + cipher.final
@@ -66,8 +65,7 @@ module TTTLS13
       # @return [String]
       # @return [TTTLS13::Message::ContentType]
       def decrypt(encrypted_record, auth_data)
-        reset_cipher
-        decipher = @cipher.decrypt
+        decipher = reset_decipher
         auth_tag = encrypted_record[-@auth_tag_len..-1]
         decipher.auth_tag = auth_tag
         decipher.auth_data = auth_data # record header of TLSCiphertext
@@ -105,11 +103,26 @@ module TTTLS13
         + ciphertext_len.to_uint16
       end
 
+      # @return [OpenSSL::Cipher]
       def reset_cipher
-        @cipher.reset
-        @cipher.key = @write_key
+        cipher = @cipher.encrypt
+        cipher.reset
+        cipher.key = @write_key
         iv_len = CipherSuite.iv_len(@cipher_suite)
-        @cipher.iv = @sequence_number.xor(@write_iv, iv_len)
+        cipher.iv = @sequence_number.xor(@write_iv, iv_len)
+
+        cipher
+      end
+
+      # @return [OpenSSL::Cipher]
+      def reset_decipher
+        decipher = @cipher.decrypt
+        decipher.reset
+        decipher.key = @write_key
+        iv_len = CipherSuite.iv_len(@cipher_suite)
+        decipher.iv = @sequence_number.xor(@write_iv, iv_len)
+
+        decipher
       end
 
       # @param clear [String]

data/lib/tttls1.3/cryptograph.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-Dir[File.dirname(__FILE__) + '/cryptograph/*.rb'].each { |f| require f }
+Dir[File.dirname(__FILE__) + '/cryptograph/*.rb'].sort.each { |f| require f }

data/lib/tttls1.3/message/alert.rb

@@ -8,7 +8,7 @@ module TTTLS13
       FATAL   = "\x02"
     end
 
-    # rubocop: disable Layout/AlignHash
+    # rubocop: disable Layout/HashAlignment
     ALERT_DESCRIPTION = {
       close_notify:                    "\x00",
       unexpected_message:              "\x0a",
@@ -38,7 +38,7 @@ module TTTLS13
       certificate_required:            "\x74",
       no_application_protocol:         "\x78"
     }.freeze
-    # rubocop: enable Layout/AlignHash
+    # rubocop: enable Layout/HashAlignment
 
     class Alert
       attr_reader :level

data/lib/tttls1.3/message/client_hello.rb

@@ -18,6 +18,7 @@ module TTTLS13
       ExtensionType::CLIENT_CERTIFICATE_TYPE,
       ExtensionType::SERVER_CERTIFICATE_TYPE,
       ExtensionType::PADDING,
+      ExtensionType::COMPRESS_CERTIFICATE,
       ExtensionType::RECORD_SIZE_LIMIT,
       ExtensionType::PWD_PROTECT,
       ExtensionType::PWD_CLEAR,