@amritk/nish-x86_64-linux 0.17.0 → 0.20.0

package/std/net/quic-packet.ts

@@ -5,14 +5,23 @@
  * Initial secrets, AEAD packet protection, header protection and the Retry
  * integrity tag.
  *
- *     import { quicInitialSecrets, quicKeys, quicParseHeader, quicOpenPacket,
+ *     import { quicInitialSecrets, quicKeys, quicParseHeader, quicOpenPacket, QuicKeysSlot,
  *              QUIC_AEAD_AES_128_GCM, QUIC_PACKET_OK } from "nish/net/quic-packet";
+ *     import { Secret, secret, wipe } from "nish:secret";
  *
  *     const secrets = quicInitialSecrets(clientDcid);            // RFC 9001 §5.2
- *     const keys = quicKeys(QUIC_AEAD_AES_128_GCM, secrets.client);
+ *     if (secrets === null) { … a DCID over 20 bytes … }
+ *     const client: u8[] = new Array<u8>(secrets.client.length); // public, so a copy
+ *     client.set(secrets.client);
+ *     const held: Secret<u8[]> = secret(client);
+ *     const slot = new QuicKeysSlot();                           // ours, so ours to wipe
+ *     const keys = quicKeys(slot, QUIC_AEAD_AES_128_GCM, held);
+ *     wipe(held);
+ *     if (keys === null) { … }
  *     const header = quicParseHeader(datagram, 0, 8);            // 8: our short-header DCID length
  *     const packet = quicOpenPacket(keys, datagram, header, largestReceived);
  *     if (packet.error === QUIC_PACKET_OK) { … packet.payload holds the frames … }
+ *     slot.wipe();                                               // once the level is done
  *
  * The module is sans-IO: bytes in, bytes out, no socket and no clock. It
  * frames and protects packets and stops there, so it knows nothing of frames,
@@ -48,14 +57,25 @@
  * carries its own Length, and `QuicHeader.end` is where the next packet in the
  * datagram starts. A short header has none, so it runs to the datagram's end.
  *
- * **Secrets are not wiped.** `QuicKeys` holds a packet key, an IV and a
- * header-protection key, and `quicKeys`, `quicKeyUpdateSecret` and the seal
- * and open functions hold traffic secrets and keys in arena memory until that
- * memory is reused. `nish/crypto`'s signers and X25519 now hold their keys as
- * a `Secret` from `nish:secret` and wipe them (ECC-2, X509-7); this module
- * does not yet, and `docs/security/quic.md` records that as QUIC-1. The
- * Initial keys are not secret, because anyone who reads the client's first
- * DCID can derive them (RFC 9001 §5.2); the Handshake and 1-RTT keys are.
+ * **Secrets.** `QuicKeys` holds a packet key, an IV and a header-protection
+ * key, pointing into a `QuicKeysSlot`'s arrays. `quicKeys` and
+ * `quicKeysUpdate` take a traffic secret as a `Secret` from `nish:secret`
+ * and a slot the caller owns, and derive into the slot; a slot the caller
+ * owns is the caller's to wipe, and `QuicKeysSlot.wipe` zeroes it with
+ * stores no optimiser removes, AES schedules included (QUIC-1).
+ * `quicKeyUpdateSecret` answers the next secret as a `Secret`, and every
+ * derivation wipes its HKDF intermediates before it returns. `quicKeysWipe`
+ * zeroes the arrays one `QuicKeys` points at. The Initial keys are not
+ * secret, because anyone who reads the client's first DCID can derive them
+ * (RFC 9001 §5.2), so `quicInitialSecrets` answers plain arrays, and
+ * `quicKeysInto`, `quicKeysUpdateInto`, `quicKeyUpdateSecretInto` and
+ * `quicInitialSecretsInto` derive from plain secrets over a caller's
+ * `HkdfScratch`; the Handshake and 1-RTT keys are secret. Each derivation's
+ * own temporaries go with its arena block. A slot whose traffic secret is
+ * held as a `Secret` may also derive with `quicKeysHeldInto`, and ratchet
+ * the secret in place with `quicKeyUpdateSecretHeldInto`. Sealing and
+ * opening a packet wipe the nonce, which gives the IV away, and the
+ * header-protection mask once each is used (QUIC-2).
  *
  * **Constant time.** The AEADs and the header-protection masks are
  * `nish/crypto/aes` and `nish/crypto/chacha20poly1305`, with their guarantees.
@@ -73,10 +93,31 @@
  * private functions share the importing program's flat symbol namespace
  * (`docs/wp26-stdlib.md` §3e).
  */
-import { aesGcmOpen, aesGcmSeal, aesHeaderMask, aesKey, AesKey } from "nish/crypto/aes"
+import { Secret, expose, wipe } from "nish:secret"
+import {
+  aesGcmOpen,
+  aesGcmSeal,
+  aesHeaderMask,
+  aesKey,
+  aesKeyInto,
+  aesKeyWipe,
+  AesKey,
+} from "nish/crypto/aes"
 import { chacha20HeaderMask, chacha20Poly1305Open, chacha20Poly1305Seal } from "nish/crypto/chacha20poly1305"
 import { timingSafeEqual } from "nish/crypto/ct"
-import { hkdfExpandLabelSha256, hkdfExpandLabelSha384, hkdfExtractSha256 } from "nish/crypto/hkdf"
+import {
+  HkdfScratch,
+  hkdfExpandLabelHeldInto,
+  hkdfExpandLabelInto,
+  hkdfExpandLabelSha256,
+  hkdfExpandLabelSha256Held,
+  hkdfExpandLabelSha256Secret,
+  hkdfExpandLabelSha384,
+  hkdfExpandLabelSha384Held,
+  hkdfExpandLabelSha384Secret,
+  hkdfExtractInto,
+  hkdfExtractSha256,
+} from "nish/crypto/hkdf"
 
 /** QUIC version 1 (RFC 9000 §15), the only version this module protects. */
 export const QUIC_VERSION_1: i64 = 1
@@ -964,6 +1005,28 @@ const quicPacketSecretLength = (aead: i32): i32 => (aead === QUIC_AEAD_AES_256_G
 const quicPacketSecretFits = (aead: i32, secret: u8[]): boolean =>
   quicPacketKeyLength(aead) !== 0 && toI32(secret.length) === quicPacketSecretLength(aead)
 
+/** `quicPacketSecretFits` for a held secret, whose length is public, read through `expose`. */
+const quicPacketHeldFits = (aead: i32, trafficSecret: Secret<u8[]>): boolean =>
+  quicPacketKeyLength(aead) !== 0 &&
+  expose(trafficSecret, quicPacketBytesLength) === quicPacketSecretLength(aead)
+
+/** The length of `bytes`, for `expose` to read off a held secret. */
+const quicPacketBytesLength = (bytes: u8[]): i32 => toI32(bytes.length)
+
+/** A plain copy of `bytes`, for `expose` to hand a derived key to the `QuicKeys` that holds it. */
+const quicPacketDup = (bytes: u8[]): u8[] => quicPacketSlice(bytes, 0, toI32(bytes.length))
+
+/**
+ * `quicPacketExpandLabel` of a held secret, answered held: the
+ * `hkdfExpandLabelSha*Secret` form, which wipes its own intermediates.
+ */
+const quicPacketExpandHeld = (aead: i32, prk: Secret<u8[]>, label: string, length: i32): Secret<u8[]> => {
+  const none: u8[] = []
+  return aead === QUIC_AEAD_AES_256_GCM
+    ? hkdfExpandLabelSha384Secret(prk, label, none, length)
+    : hkdfExpandLabelSha256Secret(prk, label, none, length)
+}
+
 /**
  * Whether `keys` has the shape `quicKeys` gives: a known AEAD, key and
  * header-protection key of its length, a 12-byte IV, and for the AES suites
@@ -985,65 +1048,362 @@ const quicPacketKeysUsable = (keys: QuicKeys): boolean => {
 }
 
 /**
- * Keys for `aead` with the packet key and IV derived from `secret` (RFC 9001
- * §5.1) and the header-protection key given, which a key update keeps
- * (§6). The caller has checked `secret` with `quicPacketSecretFits`.
+ * The packet-protection keys of RFC 9001 §5.1 from a traffic secret, held as
+ * a `Secret` the caller still owns and wipes, derived into `slot`, which the
+ * caller owns too: the AEAD key (`quic key`), the IV (`quic iv`) and the
+ * header-protection key (`quic hp`), each HKDF-Expand-Label with an empty
+ * context under the hash `aead` pairs with, written into the slot's arrays
+ * and the AES schedules expanded there. The secret is read through a plain
+ * copy inside an arena block, which is zeroed, and the derivation's
+ * temporaries go with the block, so the call keeps in the arena only the
+ * `HkdfScratch` it makes for the derivation, which wipes itself before the
+ * derivation returns.
+ * Answers the slot's keys, which the next derivation into it overwrites and
+ * `QuicKeysSlot.wipe` zeroes, or `null`, deriving nothing, for an `aead`
+ * this module does not know or a secret that is not that hash's length. The
+ * Initial secrets are public (RFC 9001 §5.2), so a caller deriving Initial
+ * keys wraps a copy of one in `secret`, or uses `quicKeysInto`.
  */
-const quicPacketDerive = (aead: i32, secret: u8[], hp: u8[], hpAes: AesKey | null): QuicKeys => {
-  const keys: QuicKeys = new QuicKeys(
-    aead,
-    quicPacketExpandLabel(aead, secret, "quic key", quicPacketKeyLength(aead)),
-    quicPacketExpandLabel(aead, secret, "quic iv", QUIC_IV_SIZE),
-    hp
-  )
-  keys.hpAes = hpAes
-  if (aead !== QUIC_AEAD_CHACHA20_POLY1305) {
-    keys.packetAes = aesKey(keys.key)
+export const quicKeys = (slot: QuicKeysSlot, aead: i32, trafficSecret: Secret<u8[]>): QuicKeys | null => {
+  if (!quicPacketHeldFits(aead, trafficSecret)) {
+    return null
   }
-  return keys
+  const scratch: HkdfScratch = new HkdfScratch()
+  {
+    using _scope = arena()
+    const plain: u8[] = expose(trafficSecret, quicPacketDup)
+    quicKeysInto(scratch, slot, aead, plain)
+    secureZero(plain)
+  }
+  return slot.keys
+}
+
+/**
+ * The next generation's traffic secret for a key update (RFC 9001 §6.1):
+ * HKDF-Expand-Label(`trafficSecret`, `quic ku`, "", Hash.length), taken and
+ * answered as a `Secret` the caller wipes. The header-protection key does
+ * not change with it (§6), so the new keys are `quicKeysUpdate` of the old
+ * keys and this. Answers `null` where `quicKeys` would.
+ */
+export const quicKeyUpdateSecret = (aead: i32, trafficSecret: Secret<u8[]>): Secret<u8[]> | null => {
+  if (!quicPacketHeldFits(aead, trafficSecret)) {
+    return null
+  }
+  return quicPacketExpandHeld(aead, trafficSecret, "quic ku", quicPacketSecretLength(aead))
 }
 
 /**
- * The packet-protection keys of RFC 9001 §5.1 from a traffic `secret`: the
- * AEAD key (`quic key`), the IV (`quic iv`) and the header-protection key
- * (`quic hp`), each HKDF-Expand-Label with an empty context under the hash
- * `aead` pairs with. Answers `null` for an `aead` this module does not know,
- * or a secret that is not that hash's length.
+ * The next generation's keys in a key update (RFC 9001 §6), derived into
+ * `slot`, which the caller owns and which must not be the slot `keys` live
+ * in: the packet key and IV from `nextSecret`, which `quicKeyUpdateSecret`
+ * made from the current secret and the caller still owns, read through a
+ * plain copy inside an arena block that is zeroed, and `keys`'
+ * header-protection key kept, since header protection never changes with
+ * the phase. The new generation holds its own copy of that key and its own
+ * schedule, in the slot, so wiping one generation leaves the other usable.
+ * Answers the slot's keys, or `null`, deriving nothing, for keys `quicKeys`
+ * did not make, keys that live in `slot`, or a secret of the wrong length.
  */
-export const quicKeys = (aead: i32, secret: u8[]): QuicKeys | null => {
-  if (!quicPacketSecretFits(aead, secret)) {
+export const quicKeysUpdate = (
+  slot: QuicKeysSlot,
+  keys: QuicKeys,
+  nextSecret: Secret<u8[]>
+): QuicKeys | null => {
+  if (keys === slot.keys || !quicPacketKeysUsable(keys) || !quicPacketHeldFits(keys.aead, nextSecret)) {
     return null
   }
-  const hp: u8[] = quicPacketExpandLabel(aead, secret, "quic hp", quicPacketKeyLength(aead))
-  return quicPacketDerive(aead, secret, hp, aead === QUIC_AEAD_CHACHA20_POLY1305 ? null : aesKey(hp))
+  quicPacketPoint(slot, keys.aead)
+  const next: QuicKeys = slot.keys
+  next.hp.set(keys.hp)
+  const scratch: HkdfScratch = new HkdfScratch()
+  {
+    using _scope = arena()
+    const hpAes: AesKey | null = next.hpAes
+    if (hpAes !== null) {
+      aesKeyInto(next.hp, hpAes)
+    }
+    const plain: u8[] = expose(nextSecret, quicPacketDup)
+    quicPacketDeriveInto(scratch, next, plain)
+    secureZero(plain)
+  }
+  return next
 }
 
 /**
- * The next generation's traffic secret for a key update (RFC 9001 §6.1):
- * HKDF-Expand-Label(`secret`, `quic ku`, "", Hash.length). The
- * header-protection key does not change with it (§6), so the new keys are
- * `quicKeysUpdate` of the old keys and this. Answers `null` where `quicKeys`
- * would.
+ * Zeroes every array `keys` holds: the packet key, the IV and the
+ * header-protection key with `secureZero`, and each AES schedule with
+ * `aesKeyWipe`, whose volatile stores reach the whole of `roundKeys` (the
+ * kernels' powers of H included) and H itself. It zeroes the arrays `keys`
+ * points at now; a slot's arrays of the other lengths are
+ * `QuicKeysSlot.wipe`'s, which zeroes them all.
+ */
+export const quicKeysWipe = (keys: QuicKeys): void => {
+  secureZero(keys.key)
+  secureZero(keys.iv)
+  secureZero(keys.hp)
+  const packetAes: AesKey | null = keys.packetAes
+  if (packetAes !== null) {
+    aesKeyWipe(packetAes)
+  }
+  const hpAes: AesKey | null = keys.hpAes
+  if (hpAes !== null) {
+    aesKeyWipe(hpAes)
+  }
+}
+
+// ---- Keys in a connection slot ----------------------------------------------
+
+/**
+ * The storage one direction of one level's packet keys lives in for a
+ * connection slot (QUIC-3): a key and a header-protection key of each
+ * length, the IV, and an AES key schedule of each size for each, made once,
+ * and the `QuicKeys` that `quicKeysInto` and `quicKeysUpdateInto` point at
+ * the ones the negotiated AEAD uses. So installing a level's keys, or a key
+ * update's, writes into memory the slot already holds and keeps nothing in
+ * the arena. The slot is its owner's to wipe (QUIC-1): `wipe` zeroes all of
+ * it.
+ */
+export class QuicKeysSlot {
+  /** The keys, pointing into the arrays below; `aead` is 0 until something is derived. */
+  keys: QuicKeys
+  key16: u8[]
+  key32: u8[]
+  hp16: u8[]
+  hp32: u8[]
+  packet128: AesKey
+  packet256: AesKey
+  hp128: AesKey
+  hp256: AesKey
+
+  constructor() {
+    this.key16 = new Array<u8>(16)
+    this.key32 = new Array<u8>(32)
+    this.hp16 = new Array<u8>(16)
+    this.hp32 = new Array<u8>(32)
+    this.keys = new QuicKeys(0, this.key16, new Array<u8>(QUIC_IV_SIZE), this.hp16)
+    this.packet128 = new AesKey(10, new Array<u64>(88))
+    this.packet256 = new AesKey(14, new Array<u64>(120))
+    this.hp128 = new AesKey(10, new Array<u64>(88))
+    this.hp256 = new AesKey(14, new Array<u64>(120))
+  }
+
+  /**
+   * Zeroes every key the slot holds: the keys and the IV with `secureZero`,
+   * and each AES schedule with `aesKeyWipe`, whose volatile stores reach the
+   * whole of `roundKeys` (the kernels' powers of H included) and H itself.
+   */
+  wipe(): void {
+    secureZero(this.key16)
+    secureZero(this.key32)
+    secureZero(this.hp16)
+    secureZero(this.hp32)
+    secureZero(this.keys.iv)
+    aesKeyWipe(this.packet128)
+    aesKeyWipe(this.packet256)
+    aesKeyWipe(this.hp128)
+    aesKeyWipe(this.hp256)
+  }
+}
+
+/** Points `slot.keys` at the arrays `aead` needs: the packet key and its schedule, and the header-protection ones. */
+const quicPacketPoint = (slot: QuicKeysSlot, aead: i32): void => {
+  const keys: QuicKeys = slot.keys
+  const wide: boolean = quicPacketKeyLength(aead) === 32
+  keys.aead = aead
+  keys.key = wide ? slot.key32 : slot.key16
+  keys.hp = wide ? slot.hp32 : slot.hp16
+  keys.packetAes = null
+  keys.hpAes = null
+  if (aead !== QUIC_AEAD_CHACHA20_POLY1305) {
+    keys.packetAes = wide ? slot.packet256 : slot.packet128
+    keys.hpAes = wide ? slot.hp256 : slot.hp128
+  }
+}
+
+/**
+ * `quicPacketDerive` in place: the packet key and IV from `secret` into
+ * `keys`' own arrays, and for the AES suites the key's schedule expanded
+ * into its own `AesKey`. HKDF runs in `kdf`, which wipes what it held, and
+ * the expansion's temporaries go with the arena block.
+ */
+const quicPacketDeriveInto = (kdf: HkdfScratch, keys: QuicKeys, secret: u8[]): void => {
+  const aead: i32 = keys.aead
+  const hashLength: i32 = quicPacketSecretLength(aead)
+  using _scope = arena()
+  const none: u8[] = []
+  hkdfExpandLabelInto(kdf, hashLength, secret, "quic key", none, 0, 0, keys.key, 0, quicPacketKeyLength(aead))
+  hkdfExpandLabelInto(kdf, hashLength, secret, "quic iv", none, 0, 0, keys.iv, 0, QUIC_IV_SIZE)
+  const packetAes: AesKey | null = keys.packetAes
+  if (packetAes !== null) {
+    aesKeyInto(keys.key, packetAes)
+  }
+}
+
+/**
+ * `quicKeys` into `slot`: the packet key, IV and header-protection key of
+ * RFC 9001 §5.1 derived from `secret` straight into the slot's arrays, in
+ * `kdf`, with the AES schedules expanded in place. Answers the slot's keys,
+ * or `null`, deriving nothing, where `quicKeys` answers `null`. The keys
+ * are the slot's: the next derivation into it overwrites them.
  */
-export const quicKeyUpdateSecret = (aead: i32, secret: u8[]): u8[] | null => {
+export const quicKeysInto = (
+  kdf: HkdfScratch,
+  slot: QuicKeysSlot,
+  aead: i32,
+  secret: u8[]
+): QuicKeys | null => {
   if (!quicPacketSecretFits(aead, secret)) {
     return null
   }
-  return quicPacketExpandLabel(aead, secret, "quic ku", quicPacketSecretLength(aead))
+  quicPacketPoint(slot, aead)
+  const keys: QuicKeys = slot.keys
+  quicPacketDeriveInto(kdf, keys, secret)
+  {
+    using _scope = arena()
+    const none: u8[] = []
+    hkdfExpandLabelInto(
+      kdf,
+      quicPacketSecretLength(aead),
+      secret,
+      "quic hp",
+      none,
+      0,
+      0,
+      keys.hp,
+      0,
+      quicPacketKeyLength(aead)
+    )
+    const hpAes: AesKey | null = keys.hpAes
+    if (hpAes !== null) {
+      aesKeyInto(keys.hp, hpAes)
+    }
+  }
+  return keys
 }
 
 /**
- * The next generation's keys in a key update (RFC 9001 §6): the packet key
- * and IV derived from `nextSecret`, which `quicKeyUpdateSecret` made from the
- * current secret, and `keys`' header-protection key kept, expanded as it was,
- * since header protection never changes with the phase. Answers `null` for
- * keys `quicKeys` did not make or a secret of the wrong length.
+ * `quicKeysUpdate` into `slot`, which must not be the slot `keys` live in:
+ * the next generation's packet key and IV from `nextSecret`, and `keys`'
+ * header-protection key shared, as every generation shares it (RFC 9001
+ * §6). Answers the slot's keys, or `null` where `quicKeysUpdate` does.
  */
-export const quicKeysUpdate = (keys: QuicKeys, nextSecret: u8[]): QuicKeys | null => {
+export const quicKeysUpdateInto = (
+  kdf: HkdfScratch,
+  slot: QuicKeysSlot,
+  keys: QuicKeys,
+  nextSecret: u8[]
+): QuicKeys | null => {
   if (!quicPacketKeysUsable(keys) || !quicPacketSecretFits(keys.aead, nextSecret)) {
     return null
   }
-  return quicPacketDerive(keys.aead, nextSecret, keys.hp, keys.hpAes)
+  quicPacketPoint(slot, keys.aead)
+  const next: QuicKeys = slot.keys
+  next.hp = keys.hp
+  next.hpAes = keys.hpAes
+  quicPacketDeriveInto(kdf, next, nextSecret)
+  return next
+}
+
+/**
+ * `quicKeyUpdateSecret` into `out`, which must be exactly the secret's
+ * length and not `secret` itself. Answers whether it derived, which it does
+ * where `quicKeyUpdateSecret` answers a secret.
+ */
+export const quicKeyUpdateSecretInto = (kdf: HkdfScratch, aead: i32, secret: u8[], out: u8[]): boolean => {
+  const length: i32 = quicPacketSecretLength(aead)
+  if (!quicPacketSecretFits(aead, secret) || toI32(out.length) !== length) {
+    return false
+  }
+  using _scope = arena()
+  const none: u8[] = []
+  hkdfExpandLabelInto(kdf, length, secret, "quic ku", none, 0, 0, out, 0, length)
+  return true
+}
+
+/**
+ * `quicKeysInto` from a traffic secret held as a `Secret`: the packet key, IV
+ * and header-protection key derived from it straight into the slot's arrays,
+ * the plain output of each derivation wiped, and the AES schedules expanded
+ * in place inside an arena block. Answers the slot's keys, or `null`,
+ * deriving nothing, where `quicKeys` answers `null`.
+ */
+export const quicKeysHeldInto = (slot: QuicKeysSlot, aead: i32, secret: Secret<u8[]>): QuicKeys | null => {
+  if (!quicPacketHeldFits(aead, secret)) {
+    return null
+  }
+  quicPacketPoint(slot, aead)
+  const keys: QuicKeys = slot.keys
+  const hashLength: i32 = quicPacketSecretLength(aead)
+  const keyLength: i32 = quicPacketKeyLength(aead)
+  const none: u8[] = []
+  hkdfExpandLabelHeldInto(hashLength, secret, "quic key", none, keys.key, 0, keyLength)
+  hkdfExpandLabelHeldInto(hashLength, secret, "quic iv", none, keys.iv, 0, QUIC_IV_SIZE)
+  hkdfExpandLabelHeldInto(hashLength, secret, "quic hp", none, keys.hp, 0, keyLength)
+  using _scope = arena()
+  const packetAes: AesKey | null = keys.packetAes
+  if (packetAes !== null) {
+    aesKeyInto(keys.key, packetAes)
+  }
+  const hpAes: AesKey | null = keys.hpAes
+  if (hpAes !== null) {
+    aesKeyInto(keys.hp, hpAes)
+  }
+  return keys
+}
+
+/**
+ * `quicKeyUpdateSecret` from one held secret into another (RFC 9001 §6.1):
+ * HKDF-Expand-Label(`src`, `quic ku`, "", Hash.length) written over `dst`'s
+ * bytes in place, under SHA-384 for a 48-byte secret and SHA-256 for a
+ * 32-byte one. `dst` may be `src`, which ratchets it. Answers whether it
+ * derived: not unless both hold 32 bytes or both 48.
+ */
+export const quicKeyUpdateSecretHeldInto = (dst: Secret<u8[]>, src: Secret<u8[]>): boolean => {
+  const length: i32 = expose(src, quicPacketBytesLength)
+  if ((length !== 32 && length !== 48) || expose(dst, quicPacketBytesLength) !== length) {
+    return false
+  }
+  const none: u8[] = []
+  if (length === 48) {
+    hkdfExpandLabelSha384Held(dst, src, "quic ku", none)
+  } else {
+    hkdfExpandLabelSha256Held(dst, src, "quic ku", none)
+  }
+  return true
+}
+
+/**
+ * `quicInitialSecrets` of the Destination Connection ID `buf[at .. at +
+ * length)`, read in place, into `client` and `server`, 32 bytes each.
+ * Answers whether it derived: not for an ID over 20 bytes, a window outside
+ * `buf`, or an output of another length.
+ */
+export const quicInitialSecretsInto = (
+  kdf: HkdfScratch,
+  buf: u8[],
+  at: i32,
+  length: i32,
+  client: u8[],
+  server: u8[]
+): boolean => {
+  if (
+    length < 0 ||
+    length > QUIC_MAX_CID_LENGTH ||
+    at < 0 ||
+    at > toI32(buf.length) - length ||
+    toI32(client.length) !== 32 ||
+    toI32(server.length) !== 32
+  ) {
+    return false
+  }
+  using _scope = arena()
+  const none: u8[] = []
+  const initial: u8[] = new Array<u8>(32)
+  hkdfExtractInto(kdf, 32, quicPacketInitialSalt(), quicPacketSlice(buf, at, at + length), initial, 0)
+  hkdfExpandLabelInto(kdf, 32, initial, "client in", none, 0, 0, client, 0, 32)
+  hkdfExpandLabelInto(kdf, 32, initial, "server in", none, 0, 0, server, 0, 32)
+  secureZero(initial)
+  return true
 }
 
 /** The bits of the first byte header protection covers: four in a long header, five in a short one (RFC 9001 §5.4.1). */
@@ -1152,12 +1512,17 @@ export const quicSealInPlace = (
   const payloadAt: i32 = start + headerLength
   {
     using _scope = arena()
+    // The nonce is the IV with a public number XORed in, so it gives the IV
+    // away, and the mask is the header-protection key's keystream: both are
+    // wiped once used, before the arena block takes them back.
+    const nonce: u8[] = quicPacketNonce(keys, packetNumber)
     const sealed: u8[] | null = quicPacketSeal(
       keys,
-      quicPacketNonce(keys, packetNumber),
+      nonce,
       quicPacketSlice(buf, start, payloadAt),
       quicPacketSlice(buf, payloadAt, payloadAt + payloadLength)
     )
+    wipe(nonce)
     if (sealed === null || payloadAt + toI32(sealed.length) > toI32(buf.length)) {
       return -1
     }
@@ -1167,15 +1532,22 @@ export const quicSealInPlace = (
       keys,
       quicPacketSlice(buf, sampleAt, sampleAt + QUIC_SAMPLE_SIZE)
     )
-    if (mask === null || toI32(mask.length) < 5) {
+    if (mask === null) {
       return -1
     }
-    buf[start] = toU8(first ^ (toI32(mask[0]) & quicPacketProtectedBits(first)))
-    for (let k: i32 = 0; k < pnLength && k + 1 < toI32(mask.length); k += 1) {
-      if (pnOffset + k >= 0 && pnOffset + k < toI32(buf.length)) {
-        buf[pnOffset + k] = buf[pnOffset + k] ^ mask[k + 1]
+    const masked: boolean = toI32(mask.length) >= 5
+    if (masked) {
+      buf[start] = toU8(first ^ (toI32(mask[0]) & quicPacketProtectedBits(first)))
+      for (let k: i32 = 0; k < pnLength && k + 1 < toI32(mask.length); k += 1) {
+        if (pnOffset + k >= 0 && pnOffset + k < toI32(buf.length)) {
+          buf[pnOffset + k] = buf[pnOffset + k] ^ mask[k + 1]
+        }
       }
     }
+    wipe(mask)
+    if (!masked) {
+      return -1
+    }
   }
   return end
 }
@@ -1263,13 +1635,16 @@ export const quicUnprotectHeader = (
     keys,
     quicPacketSlice(datagram, sampleAt, sampleAt + QUIC_SAMPLE_SIZE)
   )
-  if (mask === null || toI32(mask.length) < 5) {
+  if (mask === null) {
     packet.error = QUIC_ERR_KEYS
     return []
   }
+  const usable: boolean = toI32(mask.length) >= 5
   const protectedFirst: i32 = toI32(datagram[header.start])
   const long: boolean = (protectedFirst & 0x80) !== 0
-  const first: i32 = protectedFirst ^ (toI32(mask[0]) & quicPacketProtectedBits(protectedFirst))
+  const first: i32 = usable
+    ? protectedFirst ^ (toI32(mask[0]) & quicPacketProtectedBits(protectedFirst))
+    : protectedFirst
   const pnLength: i32 = (first & 3) + 1
   // The sample check above put 20 bytes after `pnOffset` inside the packet,
   // so the packet number's at most 4 are there too.
@@ -1284,6 +1659,13 @@ export const quicUnprotectHeader = (
       truncated = (truncated << 8) | toI64(b)
     }
   }
+  // The mask is the header-protection key's keystream: wiped once used, on
+  // the one path every mask takes, so that `-O2` counts this wipe alone.
+  wipe(mask)
+  if (!usable) {
+    packet.error = QUIC_ERR_KEYS
+    return []
+  }
   packet.firstByte = first
   packet.pnLength = pnLength
   packet.packetNumber = quicPacketNumberDecode(largestPn, truncated, pnLength)
@@ -1338,12 +1720,15 @@ export const quicDecryptPayload = (
     return null
   }
   const payloadStart: i32 = header.start + toI32(clear.length)
+  // The nonce gives the IV away (see `quicSealInPlace`): wiped once used.
+  const nonce: u8[] = quicPacketNonce(keys, packet.packetNumber)
   const plain: u8[] | null = quicPacketOpen(
     keys,
-    quicPacketNonce(keys, packet.packetNumber),
+    nonce,
     clear,
     quicPacketSlice(datagram, payloadStart, header.end)
   )
+  wipe(nonce)
   if (plain === null) {
     packet.error = QUIC_ERR_DECRYPT
     return null