Uprev NSS to 3.23 on iOS

net/third_party/nss/ssl/tls13con.c

+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/*
+ * TLS 1.3 Protocol
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "stdarg.h"
+#include "cert.h"
+#include "ssl.h"
+#include "keyhi.h"
+#include "pk11func.h"
+#include "secitem.h"
+#include "sslimpl.h"
+#include "sslproto.h"
+#include "sslerr.h"
+#include "tls13hkdf.h"
+#include "tls13con.h"
+
+typedef enum {
+    TrafficKeyEarlyData,
+    TrafficKeyHandshake,
+    TrafficKeyApplicationData
+} TrafficKeyType;
+
+typedef enum {
+    InstallCipherSpecRead,
+    InstallCipherSpecWrite,
+    InstallCipherSpecBoth
+} InstallCipherSpecDirection;
+
+#define MAX_FINISHED_SIZE 64
+
+static SECStatus tls13_InitializeHandshakeEncryption(sslSocket *ss);
+static SECStatus tls13_InstallCipherSpec(
+    sslSocket *ss, InstallCipherSpecDirection direction);
+static SECStatus tls13_InitCipherSpec(
+    sslSocket *ss, TrafficKeyType type, InstallCipherSpecDirection install);
+static SECStatus tls13_AESGCM(
+    ssl3KeyMaterial *keys,
+    PRBool doDecrypt,
+    unsigned char *out, int *outlen, int maxout,
+    const unsigned char *in, int inlen,
+    const unsigned char *additionalData, int additionalDataLen);
+static SECStatus tls13_SendEncryptedExtensions(sslSocket *ss);
+static SECStatus tls13_HandleEncryptedExtensions(sslSocket *ss, SSL3Opaque *b,
+                                                 PRUint32 length);
+static SECStatus tls13_HandleCertificate(
+    sslSocket *ss, SSL3Opaque *b, PRUint32 length);
+static SECStatus tls13_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b,
+                                                PRUint32 length);
+static SECStatus tls13_HandleCertificateStatus(sslSocket *ss, SSL3Opaque *b,
+                                               PRUint32 length);
+static SECStatus tls13_HandleCertificateVerify(
+    sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+    SSL3Hashes *hashes);
+static SECStatus tls13_HkdfExtractSharedKey(sslSocket *ss, PK11SymKey *key,
+                                            SharedSecretType keyType);
+static SECStatus tls13_SendFinished(sslSocket *ss);
+static SECStatus tls13_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+                                      const SSL3Hashes *hashes);
+static SECStatus tls13_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b,
+                                              PRUint32 length);
+static SECStatus tls13_ComputeSecrets1(sslSocket *ss);
+static SECStatus tls13_ComputeFinished(
+    sslSocket *ss, const SSL3Hashes *hashes,
+    PRBool sending,
+    PRUint8 *output, unsigned int *outputLen,
+    unsigned int maxOutputLen);
+static SECStatus tls13_SendClientSecondRound(sslSocket *ss);
+static SECStatus tls13_FinishHandshake(sslSocket *ss);
+
+const char kHkdfLabelExpandedSs[] = "expanded static secret";
+const char kHkdfLabelExpandedEs[] = "expanded ephemeral secret";
+const char kHkdfLabelMasterSecret[] = "master secret";
+const char kHkdfLabelTrafficSecret[] = "traffic secret";
+const char kHkdfLabelClientFinishedSecret[] = "client finished";
+const char kHkdfLabelServerFinishedSecret[] = "server finished";
+const char kHkdfLabelResumptionMasterSecret[] = "resumption master secret";
+const char kHkdfLabelExporterMasterSecret[] = "exporter master secret";
+const char kHkdfPhaseEarlyHandshakeDataKeys[] = "early handshake key expansion";
+const char kHkdfPhaseEarlyApplicationDataKeys[] = "early application data key expansion";
+const char kHkdfPhaseHandshakeKeys[] = "handshake key expansion";
+const char kHkdfPhaseApplicationDataKeys[] = "application data key expansion";
+const char kHkdfPurposeClientWriteKey[] = "client write key";
+const char kHkdfPurposeServerWriteKey[] = "server write key";
+const char kHkdfPurposeClientWriteIv[] = "client write iv";
+const char kHkdfPurposeServerWriteIv[] = "server write iv";
+const char kClientFinishedLabel[] = "client finished";
+const char kServerFinishedLabel[] = "server finished";
+
+const SSL3ProtocolVersion kRecordVersion = 0x0301U;
+
+#define FATAL_ERROR(ss, prError, desc)                                             \
+    do {                                                                           \
+        SSL_TRC(3, ("%d: TLS13[%d]: fatal error %d in %s (%s:%d)",                 \
+                    SSL_GETPID(), ss->fd, prError, __func__, __FILE__, __LINE__)); \
+        tls13_FatalError(ss, prError, desc);                                       \
+    } while (0)
+
+#define UNIMPLEMENTED()                                                   \
+    do {                                                                  \
+        SSL_TRC(3, ("%d: TLS13[%d]: unimplemented feature in %s (%s:%d)", \
+                    SSL_GETPID(), ss->fd, __func__, __FILE__, __LINE__)); \
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);                         \
+        PORT_Assert(0);                                                   \
+        return SECFailure;                                                \
+    } while (0)
+
+void
+tls13_FatalError(sslSocket *ss, PRErrorCode prError, SSL3AlertDescription desc)
+{
+    PORT_Assert(desc != internal_error); /* These should never happen */
+    (void)SSL3_SendAlert(ss, alert_fatal, desc);
+    PORT_SetError(prError);
+}
+
+#ifdef TRACE
+#define STATE_CASE(a) \
+    case a:           \
+        return #a
+static char *
+tls13_HandshakeState(SSL3WaitState st)
+{
+    switch (st) {
+        STATE_CASE(wait_client_hello);
+        STATE_CASE(wait_client_cert);
+        STATE_CASE(wait_cert_verify);
+        STATE_CASE(wait_finished);
+        STATE_CASE(wait_server_hello);
+        STATE_CASE(wait_certificate_status);
+        STATE_CASE(wait_server_cert);
+        STATE_CASE(wait_cert_request);
+        STATE_CASE(wait_encrypted_extensions);
+        STATE_CASE(idle_handshake);
+        default:
+            break;
+    }
+    PORT_Assert(0);
+    return "unknown";
+}
+#endif
+
+#define TLS13_WAIT_STATE_MASK 0x80
+
+#define TLS13_BASE_WAIT_STATE(ws) (ws & ~TLS13_WAIT_STATE_MASK)
+/* We don't mask idle_handshake because other parts of the code use it*/
+#define TLS13_WAIT_STATE(ws) (ws == idle_handshake ? ws : ws | TLS13_WAIT_STATE_MASK)
+#define TLS13_CHECK_HS_STATE(ss, err, ...)                          \
+    tls13_CheckHsState(ss, err, #err, __func__, __FILE__, __LINE__, \
+                       __VA_ARGS__,                                 \
+                       wait_invalid)
+void
+tls13_SetHsState(sslSocket *ss, SSL3WaitState ws,
+                 const char *func, const char *file, int line)
+{
+#ifdef TRACE
+    const char *new_state_name =
+        tls13_HandshakeState(ws);
+
+    SSL_TRC(3, ("%d: TLS13[%d]: state change from %s->%s in %s (%s:%d)",
+                SSL_GETPID(), ss->fd,
+                tls13_HandshakeState(TLS13_BASE_WAIT_STATE(ss->ssl3.hs.ws)),
+                new_state_name,
+                func, file, line));
+#endif
+
+    ss->ssl3.hs.ws = TLS13_WAIT_STATE(ws);
+}
+
+static PRBool
+tls13_InHsStateV(sslSocket *ss, va_list ap)
+{
+    SSL3WaitState ws;
+
+    while ((ws = va_arg(ap, SSL3WaitState)) != wait_invalid) {
+        if (ws == TLS13_BASE_WAIT_STATE(ss->ssl3.hs.ws)) {
+            return PR_TRUE;
+        }
+    }
+    return PR_FALSE;
+}
+
+PRBool
+tls13_InHsState(sslSocket *ss, ...)
+{
+    PRBool found;
+    va_list ap;
+
+    va_start(ap, ss);
+    found = tls13_InHsStateV(ss, ap);
+    va_end(ap);
+
+    return found;
+}
+
+static SECStatus
+tls13_CheckHsState(sslSocket *ss, int err, const char *error_name,
+                   const char *func, const char *file, int line,
+                   ...)
+{
+    va_list ap;
+    va_start(ap, line);
+    if (tls13_InHsStateV(ss, ap)) {
+        va_end(ap);
+        return SECSuccess;
+    }
+    va_end(ap);
+
+    SSL_TRC(3, ("%d: TLS13[%d]: error %s state is (%s) at %s (%s:%d)",
+                SSL_GETPID(), ss->fd,
+                error_name,
+                tls13_HandshakeState(TLS13_BASE_WAIT_STATE(ss->ssl3.hs.ws)),
+                func, file, line));
+    tls13_FatalError(ss, err, unexpected_message);
+    return SECFailure;
+}
+
+SSLHashType
+tls13_GetHash(sslSocket *ss)
+{
+    /* TODO(ekr@rtfm.com): This needs to actually be looked up. */
+    return ssl_hash_sha256;
+}
+
+CK_MECHANISM_TYPE
+tls13_GetHkdfMechanism(sslSocket *ss)
+{
+    /* TODO(ekr@rtfm.com): This needs to actually be looked up. */
+    return CKM_NSS_HKDF_SHA256;
+}
+
+static CK_MECHANISM_TYPE
+tls13_GetHmacMechanism(sslSocket *ss)
+{
+    /* TODO(ekr@rtfm.com): This needs to actually be looked up. */
+    return CKM_SHA256_HMAC;
+}
+
+/*
+ * Called from ssl3_SendClientHello
+ */
+SECStatus
+tls13_SetupClientHello(sslSocket *ss)
+{
+    SECStatus rv;
+    /* TODO(ekr@rtfm.com): Handle multiple curves here. */
+    ECName curves_to_try[] = { ec_secp256r1 };
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
+
+    PORT_Assert(!ss->ephemeralECDHKeyPair);
+
+    rv = ssl3_CreateECDHEphemeralKeyPair(curves_to_try[0],
+                                         &ss->ephemeralECDHKeyPair);
+    if (rv != SECSuccess)
+        return rv;
+
+    return SECSuccess;
+}
+
+static SECStatus
+tls13_HandleECDHEKeyShare(sslSocket *ss,
+                          TLS13KeyShareEntry *entry,
+                          SECKEYPrivateKey *privKey,
+                          SharedSecretType type)
+{
+    SECStatus rv;
+    SECKEYPublicKey *peerKey;
+    PK11SymKey *shared;
+
+    peerKey = tls13_ImportECDHKeyShare(ss, entry->key_exchange.data,
+                                       entry->key_exchange.len,
+                                       entry->group);
+    if (!peerKey)
+        return SECFailure; /* Error code set already. */
+
+    /* Compute shared key. */
+    shared = tls13_ComputeECDHSharedKey(ss, privKey, peerKey);
+    SECKEY_DestroyPublicKey(peerKey);
+    if (!shared) {
+        return SECFailure; /* Error code set already. */
+    }
+
+    /* Extract key. */
+    rv = tls13_HkdfExtractSharedKey(ss, shared, type);
+    PK11_FreeSymKey(shared);
+
+    return rv;
+}
+
+SECStatus
+tls13_HandlePostHelloHandshakeMessage(sslSocket *ss, SSL3Opaque *b,
+                                      PRUint32 length, SSL3Hashes *hashesPtr)
+{
+    /* TODO(ekr@rtfm.com): Would it be better to check all the states here? */
+    switch (ss->ssl3.hs.msg_type) {
+        case certificate:
+            return tls13_HandleCertificate(ss, b, length);
+
+        case certificate_status:
+            return tls13_HandleCertificateStatus(ss, b, length);
+
+        case certificate_request:
+            return tls13_HandleCertificateRequest(ss, b, length);
+
+        case certificate_verify:
+            return tls13_HandleCertificateVerify(ss, b, length, hashesPtr);
+
+        case encrypted_extensions:
+            return tls13_HandleEncryptedExtensions(ss, b, length);
+
+        case new_session_ticket:
+            return tls13_HandleNewSessionTicket(ss, b, length);
+
+        case finished:
+            return tls13_HandleFinished(ss, b, length, hashesPtr);
+
+        default:
+            FATAL_ERROR(ss, SSL_ERROR_RX_UNKNOWN_HANDSHAKE, unexpected_message);
+            return SECFailure;
+    }
+
+    PORT_Assert(0); /* Unreached */
+    return SECFailure;
+}
+
+/* Called from ssl3_HandleClientHello.
+ *
+ * Caller must hold Handshake and RecvBuf locks.
+ */
+SECStatus
+tls13_HandleClientKeyShare(sslSocket *ss)
+{
+    ECName expectedGroup;
+    SECStatus rv;
+    TLS13KeyShareEntry *found = NULL;
+    PRCList *cur_p;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle client_key_share handshake",
+                SSL_GETPID(), ss->fd));
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    rv = ssl3_SetupPendingCipherSpec(ss);
+    if (rv != SECSuccess)
+        return SECFailure; /* Error code set below */
+
+    /* Figure out what group we expect */
+    switch (ss->ssl3.hs.kea_def->exchKeyType) {
+#ifndef NSS_DISABLE_ECC
+        case ssl_kea_ecdh:
+            expectedGroup = ssl3_GetCurveNameForServerSocket(ss);
+            if (!expectedGroup) {
+                FATAL_ERROR(ss, SSL_ERROR_NO_CYPHER_OVERLAP,
+                            handshake_failure);
+                return SECFailure;
+            }
+            break;
+#endif
+        default:
+            /* Got an unknown or unsupported Key Exchange Algorithm.
+             * Can't happen. */
+            FATAL_ERROR(ss, SEC_ERROR_UNSUPPORTED_KEYALG,
+                        internal_error);
+            return SECFailure;
+    }
+
+    /* Now walk through the keys until we find one for our group */
+    cur_p = PR_NEXT_LINK(&ss->ssl3.hs.remoteKeyShares);
+    while (cur_p != &ss->ssl3.hs.remoteKeyShares) {
+        TLS13KeyShareEntry *offer = (TLS13KeyShareEntry *)cur_p;
+
+        if (offer->group == expectedGroup) {
+            found = offer;
+            break;
+        }
+        cur_p = PR_NEXT_LINK(cur_p);
+    }
+
+    if (!found) {
+        /* No acceptable group. In future, we will need to correct the client.
+         * Currently just generate an error.
+         * TODO(ekr@rtfm.com): Write code to correct client.
+         */
+        FATAL_ERROR(ss, SSL_ERROR_NO_CYPHER_OVERLAP, handshake_failure);
+        return SECFailure;
+    }
+
+    /* Generate our key */
+    rv = ssl3_CreateECDHEphemeralKeyPair(expectedGroup, &ss->ephemeralECDHKeyPair);
+    if (rv != SECSuccess)
+        return rv;
+
+    ss->sec.keaType = ss->ssl3.hs.kea_def->exchKeyType;
+    ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(
+        ss->ephemeralECDHKeyPair->pubKey);
+
+    /* Register the sender */
+    rv = ssl3_RegisterServerHelloExtensionSender(ss, ssl_tls13_key_share_xtn,
+                                                 tls13_ServerSendKeyShareXtn);
+    if (rv != SECSuccess)
+        return SECFailure; /* Error code set below */
+
+    rv = tls13_HandleECDHEKeyShare(ss, found,
+                                   ss->ephemeralECDHKeyPair->privKey,
+                                   EphemeralSharedSecret);
+    if (rv != SECSuccess)
+        return SECFailure; /* Error code set below */
+
+    return SECSuccess;
+}
+
+/*
+ *     [draft-ietf-tls-tls13-11] Section 6.3.3.2
+ *
+ *     opaque DistinguishedName<1..2^16-1>;
+ *
+ *     struct {
+ *         opaque certificate_extension_oid<1..2^8-1>;
+ *         opaque certificate_extension_values<0..2^16-1>;
+ *     } CertificateExtension;
+ *
+ *     struct {
+ *         opaque certificate_request_context<0..2^8-1>;
+ *         SignatureAndHashAlgorithm
+ *           supported_signature_algorithms<2..2^16-2>;
+ *         DistinguishedName certificate_authorities<0..2^16-1>;
+ *         CertificateExtension certificate_extensions<0..2^16-1>;
+ *     } CertificateRequest;
+ */
+static SECStatus
+tls13_SendCertificateRequest(sslSocket *ss)
+{
+    SECStatus rv;
+    int calen;
+    SECItem *names;
+    int nnames;
+    SECItem *name;
+    int i;
+    PRUint8 sigAlgs[MAX_SIGNATURE_ALGORITHMS * 2];
+    unsigned int sigAlgsLength = 0;
+    int length;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: begin send certificate_request",
+                SSL_GETPID(), ss->fd));
+
+    /* Fixed context value. */
+    ss->ssl3.hs.certReqContext[0] = 0;
+    ss->ssl3.hs.certReqContextLen = 1;
+
+    rv = ssl3_EncodeCertificateRequestSigAlgs(ss, sigAlgs, sizeof(sigAlgs),
+                                              &sigAlgsLength);
+    if (rv != SECSuccess) {
+        return rv;
+    }
+
+    ssl3_GetCertificateRequestCAs(ss, &calen, &names, &nnames);
+    length = 1 + ss->ssl3.hs.certReqContextLen +
+             2 + sigAlgsLength + 2 + calen + 2;
+
+    rv = ssl3_AppendHandshakeHeader(ss, certificate_request, length);
+    if (rv != SECSuccess) {
+        return rv; /* err set by AppendHandshake. */
+    }
+    rv = ssl3_AppendHandshakeVariable(ss, ss->ssl3.hs.certReqContext,
+                                      ss->ssl3.hs.certReqContextLen, 1);
+    if (rv != SECSuccess) {
+        return rv; /* err set by AppendHandshake. */
+    }
+    rv = ssl3_AppendHandshakeVariable(ss, sigAlgs, sigAlgsLength, 2);
+    if (rv != SECSuccess) {
+        return rv; /* err set by AppendHandshake. */
+    }
+    rv = ssl3_AppendHandshakeNumber(ss, calen, 2);
+    if (rv != SECSuccess) {
+        return rv; /* err set by AppendHandshake. */
+    }
+    for (i = 0, name = names; i < nnames; i++, name++) {
+        rv = ssl3_AppendHandshakeVariable(ss, name->data, name->len, 2);
+        if (rv != SECSuccess) {
+            return rv; /* err set by AppendHandshake. */
+        }
+    }
+    rv = ssl3_AppendHandshakeNumber(ss, 0, 2);
+    if (rv != SECSuccess) {
+        return rv; /* err set by AppendHandshake. */
+    }
+
+    return SECSuccess;
+}
+
+static SECStatus
+tls13_HandleCertificateRequest(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+{
+    SECStatus rv;
+    SECItem context = { siBuffer, NULL, 0 };
+    SECItem algorithms = { siBuffer, NULL, 0 };
+    PLArenaPool *arena;
+    CERTDistNames ca_list;
+    PRInt32 extensionsLength;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle certificate_request sequence",
+                SSL_GETPID(), ss->fd));
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    /* Client */
+    rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERT_REQUEST, wait_cert_request);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+
+    PORT_Assert(ss->ssl3.clientCertChain == NULL);
+    PORT_Assert(ss->ssl3.clientCertificate == NULL);
+    PORT_Assert(ss->ssl3.clientPrivateKey == NULL);
+
+    rv = ssl3_ConsumeHandshakeVariable(ss, &context, 1, &b, &length);
+    if (rv != SECSuccess)
+        return SECFailure;
+    PORT_Assert(sizeof(ss->ssl3.hs.certReqContext) == 255);
+    PORT_Memcpy(ss->ssl3.hs.certReqContext, context.data, context.len);
+    ss->ssl3.hs.certReqContextLen = context.len;
+
+    rv = ssl3_ConsumeHandshakeVariable(ss, &algorithms, 2, &b, &length);
+    if (rv != SECSuccess)
+        return SECFailure;
+
+    if (algorithms.len == 0 || (algorithms.len & 1) != 0) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_REQUEST,
+                    illegal_parameter);
+        return SECFailure;
+    }
+
+    arena = ca_list.arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+    if (!arena) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    rv = ssl3_ParseCertificateRequestCAs(ss, &b, &length, arena, &ca_list);
+    if (rv != SECSuccess)
+        goto loser; /* alert sent below */
+
+    /* Verify that the extensions length is correct. */
+    extensionsLength = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
+    if (extensionsLength < 0) {
+        goto loser; /* alert sent below */
+    }
+    if (extensionsLength != length) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_REQUEST,
+                    illegal_parameter);
+        goto loser;
+    }
+
+    TLS13_SET_HS_STATE(ss, wait_server_cert);
+
+    rv = ssl3_CompleteHandleCertificateRequest(ss, &algorithms, &ca_list);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        goto loser;
+    }
+
+    return SECSuccess;
+
+loser:
+    PORT_FreeArena(arena, PR_FALSE);
+    return SECFailure;
+}
+
+static SECStatus
+tls13_InitializeHandshakeEncryption(sslSocket *ss)
+{
+    SECStatus rv;
+
+    /* For all present cipher suites, SS = ES.
+     * TODO(ekr@rtfm.com): Revisit for 0-RTT. */
+    ss->ssl3.hs.xSS = PK11_ReferenceSymKey(ss->ssl3.hs.xES);
+    if (!ss->ssl3.hs.xSS) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    rv = tls13_InitCipherSpec(ss, TrafficKeyHandshake,
+                              InstallCipherSpecBoth);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SSL_ERROR_INIT_CIPHER_SUITE_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    return rv;
+}
+
+/* Called from:  ssl3_HandleClientHello */
+SECStatus
+tls13_SendServerHelloSequence(sslSocket *ss)
+{
+    SECStatus rv;
+    SSL3KEAType certIndex;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: begin send server_hello sequence",
+                SSL_GETPID(), ss->fd));
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
+
+    rv = ssl3_SendServerHello(ss);
+    if (rv != SECSuccess) {
+        return rv; /* err code is set. */
+    }
+
+    rv = tls13_InitializeHandshakeEncryption(ss);
+    if (rv != SECSuccess) {
+        return SECFailure; /* error code is set. */
+    }
+
+    rv = tls13_SendEncryptedExtensions(ss);
+    if (rv != SECSuccess) {
+        return SECFailure; /* error code is set. */
+    }
+
+    if (ss->opt.requestCertificate) {
+        rv = tls13_SendCertificateRequest(ss);
+        if (rv != SECSuccess) {
+            return SECFailure; /* error code is set. */
+        }
+    }
+    rv = ssl3_SendCertificate(ss);
+    if (rv != SECSuccess) {
+        return SECFailure; /* error code is set. */
+    }
+    rv = ssl3_SendCertificateStatus(ss);
+    if (rv != SECSuccess) {
+        return SECFailure; /* error code is set. */
+    }
+
+    /* This was copied from: ssl3_SendCertificate.
+     * TODO(ekr@rtfm.com): Verify that this selection logic is correct.
+     * Bug 1237514.
+    */
+    if ((ss->ssl3.hs.kea_def->kea == kea_ecdhe_rsa) ||
+        (ss->ssl3.hs.kea_def->kea == kea_dhe_rsa)) {
+        certIndex = kt_rsa;
+    } else {
+        certIndex = ss->ssl3.hs.kea_def->exchKeyType;
+    }
+    rv = ssl3_SendCertificateVerify(ss, ss->serverCerts[certIndex].SERVERKEY);
+    if (rv != SECSuccess) {
+        return rv; /* err code is set. */
+    }
+
+    /* Compute the rest of the secrets except for the resumption
+     * and exporter secret. */
+    rv = tls13_ComputeSecrets1(ss);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    rv = tls13_SendFinished(ss);
+    if (rv != SECSuccess) {
+        return rv; /* error code is set. */
+    }
+
+    TLS13_SET_HS_STATE(ss, ss->opt.requestCertificate ? wait_client_cert
+                                                      : wait_finished);
+
+    return SECSuccess;
+}
+
+/*
+ * Called from ssl3_HandleServerHello.
+ *
+ * Caller must hold Handshake and RecvBuf locks.
+ */
+SECStatus
+tls13_HandleServerKeyShare(sslSocket *ss)
+{
+    SECStatus rv;
+    ECName expectedGroup;
+    PRCList *cur_p;
+    TLS13KeyShareEntry *entry;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle server_key_share handshake",
+                SSL_GETPID(), ss->fd));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    switch (ss->ssl3.hs.kea_def->exchKeyType) {
+#ifndef NSS_DISABLE_ECC
+        case ssl_kea_ecdh:
+            expectedGroup = ssl3_PubKey2ECName(ss->ephemeralECDHKeyPair->pubKey);
+            break;
+#endif /* NSS_DISABLE_ECC */
+        default:
+            FATAL_ERROR(ss, SEC_ERROR_UNSUPPORTED_KEYALG, handshake_failure);
+            return SECFailure;
+    }
+
+    /* This list should have one entry. */
+    cur_p = PR_NEXT_LINK(&ss->ssl3.hs.remoteKeyShares);
+    if (!cur_p) {
+        FATAL_ERROR(ss, SSL_ERROR_MISSING_KEY_SHARE, missing_extension);
+        return SECFailure;
+    }
+    PORT_Assert(PR_NEXT_LINK(cur_p) == &ss->ssl3.hs.remoteKeyShares);
+
+    entry = (TLS13KeyShareEntry *)cur_p;
+    if (entry->group != expectedGroup) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_KEY_SHARE, illegal_parameter);
+        return SECFailure;
+    }
+
+    rv = tls13_HandleECDHEKeyShare(ss, entry,
+                                   ss->ephemeralECDHKeyPair->privKey,
+                                   EphemeralSharedSecret);
+
+    ss->sec.keaType = ss->ssl3.hs.kea_def->exchKeyType;
+    ss->sec.keaKeyBits = SECKEY_PublicKeyStrengthInBits(
+        ss->ephemeralECDHKeyPair->pubKey);
+
+    if (rv != SECSuccess)
+        return SECFailure; /* Error code set below */
+
+    return tls13_InitializeHandshakeEncryption(ss);
+}
+
+/* Called from tls13_CompleteHandleHandshakeMessage() when it has deciphered a complete
+ * tls13 Certificate message.
+ * Caller must hold Handshake and RecvBuf locks.
+ */
+static SECStatus
+tls13_HandleCertificate(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+{
+    SECStatus rv;
+    SECItem context = { siBuffer, NULL, 0 };
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle certificate handshake",
+                SSL_GETPID(), ss->fd));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    if (ss->sec.isServer) {
+        rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERTIFICATE,
+                                  wait_client_cert);
+    } else {
+        rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERTIFICATE,
+                                  wait_cert_request, wait_server_cert);
+    }
+    if (rv != SECSuccess)
+        return SECFailure;
+
+    /* Process the context string */
+    rv = ssl3_ConsumeHandshakeVariable(ss, &context, 1, &b, &length);
+    if (rv != SECSuccess)
+        return SECFailure;
+    if (!ss->sec.isServer) {
+        if (context.len) {
+            /* The server's context string MUST be empty */
+            FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERTIFICATE,
+                        illegal_parameter);
+            return SECFailure;
+        }
+    } else {
+        if (!context.len || context.len != ss->ssl3.hs.certReqContextLen ||
+            (NSS_SecureMemcmp(ss->ssl3.hs.certReqContext,
+                              context.data, context.len) != 0)) {
+            FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERTIFICATE,
+                        illegal_parameter);
+            return SECFailure;
+        }
+        context.len = 0; /* Belt and suspenders. Zero out the context. */
+    }
+
+    return ssl3_CompleteHandleCertificate(ss, b, length);
+}
+
+/* Called from tls13_CompleteHandleHandshakeMessage() when it has deciphered a complete
+ * ssl3 CertificateStatus message.
+ * Caller must hold Handshake and RecvBuf locks.
+ */
+static SECStatus
+tls13_HandleCertificateStatus(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+{
+    SECStatus rv;
+
+    rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERT_STATUS,
+                              wait_certificate_status);
+    if (rv != SECSuccess)
+        return rv;
+
+    return ssl3_CompleteHandleCertificateStatus(ss, b, length);
+}
+
+/*
+ * TODO(ekr@rtfm.com): This install logic needs renaming since it's
+ * what happens at various stages of cipher spec setup. Legacy from ssl3con.c.
+ */
+int
+tls13_InstallCipherSpec(sslSocket *ss, InstallCipherSpecDirection direction)
+{
+    SSL_TRC(3, ("%d: TLS13[%d]: Installing new cipher specs direction = %s",
+                SSL_GETPID(), ss->fd,
+                direction == InstallCipherSpecRead ? "read" : "write"));
+
+    PORT_Assert(!IS_DTLS(ss)); /* TODO(ekr@rtfm.com): Update for DTLS */
+    /* TODO(ekr@rtfm.com): Holddown timer for DTLS. */
+    ssl_GetSpecWriteLock(ss); /**************************************/
+
+    /* Flush out any old stuff in the handshake buffers */
+    switch (direction) {
+        case InstallCipherSpecWrite: {
+            ssl3CipherSpec *pwSpec;
+            pwSpec = ss->ssl3.pwSpec;
+
+            ss->ssl3.pwSpec = ss->ssl3.cwSpec;
+            ss->ssl3.cwSpec = pwSpec;
+            break;
+        } break;
+        case InstallCipherSpecRead: {
+            ssl3CipherSpec *prSpec;
+
+            prSpec = ss->ssl3.prSpec;
+            ss->ssl3.prSpec = ss->ssl3.crSpec;
+            ss->ssl3.crSpec = prSpec;
+        } break;
+        default:
+            PORT_Assert(0);
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+            ssl_ReleaseSpecWriteLock(ss); /**************************************/
+            return SECFailure;
+    }
+
+    /* If we are really through with the old cipher prSpec
+     * (Both the read and write sides have changed) destroy it.
+     */
+    if (ss->ssl3.prSpec == ss->ssl3.pwSpec) {
+        ssl3_DestroyCipherSpec(ss->ssl3.prSpec, PR_FALSE /*freeSrvName*/);
+    }
+    ssl_ReleaseSpecWriteLock(ss); /**************************************/
+
+    return SECSuccess;
+}
+
+/* Add context to the hash functions as described in
+   [draft-ietf-tls-tls13; Section 4.9.1] */
+SECStatus
+tls13_AddContextToHashes(sslSocket *ss, SSL3Hashes *hashes /* IN/OUT */,
+                         SSLHashType algorithm, PRBool sending)
+{
+    SECStatus rv = SECSuccess;
+    PK11Context *ctx;
+    const unsigned char context_padding[] = {
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+        0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+    };
+    const char *client_cert_verify_string = "TLS 1.3, client CertificateVerify";
+    const char *server_cert_verify_string = "TLS 1.3, server CertificateVerify";
+    const char *context_string = (sending ^ ss->sec.isServer) ? client_cert_verify_string
+                                                              : server_cert_verify_string;
+    unsigned int hashlength;
+
+    /* Double check that we are doing SHA-256 for the handshake hash.*/
+    PORT_Assert(hashes->hashAlg == ssl_hash_sha256);
+    if (hashes->hashAlg != ssl_hash_sha256) {
+        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        goto loser;
+    }
+    PORT_Assert(hashes->len == 32);
+
+    ctx = PK11_CreateDigestContext(ssl3_TLSHashAlgorithmToOID(algorithm));
+    if (!ctx) {
+        PORT_SetError(SEC_ERROR_NO_MEMORY);
+        goto loser;
+    }
+
+    PORT_Assert(SECFailure);
+    PORT_Assert(!SECSuccess);
+
+    rv |= PK11_DigestBegin(ctx);
+    rv |= PK11_DigestOp(ctx, context_padding, sizeof(context_padding));
+    rv |= PK11_DigestOp(ctx, (unsigned char *)context_string,
+                        strlen(context_string) + 1); /* +1 includes the terminating 0 */
+    rv |= PK11_DigestOp(ctx, hashes->u.raw, hashes->len);
+    /* Update the hash in-place */
+    rv |= PK11_DigestFinal(ctx, hashes->u.raw, &hashlength, sizeof(hashes->u.raw));
+    PK11_DestroyContext(ctx, PR_TRUE);
+    PRINT_BUF(90, (NULL, "TLS 1.3 hash with context", hashes->u.raw, hashlength));
+
+    hashes->len = hashlength;
+    hashes->hashAlg = algorithm;
+
+    if (rv) {
+        ssl_MapLowLevelError(SSL_ERROR_SHA_DIGEST_FAILURE);
+        goto loser;
+    }
+    return SECSuccess;
+
+loser:
+    return SECFailure;
+}
+
+static SECStatus
+tls13_HkdfExtractSharedKey(sslSocket *ss, PK11SymKey *key,
+                           SharedSecretType keyType)
+{
+    PK11SymKey **destp;
+
+    switch (keyType) {
+        case EphemeralSharedSecret:
+            destp = &ss->ssl3.hs.xES;
+            break;
+        case StaticSharedSecret:
+            destp = &ss->ssl3.hs.xSS;
+            break;
+        default:
+            PORT_Assert(0);
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+            return SECFailure;
+    }
+
+    PORT_Assert(!*destp);
+    return tls13_HkdfExtract(NULL, key, tls13_GetHash(ss), destp);
+}
+
+static SECStatus
+tls13_DeriveTrafficKeys(sslSocket *ss, ssl3CipherSpec *pwSpec,
+                        TrafficKeyType type)
+{
+    size_t keySize = pwSpec->cipher_def->key_size;
+    size_t ivSize = pwSpec->cipher_def->iv_size +
+                    pwSpec->cipher_def->explicit_nonce_size; /* This isn't always going to
+                                                              * work, but it does for
+                                                              * AES-GCM */
+    CK_MECHANISM_TYPE bulkAlgorithm = ssl3_Alg2Mech(pwSpec->cipher_def->calg);
+    SSL3Hashes hashes;
+    PK11SymKey *prk = NULL;
+    const char *phase;
+    char label[256]; /* Arbitrary buffer large enough to hold the label */
+    SECStatus rv;
+
+#define FORMAT_LABEL(phase_, purpose_)                                              \
+    do {                                                                            \
+        PRUint32 n = PR_snprintf(label, sizeof(label), "%s, %s", phase_, purpose_); \
+        /* Check for getting close. */                                              \
+        if ((n + 1) >= sizeof(label)) {                                             \
+            PORT_Assert(0);                                                         \
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);                               \
+            goto loser;                                                             \
+        }                                                                           \
+    } while (0)
+#define EXPAND_TRAFFIC_KEY(purpose_, target_)                                 \
+    do {                                                                      \
+        FORMAT_LABEL(phase, purpose_);                                        \
+        rv = tls13_HkdfExpandLabel(prk, tls13_GetHash(ss),                    \
+                                   hashes.u.raw, hashes.len,                  \
+                                   label, strlen(label),                      \
+                                   bulkAlgorithm, keySize, &pwSpec->target_); \
+        if (rv != SECSuccess) {                                               \
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);                         \
+            PORT_Assert(0);                                                   \
+            goto loser;                                                       \
+        }                                                                     \
+    } while (0)
+
+#define EXPAND_TRAFFIC_IV(purpose_, target_)                    \
+    do {                                                        \
+        FORMAT_LABEL(phase, purpose_);                          \
+        rv = tls13_HkdfExpandLabelRaw(prk, tls13_GetHash(ss),   \
+                                      hashes.u.raw, hashes.len, \
+                                      label, strlen(label),     \
+                                      pwSpec->target_, ivSize); \
+        if (rv != SECSuccess) {                                 \
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);           \
+            PORT_Assert(0);                                     \
+            goto loser;                                         \
+        }                                                       \
+    } while (0)
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSpecWriteLock(ss));
+    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);
+
+    rv = ssl3_ComputeHandshakeHashes(ss, pwSpec, &hashes, 0);
+    if (rv != SECSuccess) {
+        PORT_Assert(0); /* Should never fail */
+        ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
+        return SECFailure;
+    }
+    PRINT_BUF(60, (ss, "Deriving traffic keys. Session hash=", hashes.u.raw,
+                   hashes.len));
+
+    switch (type) {
+        case TrafficKeyHandshake:
+            phase = kHkdfPhaseHandshakeKeys;
+            prk = ss->ssl3.hs.xES;
+            break;
+        case TrafficKeyApplicationData:
+            phase = kHkdfPhaseApplicationDataKeys;
+            prk = ss->ssl3.hs.trafficSecret;
+            break;
+        default:
+            PORT_Assert(0);
+            PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+            return SECFailure;
+    }
+    PORT_Assert(prk != NULL);
+
+    SSL_TRC(3, ("%d: TLS13[%d]: deriving traffic keys phase='%s'",
+                SSL_GETPID(), ss->fd, phase));
+
+    EXPAND_TRAFFIC_KEY(kHkdfPurposeClientWriteKey, client.write_key);
+    EXPAND_TRAFFIC_KEY(kHkdfPurposeServerWriteKey, server.write_key);
+    EXPAND_TRAFFIC_IV(kHkdfPurposeClientWriteIv, client.write_iv);
+    EXPAND_TRAFFIC_IV(kHkdfPurposeServerWriteIv, server.write_iv);
+
+    return SECSuccess;
+
+loser:
+    return SECFailure;
+}
+
+/* Set up a cipher spec with keys. If install is nonzero, then also install
+ * it as the current cipher spec for each value in the mask. */
+SECStatus
+tls13_InitCipherSpec(sslSocket *ss, TrafficKeyType type, InstallCipherSpecDirection install)
+{
+    ssl3CipherSpec *pwSpec;
+    ssl3CipherSpec *cwSpec;
+    SECStatus rv;
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    if (install == InstallCipherSpecWrite ||
+        install == InstallCipherSpecBoth) {
+        ssl_GetXmitBufLock(ss);
+
+        rv = ssl3_FlushHandshake(ss, ssl_SEND_FLAG_FORCE_INTO_BUFFER);
+        ssl_ReleaseXmitBufLock(ss);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+
+    ssl_GetSpecWriteLock(ss); /**************************************/
+
+    PORT_Assert(ss->ssl3.prSpec == ss->ssl3.pwSpec);
+
+    pwSpec = ss->ssl3.pwSpec;
+    cwSpec = ss->ssl3.cwSpec;
+
+    switch (pwSpec->cipher_def->calg) {
+        case calg_aes_gcm:
+            pwSpec->aead = tls13_AESGCM;
+            break;
+        default:
+            PORT_Assert(0);
+            goto loser;
+            break;
+    }
+
+    /* Generic behaviors -- common to all crypto methods */
+    if (!IS_DTLS(ss)) {
+        pwSpec->read_seq_num.high = pwSpec->write_seq_num.high = 0;
+    } else {
+        if (cwSpec->epoch == PR_UINT16_MAX) {
+            /* The problem here is that we have rehandshaked too many
+             * times (you are not allowed to wrap the epoch). The
+             * spec says you should be discarding the connection
+             * and start over, so not much we can do here. */
+            rv = SECFailure;
+            goto loser;
+        }
+        /* The sequence number has the high 16 bits as the epoch. */
+        pwSpec->epoch = cwSpec->epoch + 1;
+        pwSpec->read_seq_num.high = pwSpec->write_seq_num.high =
+            pwSpec->epoch << 16;
+
+        dtls_InitRecvdRecords(&pwSpec->recvdRecords);
+    }
+    pwSpec->read_seq_num.low = pwSpec->write_seq_num.low = 0;
+
+    rv = tls13_DeriveTrafficKeys(ss, pwSpec, type);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+    if (install == InstallCipherSpecWrite ||
+        install == InstallCipherSpecBoth) {
+        rv = tls13_InstallCipherSpec(ss, InstallCipherSpecWrite);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    if (install == InstallCipherSpecRead ||
+        install == InstallCipherSpecBoth) {
+        rv = tls13_InstallCipherSpec(ss, InstallCipherSpecRead);
+        if (rv != SECSuccess) {
+            goto loser;
+        }
+    }
+    ssl_ReleaseSpecWriteLock(ss); /**************************************/
+
+    return SECSuccess;
+
+loser:
+    ssl_ReleaseSpecWriteLock(ss); /**************************************/
+    PORT_SetError(SSL_ERROR_INIT_CIPHER_SUITE_FAILURE);
+    return SECFailure;
+}
+
+static SECStatus
+tls13_ComputeSecrets1(sslSocket *ss)
+{
+    SECStatus rv;
+    PK11SymKey *mSS = NULL;
+    PK11SymKey *mES = NULL;
+    PK11SymKey *masterSecret = NULL;
+    SSL3Hashes hashes;
+
+    rv = ssl3_SetupPendingCipherSpec(ss);
+    if (rv != SECSuccess) {
+        return rv; /* error code set below. */
+    }
+
+    rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.pwSpec, &hashes, 0);
+    if (rv != SECSuccess) {
+        PORT_Assert(0); /* Should never fail */
+        ssl_MapLowLevelError(SSL_ERROR_SESSION_KEY_GEN_FAILURE);
+        return SECFailure;
+    }
+
+    PORT_Assert(ss->ssl3.hs.xSS);
+    PORT_Assert(ss->ssl3.hs.xES);
+
+    rv = tls13_HkdfExpandLabel(ss->ssl3.hs.xSS,
+                               tls13_GetHash(ss),
+                               hashes.u.raw, hashes.len,
+                               kHkdfLabelExpandedSs,
+                               strlen(kHkdfLabelExpandedSs),
+                               tls13_GetHkdfMechanism(ss),
+                               hashes.len, &mSS);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = tls13_HkdfExpandLabel(ss->ssl3.hs.xES,
+                               tls13_GetHash(ss),
+                               hashes.u.raw, hashes.len,
+                               kHkdfLabelExpandedEs,
+                               strlen(kHkdfLabelExpandedEs),
+                               tls13_GetHkdfMechanism(ss),
+                               hashes.len, &mES);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = tls13_HkdfExtract(mSS, mES,
+                           tls13_GetHash(ss),
+                           &masterSecret);
+
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = tls13_HkdfExpandLabel(masterSecret,
+                               tls13_GetHash(ss),
+                               hashes.u.raw, hashes.len,
+                               kHkdfLabelTrafficSecret,
+                               strlen(kHkdfLabelTrafficSecret),
+                               tls13_GetHkdfMechanism(ss),
+                               hashes.len, &ss->ssl3.hs.trafficSecret);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = tls13_HkdfExpandLabel(masterSecret,
+                               tls13_GetHash(ss),
+                               NULL, 0,
+                               kHkdfLabelClientFinishedSecret,
+                               strlen(kHkdfLabelClientFinishedSecret),
+                               tls13_GetHmacMechanism(ss),
+                               hashes.len, &ss->ssl3.hs.clientFinishedSecret);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+    rv = tls13_HkdfExpandLabel(masterSecret,
+                               tls13_GetHash(ss),
+                               NULL, 0,
+                               kHkdfLabelServerFinishedSecret,
+                               strlen(kHkdfLabelServerFinishedSecret),
+                               tls13_GetHmacMechanism(ss),
+                               hashes.len, &ss->ssl3.hs.serverFinishedSecret);
+    if (rv != SECSuccess) {
+        goto loser;
+    }
+
+loser:
+    PK11_FreeSymKey(ss->ssl3.hs.xSS);
+    ss->ssl3.hs.xSS = NULL;
+    PK11_FreeSymKey(ss->ssl3.hs.xES);
+    ss->ssl3.hs.xES = NULL;
+
+    if (mSS) {
+        PK11_FreeSymKey(mSS);
+    }
+    if (mES) {
+        PK11_FreeSymKey(mES);
+    }
+    if (masterSecret) {
+        PK11_FreeSymKey(masterSecret);
+    }
+
+    return rv;
+}
+
+void
+tls13_DestroyKeyShareEntry(TLS13KeyShareEntry *offer)
+{
+    SECITEM_ZfreeItem(&offer->key_exchange, PR_FALSE);
+    PORT_ZFree(offer, sizeof(*offer));
+}
+
+void
+tls13_DestroyKeyShares(PRCList *list)
+{
+    PRCList *cur_p;
+
+    while (!PR_CLIST_IS_EMPTY(list)) {
+        cur_p = PR_LIST_TAIL(list);
+        PR_REMOVE_LINK(cur_p);
+        tls13_DestroyKeyShareEntry((TLS13KeyShareEntry *)cur_p);
+    }
+}
+
+/* Implement the SSLAEADCipher interface defined in sslimpl.h.
+ *
+ * That interface mixes the AD and the sequence number, but in
+ * TLS 1.3 there is no additional data so this value is just the
+ * encoded sequence number and we call it |seqNumBuf|.
+ */
+static SECStatus
+tls13_AESGCM(ssl3KeyMaterial *keys,
+             PRBool doDecrypt,
+             unsigned char *out,
+             int *outlen,
+             int maxout,
+             const unsigned char *in,
+             int inlen,
+             const unsigned char *seqNumBuf,
+             int seqNumLen)
+{
+    SECItem param;
+    SECStatus rv = SECFailure;
+    unsigned char nonce[12];
+    size_t i;
+    unsigned int uOutLen;
+    CK_GCM_PARAMS gcmParams;
+    static const int tagSize = 16;
+
+    PORT_Assert(seqNumLen == 8);
+
+    /* draft-ietf-tls-tls13 Section 5.2.2 specifies the following
+     * nonce algorithm:
+     *
+     * The length of the per-record nonce (iv_length) is set to max(8 bytes,
+     * N_MIN) for the AEAD algorithm (see [RFC5116] Section 4).  An AEAD
+     * algorithm where N_MAX is less than 8 bytes MUST NOT be used with TLS.
+     * The per-record nonce for the AEAD construction is formed as follows:
+     *
+     * 1.  The 64-bit record sequence number is padded to the left with
+     *     zeroes to iv_length.
+     *
+     * 2.  The padded sequence number is XORed with the static
+     *     client_write_iv or server_write_iv, depending on the role.
+     *
+     * The resulting quantity (of length iv_length) is used as the per-
+     * record nonce.
+     *
+     * Per RFC 5288: N_MIN = N_MAX = 12 bytes.
+     *
+     */
+    memcpy(nonce, keys->write_iv, sizeof(nonce));
+    for (i = 0; i < 8; ++i) {
+        nonce[4 + i] ^= seqNumBuf[i];
+    }
+
+    param.type = siBuffer;
+    param.data = (unsigned char *)&gcmParams;
+    param.len = sizeof(gcmParams);
+    gcmParams.pIv = nonce;
+    gcmParams.ulIvLen = sizeof(nonce);
+    gcmParams.pAAD = NULL;
+    gcmParams.ulAADLen = 0;
+    gcmParams.ulTagBits = tagSize * 8;
+
+    if (doDecrypt) {
+        rv = PK11_Decrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
+                          maxout, in, inlen);
+    } else {
+        rv = PK11_Encrypt(keys->write_key, CKM_AES_GCM, &param, out, &uOutLen,
+                          maxout, in, inlen);
+    }
+    *outlen = (int)uOutLen;
+
+    return rv;
+}
+
+static SECStatus
+tls13_HandleEncryptedExtensions(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+{
+    SECStatus rv;
+    PRInt32 innerLength;
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle encrypted extensions",
+                SSL_GETPID(), ss->fd));
+
+    rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_ENCRYPTED_EXTENSIONS,
+                              wait_encrypted_extensions);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+
+    innerLength = ssl3_ConsumeHandshakeNumber(ss, 2, &b, &length);
+    if (innerLength < 0) {
+        return SECFailure; /* Alert already sent. */
+    }
+    if (innerLength != length) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_ENCRYPTED_EXTENSIONS,
+                    illegal_parameter);
+        return SECFailure;
+    }
+
+    rv = ssl3_HandleHelloExtensions(ss, &b, &length, encrypted_extensions);
+    if (rv != SECSuccess) {
+        return SECFailure; /* Error code set below */
+    }
+
+    TLS13_SET_HS_STATE(ss, wait_cert_request);
+    return SECSuccess;
+}
+
+static SECStatus
+tls13_SendEncryptedExtensions(sslSocket *ss)
+{
+    SECStatus rv;
+    PRInt32 extensions_len = 0;
+    PRInt32 sent_len = 0;
+    PRUint32 maxBytes = 65535;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: send encrypted extensions handshake",
+                SSL_GETPID(), ss->fd));
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
+
+    extensions_len = ssl3_CallHelloExtensionSenders(
+        ss, PR_FALSE, maxBytes, &ss->xtnData.encryptedExtensionsSenders[0]);
+
+    rv = ssl3_AppendHandshakeHeader(ss, encrypted_extensions,
+                                    extensions_len + 2);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+    rv = ssl3_AppendHandshakeNumber(ss, extensions_len, 2);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+    sent_len = ssl3_CallHelloExtensionSenders(
+        ss, PR_TRUE, extensions_len,
+        &ss->xtnData.encryptedExtensionsSenders[0]);
+    PORT_Assert(sent_len == extensions_len);
+    if (sent_len != extensions_len) {
+        PORT_Assert(sent_len == 0);
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    return SECSuccess;
+}
+
+/* Called from tls13_CompleteHandleHandshakeMessage() when it has deciphered a complete
+ * tls13 CertificateVerify message
+ * Caller must hold Handshake and RecvBuf locks.
+ */
+SECStatus
+tls13_HandleCertificateVerify(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+                              SSL3Hashes *hashes)
+{
+    SECItem signed_hash = { siBuffer, NULL, 0 };
+    SECStatus rv;
+    SSLSignatureAndHashAlg sigAndHash;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle certificate_verify handshake",
+                SSL_GETPID(), ss->fd));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_CERT_VERIFY,
+                              wait_cert_verify);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+
+    if (!hashes) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    /* We only support CertificateVerify messages that use the handshake
+     * hash.
+     * TODO(ekr@rtfm.com): This should be easy to relax in TLS 1.3 by
+     * reading the client's hash algorithm first, but there may
+     * be subtleties so retain the restriction for now.
+     */
+    rv = tls13_AddContextToHashes(ss, hashes, hashes->hashAlg, PR_FALSE);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SSL_ERROR_DIGEST_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    rv = ssl3_ConsumeSignatureAndHashAlgorithm(ss, &b, &length,
+                                               &sigAndHash);
+    if (rv != SECSuccess) {
+        PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_VERIFY);
+        return SECFailure;
+    }
+
+    rv = ssl3_CheckSignatureAndHashAlgorithmConsistency(
+        ss, &sigAndHash, ss->sec.peerCert);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_VERIFY, decrypt_error);
+        return SECFailure;
+    }
+
+    /* We only support CertificateVerify messages that use the handshake
+     * hash. */
+    if (sigAndHash.hashAlg != hashes->hashAlg) {
+        FATAL_ERROR(ss, SSL_ERROR_UNSUPPORTED_HASH_ALGORITHM, decrypt_error);
+        return SECFailure;
+    }
+
+    rv = ssl3_ConsumeHandshakeVariable(ss, &signed_hash, 2, &b, &length);
+    if (rv != SECSuccess) {
+        PORT_SetError(SSL_ERROR_RX_MALFORMED_CERT_VERIFY);
+        return SECFailure;
+    }
+
+    if (length != 0) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_CERT_VERIFY, decode_error);
+        return SECFailure;
+    }
+
+    rv = ssl3_VerifySignedHashes(hashes, ss->sec.peerCert, &signed_hash,
+                                 PR_TRUE, ss->pkcs11PinArg);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, PORT_GetError(), decrypt_error);
+        return SECFailure;
+    }
+
+    if (!ss->sec.isServer) {
+        /* Compute the rest of the secrets except for the resumption
+         * and exporter secret. */
+        rv = tls13_ComputeSecrets1(ss);
+        if (rv != SECSuccess) {
+            FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+            return SECFailure;
+        }
+    }
+    TLS13_SET_HS_STATE(ss, wait_finished);
+
+    return SECSuccess;
+}
+
+static SECStatus
+tls13_ComputeFinished(sslSocket *ss, const SSL3Hashes *hashes, PRBool sending,
+                      PRUint8 *output, unsigned int *outputLen, unsigned int maxOutputLen)
+{
+    SECStatus rv;
+    PK11Context *hmacCtx = NULL;
+    CK_MECHANISM_TYPE macAlg = tls13_GetHmacMechanism(ss);
+    SECItem param = { siBuffer, NULL, 0 };
+    unsigned int outputLenUint;
+    PK11SymKey *secret = (ss->sec.isServer ^ sending) ? ss->ssl3.hs.clientFinishedSecret
+                                                      : ss->ssl3.hs.serverFinishedSecret;
+
+    PORT_Assert(secret);
+    PRINT_BUF(90, (NULL, "Handshake hash", hashes->u.raw, hashes->len));
+
+    hmacCtx = PK11_CreateContextBySymKey(macAlg, CKA_SIGN,
+                                         secret, &param);
+    if (!hmacCtx) {
+        goto abort;
+    }
+
+    rv = PK11_DigestBegin(hmacCtx);
+    if (rv != SECSuccess)
+        goto abort;
+
+    rv = PK11_DigestOp(hmacCtx, hashes->u.raw, hashes->len);
+    if (rv != SECSuccess)
+        goto abort;
+
+    PORT_Assert(maxOutputLen >= hashes->len);
+    rv = PK11_DigestFinal(hmacCtx, output, &outputLenUint, maxOutputLen);
+    if (rv != SECSuccess)
+        goto abort;
+    *outputLen = outputLenUint;
+
+    PK11_DestroyContext(hmacCtx, PR_TRUE);
+    return SECSuccess;
+
+abort:
+    if (hmacCtx) {
+        PK11_DestroyContext(hmacCtx, PR_TRUE);
+    }
+
+    PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+    return SECFailure;
+}
+
+static SECStatus
+tls13_SendFinished(sslSocket *ss)
+{
+    SECStatus rv;
+    PRUint8 finishedBuf[MAX_FINISHED_SIZE];
+    unsigned int finishedLen;
+    SSL3Hashes hashes;
+    int errCode;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: send finished handshake", SSL_GETPID(), ss->fd));
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveXmitBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    rv = ssl3_ComputeHandshakeHashes(ss, ss->ssl3.cwSpec, &hashes, 0);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    ssl_GetSpecReadLock(ss);
+    rv = tls13_ComputeFinished(ss, &hashes, PR_TRUE,
+                               finishedBuf, &finishedLen, sizeof(finishedBuf));
+    ssl_ReleaseSpecReadLock(ss);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    rv = ssl3_AppendHandshakeHeader(ss, finished, finishedLen);
+    if (rv != SECSuccess) {
+        errCode = PR_GetError();
+        goto alert_loser;
+    }
+
+    rv = ssl3_AppendHandshake(ss, finishedBuf, finishedLen);
+    if (rv != SECSuccess) {
+        errCode = PR_GetError();
+        goto alert_loser;
+    }
+
+    rv = ssl3_FlushHandshake(ss, 0);
+    if (rv != SECSuccess) {
+        errCode = PR_GetError();
+        goto alert_loser;
+    }
+
+    if (ss->sec.isServer) {
+        rv = tls13_InitCipherSpec(ss, TrafficKeyApplicationData,
+                                  InstallCipherSpecWrite);
+    } else {
+        rv = tls13_InstallCipherSpec(ss, InstallCipherSpecWrite);
+    }
+    if (rv != SECSuccess) {
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+
+    /* TODO(ekr@rtfm.com): Record key log */
+    return SECSuccess;
+
+alert_loser:
+    (void)SSL3_SendAlert(ss, alert_fatal, internal_error);
+    PORT_SetError(errCode); /* Restore error code */
+    return rv;
+}
+
+static SECStatus
+tls13_HandleFinished(sslSocket *ss, SSL3Opaque *b, PRUint32 length,
+                     const SSL3Hashes *hashes)
+{
+    SECStatus rv;
+    PRUint8 finishedBuf[MAX_FINISHED_SIZE];
+    unsigned int finishedLen;
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    SSL_TRC(3, ("%d: TLS13[%d]: handle finished handshake",
+                SSL_GETPID(), ss->fd));
+
+    rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_FINISHED, wait_finished);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+    if (!hashes) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    ssl_GetSpecReadLock(ss);
+    rv = tls13_ComputeFinished(ss, hashes, PR_FALSE,
+                               finishedBuf, &finishedLen, sizeof(finishedBuf));
+    ssl_ReleaseSpecReadLock(ss);
+    if (rv != SECSuccess) {
+        FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+        return SECFailure;
+    }
+
+    if (length != finishedLen) {
+        FATAL_ERROR(ss, SSL_ERROR_RX_MALFORMED_FINISHED, decode_error);
+        return SECFailure;
+    }
+
+    if (NSS_SecureMemcmp(b, finishedBuf, finishedLen) != 0) {
+        FATAL_ERROR(ss, SSL_ERROR_BAD_HANDSHAKE_HASH_VALUE,
+                    decrypt_error);
+        return SECFailure;
+    }
+
+    /* Server is now finished.
+     * Client sends second flight
+     */
+    /* TODO(ekr@rtfm.com): Send NewSession Ticket if server. */
+    if (ss->sec.isServer) {
+        rv = tls13_InstallCipherSpec(ss, InstallCipherSpecRead);
+        if (rv != SECSuccess) {
+            FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+            return SECFailure;
+        }
+
+        rv = tls13_FinishHandshake(ss);
+    } else {
+        if (ss->ssl3.hs.authCertificatePending) {
+            /* TODO(ekr@rtfm.com): Handle pending auth */
+            FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+            PORT_Assert(0);
+            return SECFailure;
+        }
+        rv = tls13_InitCipherSpec(ss, TrafficKeyApplicationData,
+                                  InstallCipherSpecRead);
+        if (rv != SECSuccess) {
+            FATAL_ERROR(ss, SEC_ERROR_LIBRARY_FAILURE, internal_error);
+            return SECFailure;
+        }
+
+        rv = tls13_SendClientSecondRound(ss);
+        if (rv != SECSuccess)
+            return SECFailure; /* Error code and alerts handled below */
+    }
+
+    return rv;
+}
+
+static SECStatus
+tls13_FinishHandshake(sslSocket *ss)
+{
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+    PORT_Assert(ss->ssl3.hs.restartTarget == NULL);
+
+    /* The first handshake is now completed. */
+    ss->handshake = NULL;
+
+    TLS13_SET_HS_STATE(ss, idle_handshake);
+
+    ssl_FinishHandshake(ss);
+
+    return SECSuccess;
+}
+
+static SECStatus
+tls13_SendClientSecondRound(sslSocket *ss)
+{
+    SECStatus rv;
+    PRBool sendClientCert;
+
+    PORT_Assert(ss->opt.noLocks || ssl_HaveRecvBufLock(ss));
+    PORT_Assert(ss->opt.noLocks || ssl_HaveSSL3HandshakeLock(ss));
+
+    sendClientCert = !ss->ssl3.sendEmptyCert &&
+                     ss->ssl3.clientCertChain != NULL &&
+                     ss->ssl3.clientPrivateKey != NULL;
+
+    /* Defer client authentication sending if we are still
+     * waiting for server authentication. See the long block
+     * comment in ssl3_SendClientSecondRound for more detail.
+     */
+    if (ss->ssl3.hs.restartTarget) {
+        PR_NOT_REACHED("unexpected ss->ssl3.hs.restartTarget");
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+    if (ss->ssl3.hs.authCertificatePending && (sendClientCert ||
+                                               ss->ssl3.sendEmptyCert)) {
+        SSL_TRC(3, ("%d: TLS13[%p]: deferring ssl3_SendClientSecondRound because"
+                    " certificate authentication is still pending.",
+                    SSL_GETPID(), ss->fd));
+        ss->ssl3.hs.restartTarget = tls13_SendClientSecondRound;
+        return SECWouldBlock;
+    }
+
+    ssl_GetXmitBufLock(ss); /*******************************/
+    if (ss->ssl3.sendEmptyCert) {
+        ss->ssl3.sendEmptyCert = PR_FALSE;
+        rv = ssl3_SendEmptyCertificate(ss);
+        /* Don't send verify */
+        if (rv != SECSuccess) {
+            goto loser; /* error code is set. */
+        }
+    } else if (sendClientCert) {
+        rv = ssl3_SendCertificate(ss);
+        if (rv != SECSuccess) {
+            goto loser; /* error code is set. */
+        }
+    }
+
+    if (sendClientCert) {
+        rv = ssl3_SendCertificateVerify(ss, ss->ssl3.clientPrivateKey);
+        SECKEY_DestroyPrivateKey(ss->ssl3.clientPrivateKey);
+        ss->ssl3.clientPrivateKey = NULL;
+        if (rv != SECSuccess) {
+            goto loser; /* err is set. */
+        }
+    }
+
+    rv = tls13_SendFinished(ss);
+    if (rv != SECSuccess) {
+        goto loser; /* err code was set. */
+    }
+    ssl_ReleaseXmitBufLock(ss); /*******************************/
+
+    /* The handshake is now finished */
+    return tls13_FinishHandshake(ss);
+
+loser:
+    ssl_ReleaseXmitBufLock(ss); /*******************************/
+    return SECFailure;
+}
+
+static SECStatus
+tls13_HandleNewSessionTicket(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
+{
+    SECStatus rv;
+
+    rv = TLS13_CHECK_HS_STATE(ss, SSL_ERROR_RX_UNEXPECTED_NEW_SESSION_TICKET,
+                              idle_handshake);
+    if (rv != SECSuccess) {
+        return SECFailure;
+    }
+
+    UNIMPLEMENTED();
+
+    /* Ignore */
+    return SECSuccess;
+}
+
+typedef enum {
+    ExtensionNotUsed,
+    ExtensionClientOnly,
+    ExtensionSendClear,
+    ExtensionSendEncrypted,
+} Tls13ExtensionStatus;
+
+static const struct {
+    SSLExtensionType ex_value;
+    Tls13ExtensionStatus status;
+} KnownExtensions[] = {
+    { ssl_server_name_xtn,
+      ExtensionSendEncrypted },
+    {
+        ssl_cert_status_xtn,
+        ExtensionNotUsed /* TODO(ekr@rtfm.com): Disabled because broken
+                            in TLS 1.3. */
+        /* ExtensionSendEncrypted */
+    },
+    { ssl_elliptic_curves_xtn,
+      ExtensionSendClear },
+    { ssl_ec_point_formats_xtn,
+      ExtensionNotUsed },
+    { ssl_signature_algorithms_xtn,
+      ExtensionClientOnly },
+    { ssl_use_srtp_xtn,
+      ExtensionSendEncrypted },
+    { ssl_app_layer_protocol_xtn,
+      ExtensionSendEncrypted },
+    { ssl_padding_xtn,
+      ExtensionNotUsed },
+    { ssl_extended_master_secret_xtn,
+      ExtensionNotUsed },
+    { ssl_session_ticket_xtn,
+      ExtensionClientOnly },
+    { ssl_tls13_key_share_xtn,
+      ExtensionSendClear },
+    { ssl_next_proto_nego_xtn,
+      ExtensionNotUsed },
+    { ssl_renegotiation_info_xtn,
+      ExtensionNotUsed },
+    { ssl_tls13_draft_version_xtn,
+      ExtensionClientOnly }
+};
+
+PRBool
+tls13_ExtensionAllowed(PRUint16 extension, SSL3HandshakeType message)
+{
+    unsigned int i;
+
+    PORT_Assert((message == client_hello) ||
+                (message == server_hello) ||
+                (message == encrypted_extensions));
+
+    for (i = 0; i < PR_ARRAY_SIZE(KnownExtensions); i++) {
+        if (KnownExtensions[i].ex_value == extension)
+            break;
+    }
+    if (i == PR_ARRAY_SIZE(KnownExtensions)) {
+        /* We have never heard of this extension which is OK on
+         * the server but not the client. */
+        return message == client_hello;
+    }
+
+    switch (KnownExtensions[i].status) {
+        case ExtensionNotUsed:
+            return PR_FALSE;
+        case ExtensionClientOnly:
+            return message == client_hello;
+        case ExtensionSendClear:
+            return message == client_hello ||
+                   message == server_hello;
+        case ExtensionSendEncrypted:
+            return message == client_hello ||
+                   message == encrypted_extensions;
+    }
+
+    PORT_Assert(0);
+
+    /* Not reached */
+    return PR_TRUE;
+}
+
+/* Helper function to encode a uint32 into a buffer */
+unsigned char *
+tls13_EncodeUintX(PRUint32 value, unsigned int bytes, unsigned char *to)
+{
+    PRUint32 encoded;
+
+    PORT_Assert(bytes > 0 && bytes <= 4);
+
+    encoded = PR_htonl(value);
+    memcpy(to, ((unsigned char *)(&encoded)) + (4 - bytes), bytes);
+    return to + bytes;
+}
+
+/* TLS 1.3 doesn't actually have additional data but the aead function
+ * signature overloads additional data to carry the record sequence
+ * number and that's what we put here. The TLS 1.3 AEAD functions
+ * just use this input as the sequence number and not as additional
+ * data. */
+static void
+tls13_FormatAdditionalData(unsigned char *aad, unsigned int length,
+                           SSL3SequenceNumber seqNum)
+{
+    unsigned char *ptr = aad;
+
+    PORT_Assert(length == 8);
+    ptr = tls13_EncodeUintX(seqNum.high, 4, ptr);
+    ptr = tls13_EncodeUintX(seqNum.low, 4, ptr);
+    PORT_Assert((ptr - aad) == length);
+}
+
+SECStatus
+tls13_ProtectRecord(sslSocket *ss,
+                    SSL3ContentType type,
+                    const SSL3Opaque *pIn,
+                    PRUint32 contentLen,
+                    sslBuffer *wrBuf)
+{
+    ssl3CipherSpec *cwSpec = ss->ssl3.cwSpec;
+    const ssl3BulkCipherDef *cipher_def = cwSpec->cipher_def;
+    SECStatus rv;
+    PRUint16 headerLen;
+    int cipherBytes = 0;
+    const int tagLen = cipher_def->tag_size;
+
+    SSL_TRC(3, ("%d: TLS13[%d]: protect record of length %u, seq=0x%0x%0x",
+                SSL_GETPID(), ss->fd, contentLen,
+                cwSpec->write_seq_num.high,
+                cwSpec->write_seq_num.low));
+
+    headerLen = IS_DTLS(ss) ? DTLS_RECORD_HEADER_LENGTH : SSL3_RECORD_HEADER_LENGTH;
+
+    if (headerLen + contentLen + 1 + tagLen > wrBuf->space) {
+        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
+        return SECFailure;
+    }
+
+    /* Copy the data into the wrBuf. We're going to encrypt in-place
+     * in the AEAD branch anyway */
+    PORT_Memcpy(wrBuf->buf + headerLen, pIn, contentLen);
+
+    if (cipher_def->calg == ssl_calg_null) {
+        /* Shortcut for plaintext */
+        cipherBytes = contentLen;
+    } else {
+        unsigned char aad[8];
+        PORT_Assert(cipher_def->type == type_aead);
+
+        /* Add the content type at the end. */
+        wrBuf->buf[headerLen + contentLen] = type;
+
+        /* Stomp the content type to be application_data */
+        type = content_application_data;
+
+        tls13_FormatAdditionalData(aad, sizeof(aad),
+                                   cwSpec->write_seq_num);
+        cipherBytes = contentLen + 1; /* Room for the content type on the end. */
+        rv = cwSpec->aead(
+            ss->sec.isServer ? &cwSpec->server : &cwSpec->client,
+            PR_FALSE,                               /* do encrypt */
+            wrBuf->buf + headerLen,                 /* output  */
+            &cipherBytes,                           /* out len */
+            wrBuf->space - headerLen,               /* max out */
+            wrBuf->buf + headerLen, contentLen + 1, /* input   */
+            aad, sizeof(aad));
+        if (rv != SECSuccess) {
+            PORT_SetError(SSL_ERROR_ENCRYPTION_FAILURE);
+            return SECFailure;
+        }
+    }
+
+    PORT_Assert(cipherBytes <= MAX_FRAGMENT_LENGTH + 256);
+
+    wrBuf->len = cipherBytes + headerLen;
+    wrBuf->buf[0] = type;
+
+    if (IS_DTLS(ss)) {
+        (void)tls13_EncodeUintX(2, dtls_TLSVersionToDTLSVersion(kRecordVersion),
+                                &wrBuf->buf[1]);
+        (void)tls13_EncodeUintX(cwSpec->write_seq_num.high, 4, &wrBuf->buf[3]);
+        (void)tls13_EncodeUintX(cwSpec->write_seq_num.low, 4, &wrBuf->buf[7]);
+        (void)tls13_EncodeUintX(cipherBytes, 2, &wrBuf->buf[11]);
+    } else {
+        (void)tls13_EncodeUintX(kRecordVersion, 2, &wrBuf->buf[1]);
+        (void)tls13_EncodeUintX(cipherBytes, 2, &wrBuf->buf[3]);
+    }
+    ssl3_BumpSequenceNumber(&cwSpec->write_seq_num);
+
+    return SECSuccess;
+}
+
+/* Unprotect a TLS 1.3 record and leave the result in plaintext.
+ *
+ * Called by ssl3_HandleRecord. Caller must hold the spec read lock.
+ * Therefore, we MUST not call SSL3_SendAlert().
+ *
+ * If SECFailure is returned, we:
+ * 1. Set |*alert| to the alert to be sent.
+ * 2. Call PORT_SetError() witn an appropriate code.
+ */
+SECStatus
+tls13_UnprotectRecord(sslSocket *ss, SSL3Ciphertext *cText, sslBuffer *plaintext,
+                      SSL3AlertDescription *alert)
+{
+    ssl3CipherSpec *crSpec = ss->ssl3.crSpec;
+    const ssl3BulkCipherDef *cipher_def = crSpec->cipher_def;
+    unsigned char aad[8];
+    SECStatus rv;
+
+    *alert = bad_record_mac; /* Default alert for most issues. */
+
+    SSL_TRC(3, ("%d: TLS13[%d]: unprotect record of length %u",
+                SSL_GETPID(), ss->fd, cText->buf->len));
+
+    /* We can perform this test in variable time because the record's total
+     * length and the ciphersuite are both public knowledge. */
+    if (cText->buf->len < cipher_def->tag_size) {
+        PORT_SetError(SSL_ERROR_RX_RECORD_TOO_LONG);
+        return SECFailure;
+    }
+
+    /* Verify that the content type is right, even though we overwrite it. */
+    if (cText->type != content_application_data) {
+        /* Do we need a better error here? */
+        PORT_SetError(SSL_ERROR_BAD_MAC_READ);
+        return SECFailure;
+    }
+
+    /* Check the version number in the record */
+    if (cText->version != kRecordVersion) {
+        /* Do we need a better error here? */
+        PORT_SetError(SSL_ERROR_BAD_MAC_READ);
+        return SECFailure;
+    }
+
+    /* Decrypt */
+    PORT_Assert(cipher_def->type == type_aead);
+    tls13_FormatAdditionalData(aad, sizeof(aad),
+                               IS_DTLS(ss) ? cText->seq_num
+                                           : crSpec->read_seq_num);
+    rv = crSpec->aead(
+        ss->sec.isServer ? &crSpec->client : &crSpec->server,
+        PR_TRUE,                /* do decrypt */
+        plaintext->buf,         /* out */
+        (int *)&plaintext->len, /* outlen */
+        plaintext->space,       /* maxout */
+        cText->buf->buf,        /* in */
+        cText->buf->len,        /* inlen */
+        aad, sizeof(aad));
+    if (rv != SECSuccess) {
+        PORT_SetError(SSL_ERROR_BAD_MAC_READ);
+        return SECFailure;
+    }
+
+    /* The record is right-padded with 0s, followed by the true
+     * content type, so read from the right until we receive a
+     * nonzero byte. */
+    while (plaintext->len > 0 && !(plaintext->buf[plaintext->len - 1])) {
+        --plaintext->len;
+    }
+
+    /* Bogus padding. */
+    if (plaintext->len < 1) {
+        /* It's safe to report this specifically because it happened
+         * after the MAC has been verified. */
+        PORT_SetError(SSL_ERROR_BAD_BLOCK_PADDING);
+        return SECFailure;
+    }
+
+    /* Record the type. */
+    cText->type = plaintext->buf[plaintext->len - 1];
+    --plaintext->len;
+
+    return SECSuccess;
+}