lemon-tls 0.9.0 → 0.11.0

package/src/session/ech.js

@@ -280,19 +280,29 @@ function prepare_ech_server_uncached(option) {
 
 // ============================================================
 //  ClientHello bytes (RFC 8446 §4.1.2), without the handshake header
+//
+//  ECH is TLS 1.3's and DTLS 1.3's (RFC 9849 §1). Over DTLS the hello is
+//  DTLS's (RFC 9147 §5.3): a legacy_cookie<0..255> after the session id —
+//  the encoded inner hello (§5.1) and the outer one the AAD is made of
+//  (§5.2) the same. `dtls` says which, everywhere below: read as a TLS one,
+//  every field past the session id was a byte off ("trailing bytes after
+//  ClientHello" for every DTLS hello with ECH).
 // ============================================================
 
 /**
  * The fields of a ClientHello body with their positions — what rebuilding
  * the inner hello and zeroing the outer payload need, and what a parsed
- * message object no longer has.
+ * message object no longer has. `afterSid` is past the session id, `mid`
+ * (cipher_suites onwards) past the cookie too.
  */
-function scan_client_hello(body) {
+function scan_client_hello(body, dtls) {
   var r = new Reader(body);
   r.u16();                                            // legacy_version
   var random = r.bytes(32);
   var sidStart = r.o; var session_id = r.vec8();
   var afterSid = r.o;
+  var cookie = dtls ? r.vec8() : null;                // DTLS legacy_cookie
+  var mid = r.o;
   r.vec16();                                          // cipher_suites
   r.vec8();                                           // legacy_compression_methods
   var extsStart = r.o;
@@ -306,7 +316,7 @@ function scan_client_hello(body) {
       exts.push({ type: type, start: base + at, end: base + er.o, data: data, dataStart: base + at + 4 });
     }
   }
-  return { random: random, session_id: session_id, sidStart: sidStart, afterSid: afterSid, extsStart: extsStart, exts: exts };
+  return { random: random, session_id: session_id, sidStart: sidStart, afterSid: afterSid, cookie: cookie, mid: mid, extsStart: extsStart, exts: exts };
 }
 
 function find_ext(scan, type) {
@@ -347,12 +357,13 @@ function outer_aad(body, ext, ech) {
  * outer extensions it names. In linear time, as §5.1 asks: one forward walk
  * over the outer extensions for the whole reference list.
  */
-function decode_inner(encoded, outerBody, outerScan) {
+function decode_inner(encoded, outerBody, outerScan, dtls) {
   var r = new Reader(encoded);
   r.u16(); r.bytes(32);
   var sidLen = r.u8();
   if (sidLen !== 0) throw eccError('EncodedClientHelloInner session id not empty');
   var afterSid = r.o;
+  if (dtls) r.vec8();                                 // its legacy_cookie, kept as it is
   r.vec16(); r.vec8();
   var extsStart = r.o;
   var extBlock = r.vec16();
@@ -384,7 +395,7 @@ function decode_inner(encoded, outerBody, outerScan) {
   var newExts = concat(parts);
   var sid = outerScan.session_id;
   var head = encoded.subarray(0, afterSid - 1);         // legacy_version + random
-  var mid = encoded.subarray(afterSid, extsStart);      // cipher_suites + compression
+  var mid = encoded.subarray(afterSid, extsStart);      // (DTLS: cookie +) cipher_suites + compression
   var extLen = new Uint8Array(2); put16(extLen, 0, newExts.length);
   return concat([head, new Uint8Array([sid.length]), sid, mid, extLen, newExts]);
 }
@@ -401,20 +412,23 @@ function wrap_client_hello(body) {
  * §7.1: the inner hello must carry the inner ECH extension and offer
  * nothing below TLS 1.3.
  */
-function check_inner(innerBody) {
-  var scan = scan_client_hello(innerBody);
+function check_inner(innerBody, dtls) {
+  var scan = scan_client_hello(innerBody, dtls);
   var e = find_ext(scan, EXT_ECH);
   if (!e || parse_ech_ext(e.data).type !== 1) throw eccError('ClientHelloInner without the inner encrypted_client_hello extension');
   var sv = find_ext(scan, EXT_SUPPORTED_VERSIONS);
-  if (!sv) throw eccError('ClientHelloInner offers TLS 1.2');
+  if (!sv) throw eccError('ClientHelloInner offers ' + (dtls ? 'DTLS' : 'TLS') + ' 1.2');
   var r = new Reader(sv.data), list = r.vec8();
   if (list.length === 0 || list.length % 2) throw eccError('ClientHelloInner supported_versions malformed', ALERT_DECODE_ERROR);
   for (var i = 0; i < list.length; i += 2) {
     var v = u16(list, i);
     // 0x?a?a is GREASE (RFC 8701). TLS 1.3 and up: 0x0304 to 0xfdff — the
-    // 0xfexx codes are DTLS, never a TLS version.
+    // 0xfexx codes are DTLS, never a TLS version. DTLS 1.3 and up, over
+    // DTLS: 0xfefc and down (DTLS versions count downwards), never 1.2
+    // (0xfefd) or 1.0 (0xfeff).
     if ((v & 0x0f0f) === 0x0a0a) continue;
-    if (v < 0x0304 || v >= 0xfe00) throw eccError('ClientHelloInner offers a version other than TLS 1.3 and up (0x' + v.toString(16) + ')');
+    var ok = dtls ? (v >= 0xfe00 && v <= 0xfefc) : (v >= 0x0304 && v < 0xfe00);
+    if (!ok) throw eccError('ClientHelloInner offers a version other than ' + (dtls ? 'DTLS' : 'TLS') + ' 1.3 and up (0x' + v.toString(16) + ')');
   }
   return scan;
 }
@@ -424,6 +438,41 @@ function check_inner(innerBody) {
 //  The server's side (§7.1, §7.1.1)
 // ============================================================
 
+// RFC 8446 §4.1.2: a second ClientHello repeats the first one's random —
+// for ECH the inner one's, over which the confirmation (§7.2) is computed.
+function same_inner_random(state, random) {
+  if (!Buffer.from(random).equals(Buffer.from(state.inner_random))) {
+    throw eccError('second ClientHelloInner changed its random');
+  }
+}
+
+/**
+ * Split mode, the backend's side (§7.2): a server with no ECH keys of its
+ * own. A ClientHello carrying the INNER extension is a ClientHelloInner a
+ * client-facing server decrypted and passed on; the backend confirms ECH
+ * acceptance as a server that decrypted it itself would (§7.2, §7.2.1), so
+ * it takes the same state: status 'accepted', inner_random.
+ * `extensions` is the parsed hello's list ({ type, data }). Only the inner
+ * type is the backend's business; an outer extension, which only a holder of
+ * the keys could open, is left alone. A second ClientHello (after a
+ * HelloRetryRequest) of an accepted one is a ClientHelloInner again (§7.2.1)
+ * with the first one's random (RFC 8446 §4.1.2). Throws an eccError.
+ */
+function backend_client_hello(state, extensions, random, isSecond) {
+  var ext = null;
+  for (var i = 0; i < extensions.length; i++) if (extensions[i] && extensions[i].type === EXT_ECH) { ext = extensions[i]; break; }
+  var data = ext ? (ext.data || new Uint8Array(0)) : null;
+  var inner = !!data && data.length >= 1 && data[0] === 1;
+  if (inner) parse_ech_ext(data);                     // not empty: decode_error
+  if (!isSecond) {
+    if (inner) { state.status = 'accepted'; state.backend = true; state.inner_random = new Uint8Array(random); }
+    return;
+  }
+  if (!state.backend) return;
+  if (!inner) throw eccError('second ClientHello without the inner encrypted_client_hello extension');
+  same_inner_random(state, random);
+}
+
 /**
  * A ClientHello as it arrived (handshake header included) → what the
  * handshake should continue with. `state` is per connection, `{}` at
@@ -435,9 +484,9 @@ function check_inner(innerBody) {
  * `state.status` is 'rejected' and retry_configs are due). Throws, with
  * `.alertDesc`, where §5.1 / §7.1 / §7.1.1 require the connection to end.
  */
-function server_process_client_hello(server, state, data, isSecond) {
+function server_process_client_hello(server, state, data, isSecond, dtls) {
   var body = data.subarray(4);
-  var scan = scan_client_hello(body);
+  var scan = scan_client_hello(body, dtls);
   var ext = find_ext(scan, EXT_ECH);
 
   if (isSecond) {
@@ -450,13 +499,11 @@ function server_process_client_hello(server, state, data, isSecond) {
     }
     var pt2 = state.context.open(outer_aad(body, ext, ech2), ech2.payload);
     if (!pt2) throw eccError('second ClientHelloInner does not decrypt', ALERT_DECRYPT_ERROR);
-    var inner2 = decode_inner(pt2, body, scan);
-    var scan2 = check_inner(inner2);
+    var inner2 = decode_inner(pt2, body, scan, dtls);
+    var scan2 = check_inner(inner2, dtls);
     // RFC 8446 §4.1.2: the second hello repeats the first one's random; the
     // ServerHello's confirmation (§7.2) is computed over it.
-    if (!Buffer.from(scan2.random).equals(Buffer.from(state.inner_random))) {
-      throw eccError('second ClientHelloInner changed its random');
-    }
+    same_inner_random(state, scan2.random);
     return { data: wrap_client_hello(inner2) };
   }
 
@@ -487,8 +534,8 @@ function server_process_client_hello(server, state, data, isSecond) {
     if (!pt) continue;
 
     // Decrypted: from here a malformed inner hello is fatal (§5.1).
-    var inner = decode_inner(pt, body, scan);
-    var innerScan = check_inner(inner);
+    var inner = decode_inner(pt, body, scan, dtls);
+    var innerScan = check_inner(inner, dtls);
     state.status = 'accepted';
     state.context = ctx;
     state.kdf_id = ech.kdf_id; state.aead_id = ech.aead_id; state.config_id = ech.config_id;
@@ -595,9 +642,9 @@ function client_outer_ext_data(kdf_id, aead_id, config_id, enc, payloadLen) {
  * little of the name: the server_name padded to maximum_name_length, and
  * the whole to a multiple of 32.
  */
-function client_encode_inner(innerMsg, compressed, maxNameLength, sniLength) {
+function client_encode_inner(innerMsg, compressed, maxNameLength, sniLength, dtls) {
   var body = innerMsg.subarray(4);
-  var scan = scan_client_hello(body);
+  var scan = scan_client_hello(body, dtls);
   var parts = [], placed = false;
   for (var i = 0; i < scan.exts.length; i++) {
     var e = scan.exts[i];
@@ -615,7 +662,7 @@ function client_encode_inner(innerMsg, compressed, maxNameLength, sniLength) {
   }
   var exts = concat(parts);
   var head = body.subarray(0, scan.sidStart);                  // legacy_version + random
-  var mid = body.subarray(scan.afterSid, scan.extsStart);      // cipher_suites + compression
+  var mid = body.subarray(scan.afterSid, scan.extsStart);      // (DTLS: cookie +) cipher_suites + compression
   var extLen = new Uint8Array(2); put16(extLen, 0, exts.length);
   var encoded = concat([head, new Uint8Array([0]), mid, extLen, exts]);
   var pad = sniLength != null ? Math.max(0, maxNameLength - sniLength) : 9 + maxNameLength;
@@ -623,14 +670,20 @@ function client_encode_inner(innerMsg, compressed, maxNameLength, sniLength) {
   return concat([encoded, new Uint8Array(pad)]);
 }
 
+/** A ClientHello's (a handshake message) encrypted_client_hello extension data, as it went. */
+function client_hello_ech_ext(msg, dtls) {
+  var e = find_ext(scan_client_hello(msg.subarray(4), dtls), EXT_ECH);
+  return e ? new Uint8Array(e.data) : null;
+}
+
 /**
  * ClientHelloOuter (a handshake message, its ECH payload zero) → the same
  * with the payload: `encoded` sealed with AAD = the outer hello itself, as
  * it is now (§5.2).
  */
-function client_seal_outer(outerMsg, hpkeContext, encoded) {
+function client_seal_outer(outerMsg, hpkeContext, encoded, dtls) {
   var body = outerMsg.subarray(4);
-  var scan = scan_client_hello(body);
+  var scan = scan_client_hello(body, dtls);
   var ext = find_ext(scan, EXT_ECH);
   var ech = parse_ech_ext(ext.data);
   var ct = hpkeContext.seal(new Uint8Array(body), encoded);
@@ -644,18 +697,23 @@ function client_seal_outer(outerMsg, hpkeContext, encoded) {
  * §6.2: GREASE ECH — an encrypted_client_hello extension that decrypts
  * under no key, from a client with no config, so that one with a config
  * does not stand out. `g` is fixed per connection (config_id, payload
- * length); after a HelloRetryRequest, `enc` is empty and the payload new
- * random bytes of the same length.
+ * length), and so is the extension: made once, the same bytes every time —
+ * in a second ClientHello too, which "copies the entire
+ * 'encrypted_client_hello' extension from the first ClientHello" (§6.2).
+ * (An empty enc and a fresh payload after a HelloRetryRequest is real ECH's
+ * rule, §6.1.5, which GREASE does not follow; BoGo saw the change.)
  */
 function grease_ech_state() {
   var lens = [144, 176, 208, 240];
-  return { config_id: crypto.randomBytes(1)[0], payload_len: lens[crypto.randomBytes(1)[0] & 3] + 16 };
+  return { config_id: crypto.randomBytes(1)[0], payload_len: lens[crypto.randomBytes(1)[0] & 3] + 16, ext: null };
 }
-function grease_ech_ext_data(g, second) {
-  var enc = second ? new Uint8Array(0) : new Uint8Array(crypto.randomBytes(32));
-  var d = client_outer_ext_data(0x0001, 0x0001, g.config_id, enc, g.payload_len);
-  d.set(crypto.randomBytes(g.payload_len), d.length - g.payload_len);
-  return d;
+function grease_ech_ext_data(g) {
+  if (!g.ext) {
+    var d = client_outer_ext_data(0x0001, 0x0001, g.config_id, new Uint8Array(crypto.randomBytes(32)), g.payload_len);
+    d.set(crypto.randomBytes(g.payload_len), d.length - g.payload_len);
+    g.ext = d;
+  }
+  return g.ext;
 }
 
 /**
@@ -700,6 +758,7 @@ export {
   client_outer_ext_data,
   client_encode_inner,
   client_seal_outer,
+  client_hello_ech_ext,
   grease_ech_state,
   grease_ech_ext_data,
   hrr_ech_offset,
@@ -709,6 +768,7 @@ export {
   generate_ech_key,
   prepare_ech_server,
   server_process_client_hello,
+  backend_client_hello,
   accept_confirmation,
   scan_client_hello,
   parse_ech_ext,

package/src/session/hpke.js

@@ -23,7 +23,7 @@
 
 import crypto from 'node:crypto';
 import { hkdf_extract, hkdf_expand } from '../crypto.js';
-import { x25519_get_public_key, x25519_get_shared_secret } from './ecdh.js';
+import { CURVES } from './ecdh.js';
 
 var MODE_BASE = 0x00, MODE_PSK = 0x01, MODE_AUTH = 0x02, MODE_AUTH_PSK = 0x03;
 
@@ -65,61 +65,29 @@ function labeled_expand(hash, suite_id, prk, label, info, L) {
 //  KEMs: DH groups (RFC 9180 §4.1, §7.1)
 // ============================================================
 
-// The two Montgomery curves, through node:crypto's raw-key DER wrapping.
-var X448_PKCS8 = Buffer.from('3046020100300506032b656f043a0438', 'hex');
-var X448_SPKI  = Buffer.from('3042300506032b656f033900', 'hex');
-
-function x448_public_key(sk) {
-  var priv = crypto.createPrivateKey({ key: Buffer.concat([X448_PKCS8, Buffer.from(sk)]), format: 'der', type: 'pkcs8' });
-  return new Uint8Array(crypto.createPublicKey(priv).export({ type: 'spki', format: 'der' }).subarray(X448_SPKI.length));
-}
-function x448_shared(sk, pk) {
-  var priv = crypto.createPrivateKey({ key: Buffer.concat([X448_PKCS8, Buffer.from(sk)]), format: 'der', type: 'pkcs8' });
-  var pub  = crypto.createPublicKey({ key: Buffer.concat([X448_SPKI, Buffer.from(pk)]), format: 'der', type: 'spki' });
-  var dh = new Uint8Array(crypto.diffieHellman({ privateKey: priv, publicKey: pub }));
-  // RFC 9180 §7.1.4 / RFC 7748 §6.2: an all-zero result means a low-order
-  // public key — the sender would know the "secret". Constant time.
-  var acc = 0;
-  for (var i = 0; i < dh.length; i++) acc |= dh[i];
-  if (acc === 0) throw new Error('HPKE: X448 shared secret is all zero (invalid public key)');
-  return dh;
-}
-
-// The NIST curves: a private key is a scalar below the group order;
-// DeriveKeyPair draws candidates until one is (§7.1.3).
+// The curves are ecdh.js's — TLS's key exchange uses the same ones. The
+// NIST curves' private keys are scalars below the group order, which
+// DeriveKeyPair draws candidates for (§7.1.3).
 function nist(curve, order, bitmask) {
-  return {
-    order: order,
-    bitmask: bitmask,
-    public_key: function (sk) {
-      var e = crypto.createECDH(curve); e.setPrivateKey(Buffer.from(sk));
-      return new Uint8Array(e.getPublicKey(null, 'uncompressed'));
-    },
-    // computeSecret validates the peer point (on the curve, not infinity)
-    // and gives the x-coordinate: the DH value of §7.1.
-    shared: function (sk, pk) {
-      var e = crypto.createECDH(curve); e.setPrivateKey(Buffer.from(sk));
-      return new Uint8Array(e.computeSecret(Buffer.from(pk)));
-    }
-  };
+  return { order: order, bitmask: bitmask, public_key: curve.public_key, shared: curve.shared };
 }
 
 var KEMS = {};
-KEMS[0x0010] = Object.assign(nist('prime256v1',
+KEMS[0x0010] = Object.assign(nist(CURVES.p256,
   hexToBig('ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'), 0xff),
   { id: 0x0010, name: 'DHKEM(P-256, HKDF-SHA256)', hash: 'sha256', Nsecret: 32, Nenc: 65, Npk: 65, Nsk: 32 });
-KEMS[0x0011] = Object.assign(nist('secp384r1',
+KEMS[0x0011] = Object.assign(nist(CURVES.p384,
   hexToBig('ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'), 0xff),
   { id: 0x0011, name: 'DHKEM(P-384, HKDF-SHA384)', hash: 'sha384', Nsecret: 48, Nenc: 97, Npk: 97, Nsk: 48 });
-KEMS[0x0012] = Object.assign(nist('secp521r1',
+KEMS[0x0012] = Object.assign(nist(CURVES.p521,
   hexToBig('01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'), 0x01),
   { id: 0x0012, name: 'DHKEM(P-521, HKDF-SHA512)', hash: 'sha512', Nsecret: 64, Nenc: 133, Npk: 133, Nsk: 66 });
 KEMS[0x0020] = { id: 0x0020, name: 'DHKEM(X25519, HKDF-SHA256)', hash: 'sha256', Nsecret: 32, Nenc: 32, Npk: 32, Nsk: 32,
-  public_key: x25519_get_public_key,
-  shared: x25519_get_shared_secret };       // rejects the all-zero result itself
+  public_key: CURVES.x25519.public_key,
+  shared: CURVES.x25519.shared };           // rejects the all-zero result itself (§7.1.4)
 KEMS[0x0021] = { id: 0x0021, name: 'DHKEM(X448, HKDF-SHA512)', hash: 'sha512', Nsecret: 64, Nenc: 56, Npk: 56, Nsk: 56,
-  public_key: x448_public_key,
-  shared: x448_shared };
+  public_key: CURVES.x448.public_key,
+  shared: CURVES.x448.shared };
 
 function kem_suite_id(kem) { return concat(u8('KEM'), i2osp(kem.id, 2)); }
 

package/src/session/message.js

@@ -93,12 +93,24 @@ function normalize_hello(hello, kind) {
     }
   }
 
+  // The versions on offer (RFC 8446 §4.2.1). With a supported_versions
+  // extension, that list is the whole offer: legacy_version "MUST" then be
+  // ignored. It was added to the list — a hello offering only SSL 3.0 there
+  // came out as TLS 1.2, from its legacy 0x0303.
+  // Without the extension, TLS 1.2's rules (RFC 5246 Appendix E.1): the
+  // legacy_version is the client's highest, so any value from TLS 1.2 up —
+  // 0x0304, 0x0305, a future (6,3) — offers TLS 1.2, and nothing that
+  // §4.2.1 lets a server negotiate as 1.3 ("MUST negotiate TLS 1.2 or prior
+  // ... even if ClientHello.legacy_version is 0x0304 or later"). They were
+  // refused (protocol_version), or read as TLS 1.3. DTLS counts down:
+  // 0xfefd is 1.2, and anything newer than it offers 1.2 too.
   if (!('supported_versions' in out)) {
-    out.supported_versions = [];
-  }
-
-  if (out.supported_versions.indexOf(out.version) < 0) {
-    out.supported_versions.push(out.version);
+    let v = out.version;
+    if (kind === 'client' && typeof v === 'number') {
+      if (out.dtls) { if (v <= 0xfefd) v = 0xfefd; }
+      else if (v >= 0x0303) v = 0x0303;
+    }
+    out.supported_versions = (typeof v === 'number') ? [v] : [];
   }
 
   return out;
@@ -178,13 +190,15 @@ function build_tls_message(params) {
  * @param {number}     [negotiatedVersion] — optional; 0x0303 for TLS 1.2, 0x0304 for TLS 1.3.
  *                                           Needed to disambiguate NewSessionTicket wire format.
  */
-function parse_tls_message(data, negotiatedVersion) {
+// opts.dtls: whether the transport is DTLS (the session knows; a hello's
+// version does not say it reliably).
+function parse_tls_message(data, negotiatedVersion, opts) {
   let out = {};
   let message = wire.parse_message(data);
 
   if (message.type == wire.TLS_MESSAGE_TYPE.CLIENT_HELLO || message.type == wire.TLS_MESSAGE_TYPE.SERVER_HELLO) {
     let kind = (message.type == wire.TLS_MESSAGE_TYPE.CLIENT_HELLO) ? 'client' : 'server';
-    let hello = wire.parse_hello({ kind: kind, body: message.body });
+    let hello = wire.parse_hello({ kind: kind, body: message.body, dtls: opts ? opts.dtls : undefined, lenient: !!(opts && opts.lenient) });
     out = normalize_hello(hello, kind);
 
   } else if (message.type == wire.TLS_MESSAGE_TYPE.SERVER_KEY_EXCHANGE) {
@@ -192,6 +206,12 @@ function parse_tls_message(data, negotiatedVersion) {
     out.type = 'server_key_exchange';
 
   } else if (message.type == wire.TLS_MESSAGE_TYPE.CLIENT_KEY_EXCHANGE) {
+    // ECDHE (RFC 8422 §5.7): ClientECDiffieHellmanPublic, the point as
+    // opaque <1..2^8-1>. Its length byte was skipped, never read: a wrong
+    // one was taken — decode_error.
+    if (message.body.length < 2 || message.body[0] !== message.body.length - 1) {
+      throw wire.parseError('ClientKeyExchange: point length ' + (message.body.length ? message.body[0] : 'missing') + ' for ' + Math.max(0, message.body.length - 1) + ' bytes');
+    }
     out.body = message.body;
     out.public_key = message.body.slice(1);
     out.type = 'client_key_exchange';
@@ -207,7 +227,7 @@ function parse_tls_message(data, negotiatedVersion) {
     out.type = 'encrypted_extensions';
 
   } else if (message.type == wire.TLS_MESSAGE_TYPE.CERTIFICATE) {
-    out = wire.parse_certificate(message.body);
+    out = wire.parse_certificate(message.body, wire.is_tls13_wire(negotiatedVersion));
     out.type = 'certificate';
 
   } else if (message.type == wire.TLS_MESSAGE_TYPE.COMPRESSED_CERTIFICATE) {
@@ -241,7 +261,7 @@ function parse_tls_message(data, negotiatedVersion) {
     // 1.2 does. Testing only for 0x0303 sent a DTLS 1.2 ticket through the
     // TLS 1.3 parser — the same class of bug as the Certificate encoding one:
     // a version comparison that does not know DTLS exists.
-    if (negotiatedVersion === 0x0303 || negotiatedVersion === 0xFEFD) {
+    if (wire.is_tls12_wire(negotiatedVersion)) {
       out = wire.parse_new_session_ticket_tls12(message.body);
     } else {
       out = wire.parse_new_session_ticket(message.body);

package/src/session/signing.js

@@ -4,6 +4,7 @@
  */
 
 import * as crypto from 'crypto';
+import { parse_cert } from './x509.js';
 
 let TLS_VERSION_TLS1_2 = 0x0303;
 let TLS_VERSION_TLS1_3 = 0x0304;
@@ -34,6 +35,11 @@ const SIG_SCHEMES_MODERN = [
   0x0807, 0x0808,           // ed25519, ed448
   0x0403, 0x0503, 0x0603,   // ecdsa_secp256r1/384r1/521r1
   0x0804, 0x0805, 0x0806,   // rsa_pss_rsae_sha256/384/512
+  // rsa_pss_pss_sha256/384/512: an RSASSA-PSS key (id-RSASSA-PSS) signs with
+  // these only. Verified all along, never offered — so a client certificate
+  // of that kind, held now to what the CertificateRequest offers, could not
+  // be used at all.
+  0x0809, 0x080a, 0x080b,
 ];
 
 // ML-DSA (FIPS 204), post-quantum signatures, TLS 1.3 only
@@ -61,22 +67,22 @@ const SIG_SCHEMES_LEGACY_PKCS1 = [
   0x0401, 0x0501, 0x0601,   // rsa_pkcs1_sha256/384/512
 ];
 
-/**
- * SHA-1 schemes. Deliberately last, and deliberately still offered.
+/*
+ * SHA-1 (rsa_pkcs1_sha1 0x0201, ecdsa_sha1 0x0203) is neither offered nor
+ * used, at any version (RFC 9155): not in a ClientHello or CertificateRequest
+ * — "MUST NOT include" —, not signed with, and a peer's handshake signature
+ * under it is refused (scheme_info knows no SHA-1 scheme). It was offered
+ * last, and used whenever a TLS 1.2 peer asked for it first or offered
+ * nothing else: a server signed its ServerKeyExchange with SHA-1 for any
+ * client that wanted that (internet.nl: "insufficiently secure hash
+ * functions for key exchange"; NCSC-NL 2025-05 §3.3.5).
  *
- * Same offer/use split as the PKCS#1 set above, taken one step further: SHA-1
- * is unacceptable for a handshake signature, and scheme_info already refuses
- * these at TLS 1.3 so they can never be selected for CertificateVerify. But
- * signature_algorithms also describes the signatures we can verify ON
- * CERTIFICATES (RFC 8446 §4.2.3), and SHA-1-signed intermediates still exist
- * in real chains. Withholding them from the offer tells a peer we cannot
- * verify such a chain at all, which is a different — and wrong — statement
- * from "we will not sign with SHA-1".
+ * It had been kept in the offer for certificates — signature_algorithms also
+ * names what we verify on a chain (RFC 8446 §4.2.3). That reason is gone:
+ * a certificate below the anchor signed with SHA-1 is refused
+ * (session/x509.js, CA_MD_TOO_WEAK, as node:tls refuses it), and an anchor's
+ * own signature is never checked.
  */
-const SIG_SCHEMES_LEGACY_SHA1 = [
-  0x0201,   // rsa_pkcs1_sha1
-  0x0203,   // ecdsa_sha1
-];
 
 /**
  * Default offer list — the same for every version range, deliberately taking
@@ -95,8 +101,7 @@ const SIG_SCHEMES_LEGACY_SHA1 = [
 function default_signature_schemes() {
   return SIG_SCHEMES_MODERN
     .concat(SIG_SCHEMES_MLDSA)
-    .concat(SIG_SCHEMES_LEGACY_PKCS1)
-    .concat(SIG_SCHEMES_LEGACY_SHA1);
+    .concat(SIG_SCHEMES_LEGACY_PKCS1);
 }
 
 
@@ -146,12 +151,10 @@ function scheme_info(version, scheme) {
   // (RFC 8446 §4.4.3); TLS 1.2 still uses them.
   if (version === TLS_VERSION_TLS1_3) return null;
 
-  // TLS 1.2: classic (hash, sig) interpretation
-  if (h === 0x02 && s === 0x01) return { hash: 'sha1',   sig: 'rsa',   isPSS: false };
+  // TLS 1.2: classic (hash, sig) interpretation. No SHA-1 (RFC 9155).
   if (h === 0x04 && s === 0x01) return { hash: 'sha256', sig: 'rsa',   isPSS: false };
   if (h === 0x05 && s === 0x01) return { hash: 'sha384', sig: 'rsa',   isPSS: false };
   if (h === 0x06 && s === 0x01) return { hash: 'sha512', sig: 'rsa',   isPSS: false };
-  if (h === 0x02 && s === 0x03) return { hash: 'sha1',   sig: 'ecdsa', isPSS: false };
 
   return null;
 }
@@ -259,6 +262,18 @@ function scheme_matches_key(version, scheme, keyObj) {
   let kt = keyObj.asymmetricKeyType;
 
   if (info.sig === 'rsa') {
+    // The key large enough for the scheme: PSS with a salt of the hash's
+    // length needs a modulus of 2·hLen + 2 bytes (RFC 8017 §9.1.1), PKCS#1
+    // v1.5 the DigestInfo plus 11. A 1024-bit key under rsa_pss_*_sha512 made
+    // node:crypto throw out of the handshake — the process with it — for a
+    // client that offered only that.
+    let bits = 0;
+    try { bits = (keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.modulusLength) || 0; } catch (e) { bits = 0; }
+    if (bits > 0) {
+      let hLen = info.hash === 'sha512' ? 64 : info.hash === 'sha384' ? 48 : info.hash === 'sha256' ? 32 : 20;
+      let need = info.isPSS ? 2 * hLen + 2 : hLen + 19 + 11;
+      if (Math.ceil(bits / 8) < need) return false;
+    }
     if (info.isPSS) {
       // 0x0809-0x080b are the *_pss_pss_* family; 0x0804-0x0806 are *_pss_rsae_*.
       let wantsPssKey = (scheme === 0x0809 || scheme === 0x080a || scheme === 0x080b);
@@ -270,8 +285,13 @@ function scheme_matches_key(version, scheme, keyObj) {
 
   if (info.sig === 'ecdsa') {
     if (kt !== 'ec') return false;
-    // The curve is part of the scheme, not a free choice: signing P-256 data
-    // with a P-384 key (or vice versa) is a type confusion the RFC forbids.
+    // The curve is part of the scheme in TLS 1.3 (RFC 8446 §4.2.3: "ecdsa_
+    // secp384r1_sha384" is P-384 with SHA-384): signing with a P-256 key under
+    // it is a confusion the RFC forbids. In TLS 1.2 the same codepoint is
+    // only {sha384, ecdsa} (RFC 5246 §7.4.1.4.1), for a key of any curve: a
+    // P-256 server asked only for sha384 had no scheme, and sent its
+    // ServerKeyExchange unsigned.
+    if (version !== TLS_VERSION_TLS1_3) return true;
     let curve = null;
     try {
       curve = keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.namedCurve;
@@ -360,15 +380,53 @@ const SCHEME_NAMES = {
 };
 function scheme_name(scheme) { return SCHEME_NAMES[scheme] || null; }
 
+/**
+ * Whether a certificate lets its key sign (RFC 5280 §4.2.1.3): without a
+ * keyUsage extension, yes; with one, only if digitalSignature (bit 0) is set.
+ * Every TLS 1.3 certificate signs its CertificateVerify, and under TLS 1.2
+ * every suite we offer is (EC)DHE, where the key signs the
+ * ServerKeyExchange or the client's CertificateVerify — static RSA, the one
+ * use of keyEncipherment, is not offered. So a certificate whose keyUsage
+ * says otherwise cannot be the one that authenticates this handshake.
+ *
+ * The certificate is read by cryptographic-formats (session/x509.js's parse_cert,
+ * once per DER object — the chain check reads the same one). Unreadable:
+ * null (the chain check owns that failure). An all-zero keyUsage does not
+ * read either — cryptographic-formats refuses it, as OpenSSL marks such a
+ * certificate invalid.
+ */
+function cert_allows_signing(der) {
+  let cert = parse_cert(der instanceof Uint8Array ? der : new Uint8Array(der));
+  if (!cert) return null;
+  return cert.ku ? cert.ku.digitalSignature : true;
+}
+
+/**
+ * The TLS 1.2 named group of an ECDSA key, or null for any other key
+ * (RFC 8422 §5.1.1: a client's supported_groups also names the curves it
+ * accepts in an ECDSA certificate). TLS 1.3 binds the curve in the scheme
+ * instead (scheme_matches_key).
+ */
+function ec_key_group(keyObj) {
+  let curve = null;
+  try {
+    if (keyObj.asymmetricKeyType !== 'ec') return null;
+    curve = keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.namedCurve;
+  } catch (e) { return null; }
+  return curve === 'prime256v1' ? 23 : curve === 'secp384r1' ? 24 : curve === 'secp521r1' ? 25 : -1;
+}
+
 export {
+  scheme_matches_key,
   scheme_name,
+  cert_allows_signing,
+  ec_key_group,
   scheme_info,
   pick_scheme,
   sign_with_scheme,
   verify_with_scheme,
   SIG_SCHEMES_MODERN,
   SIG_SCHEMES_LEGACY_PKCS1,
-  SIG_SCHEMES_LEGACY_SHA1,
   SIG_SCHEMES_MLDSA,
   MLDSA_AVAILABLE,
   default_signature_schemes

package/src/session/ticket.js

@@ -109,11 +109,13 @@ function decrypt_session_blob(blob, ticketKeys) {
  * User is responsible for secure storage (this contains the master_secret).
  *
  * @param {Object} state
- * @returns {Uint8Array} — utf-8 encoded JSON
+ * @returns {Buffer} — utf-8 encoded JSON. A Buffer, as node:tls's 'session'
+ *   gives (and what the socket's getSession() returned already): it was
+ *   copied into a plain Uint8Array, so 'session' handed out one type and
+ *   getSession() another.
  */
 function encode_client_session(state) {
-    let serialized = JSON.stringify(serialize_state(state));
-    return new Uint8Array(Buffer.from(serialized, 'utf8'));
+    return Buffer.from(JSON.stringify(serialize_state(state)), 'utf8');
 }
 
 /**