library/ssl_tls13_keys.c

/*
 *  TLS 1.3 key schedule
 *
 *  Copyright The Mbed TLS Contributors
 *  SPDX-License-Identifier: Apache-2.0
 *
 *  Licensed under the Apache License, Version 2.0 ( the "License" ); you may
 *  not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

#include "common.h"

#if defined(MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL)

#    include "mbedtls/hkdf.h"
#    include "ssl_misc.h"
#    include "ssl_tls13_keys.h"
#    include "mbedtls/debug.h"

#    include <stdint.h>
#    include <string.h>

#    define MBEDTLS_SSL_TLS1_3_LABEL(name, string) .name = string,

struct mbedtls_ssl_tls1_3_labels_struct const mbedtls_ssl_tls1_3_labels = {
    /* This seems to work in C, despite the string literal being one
     * character too long due to the 0-termination. */
    MBEDTLS_SSL_TLS1_3_LABEL_LIST
};

#    undef MBEDTLS_SSL_TLS1_3_LABEL

/*
 * This function creates a HkdfLabel structure used in the TLS 1.3 key schedule.
 *
 * The HkdfLabel is specified in RFC 8446 as follows:
 *
 * struct HkdfLabel {
 *   uint16 length;            // Length of expanded key material
 *   opaque label<7..255>;     // Always prefixed by "tls13 "
 *   opaque context<0..255>;   // Usually a communication transcript hash
 * };
 *
 * Parameters:
 * - desired_length: Length of expanded key material
 *                   Even though the standard allows expansion to up to
 *                   2**16 Bytes, TLS 1.3 never uses expansion to more than
 *                   255 Bytes, so we require `desired_length` to be at most
 *                   255. This allows us to save a few Bytes of code by
 *                   hardcoding the writing of the high bytes.
 * - (label, llen): label + label length, without "tls13 " prefix
 *                  The label length MUST be less than or equal to
 *                  MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN
 *                  It is the caller's responsibility to ensure this.
 *                  All (label, label length) pairs used in TLS 1.3
 *                  can be obtained via MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN().
 * - (ctx, clen): context + context length
 *                The context length MUST be less than or equal to
 *                MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN
 *                It is the caller's responsibility to ensure this.
 * - dst: Target buffer for HkdfLabel structure,
 *        This MUST be a writable buffer of size
 *        at least SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN Bytes.
 * - dlen: Pointer at which to store the actual length of
 *         the HkdfLabel structure on success.
 */

static const char tls1_3_label_prefix[6] = "tls13 ";

#    define SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(label_len, context_len) \
        (2 /* expansion length           */                                \
         + 1 /* label length               */                              \
         + label_len + 1 /* context length             */                  \
         + context_len)

#    define SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN         \
        SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(                \
            sizeof(tls1_3_label_prefix) +                      \
                MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN, \
            MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN)

static void ssl_tls1_3_hkdf_encode_label(size_t desired_length,
                                         const unsigned char *label,
                                         size_t llen,
                                         const unsigned char *ctx,
                                         size_t clen,
                                         unsigned char *dst,
                                         size_t *dlen)
{
    size_t total_label_len = sizeof(tls1_3_label_prefix) + llen;
    size_t total_hkdf_lbl_len =
        SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(total_label_len, clen);

    unsigned char *p = dst;

    /* Add the size of the expanded key material.
     * We're hardcoding the high byte to 0 here assuming that we never use
     * TLS 1.3 HKDF key expansion to more than 255 Bytes. */
#    if MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN > 255
#        error \
            "The implementation of ssl_tls1_3_hkdf_encode_label() is not fit for the \
        value of MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN"
#    endif

    *p++ = 0;
    *p++ = (unsigned char)((desired_length >> 0) & 0xFF);

    /* Add label incl. prefix */
    *p++ = (unsigned char)(total_label_len & 0xFF);
    memcpy(p, tls1_3_label_prefix, sizeof(tls1_3_label_prefix));
    p += sizeof(tls1_3_label_prefix);
    memcpy(p, label, llen);
    p += llen;

    /* Add context value */
    *p++ = (unsigned char)(clen & 0xFF);
    if (clen != 0)
        memcpy(p, ctx, clen);

    /* Return total length to the caller.  */
    *dlen = total_hkdf_lbl_len;
}

int mbedtls_ssl_tls1_3_hkdf_expand_label(mbedtls_md_type_t hash_alg,
                                         const unsigned char *secret,
                                         size_t slen,
                                         const unsigned char *label,
                                         size_t llen,
                                         const unsigned char *ctx,
                                         size_t clen,
                                         unsigned char *buf,
                                         size_t blen)
{
    const mbedtls_md_info_t *md;
    unsigned char hkdf_label[SSL_TLS1_3_KEY_SCHEDULE_MAX_HKDF_LABEL_LEN];
    size_t hkdf_label_len;

    if (llen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_LABEL_LEN) {
        /* Should never happen since this is an internal
         * function, and we know statically which labels
         * are allowed. */
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
    }

    if (clen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_CONTEXT_LEN) {
        /* Should not happen, as above. */
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
    }

    if (blen > MBEDTLS_SSL_TLS1_3_KEY_SCHEDULE_MAX_EXPANSION_LEN) {
        /* Should not happen, as above. */
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
    }

    md = mbedtls_md_info_from_type(hash_alg);
    if (md == NULL)
        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;

    ssl_tls1_3_hkdf_encode_label(blen, label, llen, ctx, clen, hkdf_label,
                                 &hkdf_label_len);

    return (mbedtls_hkdf_expand(md, secret, slen, hkdf_label, hkdf_label_len,
                                buf, blen));
}

/*
 * The traffic keying material is generated from the following inputs:
 *
 *  - One secret value per sender.
 *  - A purpose value indicating the specific value being generated
 *  - The desired lengths of key and IV.
 *
 * The expansion itself is based on HKDF:
 *
 *   [sender]_write_key = HKDF-Expand-Label( Secret, "key", "", key_length )
 *   [sender]_write_iv  = HKDF-Expand-Label( Secret, "iv" , "", iv_length )
 *
 * [sender] denotes the sending side and the Secret value is provided
 * by the function caller. Note that we generate server and client side
 * keys in a single function call.
 */
int mbedtls_ssl_tls1_3_make_traffic_keys(mbedtls_md_type_t hash_alg,
                                         const unsigned char *client_secret,
                                         const unsigned char *server_secret,
                                         size_t slen,
                                         size_t key_len,
                                         size_t iv_len,
                                         mbedtls_ssl_key_set *keys)
{
    int ret = 0;

    ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
        hash_alg, client_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(key),
        NULL, 0, keys->client_write_key, key_len);
    if (ret != 0)
        return ret;

    ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
        hash_alg, server_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(key),
        NULL, 0, keys->server_write_key, key_len);
    if (ret != 0)
        return ret;

    ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
        hash_alg, client_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(iv),
        NULL, 0, keys->client_write_iv, iv_len);
    if (ret != 0)
        return ret;

    ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
        hash_alg, server_secret, slen, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(iv),
        NULL, 0, keys->server_write_iv, iv_len);
    if (ret != 0)
        return ret;

    keys->key_len = key_len;
    keys->iv_len = iv_len;

    return 0;
}

int mbedtls_ssl_tls1_3_derive_secret(mbedtls_md_type_t hash_alg,
                                     const unsigned char *secret,
                                     size_t slen,
                                     const unsigned char *label,
                                     size_t llen,
                                     const unsigned char *ctx,
                                     size_t clen,
                                     int ctx_hashed,
                                     unsigned char *dstbuf,
                                     size_t buflen)
{
    int ret;
    unsigned char hashed_context[MBEDTLS_MD_MAX_SIZE];

    const mbedtls_md_info_t *md;
    md = mbedtls_md_info_from_type(hash_alg);
    if (md == NULL)
        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;

    if (ctx_hashed == MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED) {
        ret = mbedtls_md(md, ctx, clen, hashed_context);
        if (ret != 0)
            return ret;
        clen = mbedtls_md_get_size(md);
    } else {
        if (clen > sizeof(hashed_context)) {
            /* This should never happen since this function is internal
             * and the code sets `ctx_hashed` correctly.
             * Let's double-check nonetheless to not run at the risk
             * of getting a stack overflow. */
            return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
        }

        memcpy(hashed_context, ctx, clen);
    }

    return (mbedtls_ssl_tls1_3_hkdf_expand_label(hash_alg, secret, slen, label,
                                                 llen, hashed_context, clen,
                                                 dstbuf, buflen));
}

int mbedtls_ssl_tls1_3_evolve_secret(mbedtls_md_type_t hash_alg,
                                     const unsigned char *secret_old,
                                     const unsigned char *input,
                                     size_t input_len,
                                     unsigned char *secret_new)
{
    int ret = MBEDTLS_ERR_SSL_INTERNAL_ERROR;
    size_t hlen, ilen;
    unsigned char tmp_secret[MBEDTLS_MD_MAX_SIZE] = { 0 };
    unsigned char tmp_input[MBEDTLS_MD_MAX_SIZE] = { 0 };

    const mbedtls_md_info_t *md;
    md = mbedtls_md_info_from_type(hash_alg);
    if (md == NULL)
        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;

    hlen = mbedtls_md_get_size(md);

    /* For non-initial runs, call Derive-Secret( ., "derived", "")
     * on the old secret. */
    if (secret_old != NULL) {
        ret = mbedtls_ssl_tls1_3_derive_secret(
            hash_alg, secret_old, hlen,
            MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(derived), NULL, 0, /* context */
            MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, tmp_secret, hlen);
        if (ret != 0)
            goto cleanup;
    }

    if (input != NULL) {
        memcpy(tmp_input, input, input_len);
        ilen = input_len;
    } else {
        ilen = hlen;
    }

    /* HKDF-Extract takes a salt and input key material.
     * The salt is the old secret, and the input key material
     * is the input secret (PSK / ECDHE). */
    ret =
        mbedtls_hkdf_extract(md, tmp_secret, hlen, tmp_input, ilen, secret_new);
    if (ret != 0)
        goto cleanup;

    ret = 0;

cleanup:

    mbedtls_platform_zeroize(tmp_secret, sizeof(tmp_secret));
    mbedtls_platform_zeroize(tmp_input, sizeof(tmp_input));
    return ret;
}

int mbedtls_ssl_tls1_3_derive_early_secrets(
    mbedtls_md_type_t md_type,
    unsigned char const *early_secret,
    unsigned char const *transcript,
    size_t transcript_len,
    mbedtls_ssl_tls1_3_early_secrets *derived)
{
    int ret;
    mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
    size_t const md_size = mbedtls_md_get_size(md_info);

    /* We should never call this function with an unknown hash,
     * but add an assertion anyway. */
    if (md_info == 0)
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;

    /*
     *            0
     *            |
     *            v
     *  PSK ->  HKDF-Extract = Early Secret
     *            |
     *            +-----> Derive-Secret(., "c e traffic", ClientHello)
     *            |                     = client_early_traffic_secret
     *            |
     *            +-----> Derive-Secret(., "e exp master", ClientHello)
     *            |                     = early_exporter_master_secret
     *            v
     */

    /* Create client_early_traffic_secret */
    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, early_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(c_e_traffic), transcript,
        transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
        derived->client_early_traffic_secret, md_size);
    if (ret != 0)
        return ret;

    /* Create early exporter */
    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, early_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(e_exp_master), transcript,
        transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
        derived->early_exporter_master_secret, md_size);
    if (ret != 0)
        return ret;

    return 0;
}

int mbedtls_ssl_tls1_3_derive_handshake_secrets(
    mbedtls_md_type_t md_type,
    unsigned char const *handshake_secret,
    unsigned char const *transcript,
    size_t transcript_len,
    mbedtls_ssl_tls1_3_handshake_secrets *derived)
{
    int ret;
    mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
    size_t const md_size = mbedtls_md_get_size(md_info);

    /* We should never call this function with an unknown hash,
     * but add an assertion anyway. */
    if (md_info == 0)
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;

    /*
     *
     * Handshake Secret
     * |
     * +-----> Derive-Secret( ., "c hs traffic",
     * |                     ClientHello...ServerHello )
     * |                     = client_handshake_traffic_secret
     * |
     * +-----> Derive-Secret( ., "s hs traffic",
     * |                     ClientHello...ServerHello )
     * |                     = server_handshake_traffic_secret
     *
     */

    /*
     * Compute client_handshake_traffic_secret with
     * Derive-Secret( ., "c hs traffic", ClientHello...ServerHello )
     */

    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, handshake_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(c_hs_traffic), transcript,
        transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
        derived->client_handshake_traffic_secret, md_size);
    if (ret != 0)
        return ret;

    /*
     * Compute server_handshake_traffic_secret with
     * Derive-Secret( ., "s hs traffic", ClientHello...ServerHello )
     */

    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, handshake_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(s_hs_traffic), transcript,
        transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
        derived->server_handshake_traffic_secret, md_size);
    if (ret != 0)
        return ret;

    return 0;
}

int mbedtls_ssl_tls1_3_derive_application_secrets(
    mbedtls_md_type_t md_type,
    unsigned char const *application_secret,
    unsigned char const *transcript,
    size_t transcript_len,
    mbedtls_ssl_tls1_3_application_secrets *derived)
{
    int ret;
    mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
    size_t const md_size = mbedtls_md_get_size(md_info);

    /* We should never call this function with an unknown hash,
     * but add an assertion anyway. */
    if (md_info == 0)
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;

    /* Generate {client,server}_application_traffic_secret_0
     *
     * Master Secret
     * |
     * +-----> Derive-Secret( ., "c ap traffic",
     * |                      ClientHello...server Finished )
     * |                      = client_application_traffic_secret_0
     * |
     * +-----> Derive-Secret( ., "s ap traffic",
     * |                      ClientHello...Server Finished )
     * |                      = server_application_traffic_secret_0
     * |
     * +-----> Derive-Secret( ., "exp master",
     * |                      ClientHello...server Finished)
     * |                      = exporter_master_secret
     *
     */

    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, application_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(c_ap_traffic), transcript,
        transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
        derived->client_application_traffic_secret_N, md_size);
    if (ret != 0)
        return ret;

    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, application_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(s_ap_traffic), transcript,
        transcript_len, MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED,
        derived->server_application_traffic_secret_N, md_size);
    if (ret != 0)
        return ret;

    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, application_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(exp_master), transcript, transcript_len,
        MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->exporter_master_secret,
        md_size);
    if (ret != 0)
        return ret;

    return 0;
}

/* Generate resumption_master_secret for use with the ticket exchange.
 *
 * This is not integrated with mbedtls_ssl_tls1_3_derive_application_secrets()
 * because it uses the transcript hash up to and including ClientFinished. */
int mbedtls_ssl_tls1_3_derive_resumption_master_secret(
    mbedtls_md_type_t md_type,
    unsigned char const *application_secret,
    unsigned char const *transcript,
    size_t transcript_len,
    mbedtls_ssl_tls1_3_application_secrets *derived)
{
    int ret;
    mbedtls_md_info_t const *const md_info = mbedtls_md_info_from_type(md_type);
    size_t const md_size = mbedtls_md_get_size(md_info);

    /* We should never call this function with an unknown hash,
     * but add an assertion anyway. */
    if (md_info == 0)
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;

    ret = mbedtls_ssl_tls1_3_derive_secret(
        md_type, application_secret, md_size,
        MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(res_master), transcript, transcript_len,
        MBEDTLS_SSL_TLS1_3_CONTEXT_HASHED, derived->resumption_master_secret,
        md_size);

    if (ret != 0)
        return ret;

    return 0;
}

static int ssl_tls1_3_calc_finished_core(mbedtls_md_type_t md_type,
                                         unsigned char const *base_key,
                                         unsigned char const *transcript,
                                         unsigned char *dst)
{
    const mbedtls_md_info_t *const md_info = mbedtls_md_info_from_type(md_type);
    size_t const md_size = mbedtls_md_get_size(md_info);
    unsigned char finished_key[MBEDTLS_MD_MAX_SIZE];
    int ret;

    /* We should never call this function with an unknown hash,
     * but add an assertion anyway. */
    if (md_info == 0)
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;

    /* TLS 1.3 Finished message
     *
     * struct {
     *     opaque verify_data[Hash.length];
     * } Finished;
     *
     * verify_data =
     *     HMAC( finished_key,
     *            Hash( Handshake Context +
     *                  Certificate*      +
     *                  CertificateVerify* )
     *    )
     *
     * finished_key =
     *    HKDF-Expand-Label( BaseKey, "finished", "", Hash.length )
     */

    ret = mbedtls_ssl_tls1_3_hkdf_expand_label(
        md_type, base_key, md_size, MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(finished),
        NULL, 0, finished_key, md_size);
    if (ret != 0)
        goto exit;

    ret = mbedtls_md_hmac(md_info, finished_key, md_size, transcript, md_size,
                          dst);
    if (ret != 0)
        goto exit;

exit:

    mbedtls_platform_zeroize(finished_key, sizeof(finished_key));
    return ret;
}

int mbedtls_ssl_tls1_3_create_psk_binder(mbedtls_ssl_context *ssl,
                                         const mbedtls_md_type_t md_type,
                                         unsigned char const *psk,
                                         size_t psk_len,
                                         int psk_type,
                                         unsigned char const *transcript,
                                         unsigned char *result)
{
    int ret = 0;
    unsigned char binder_key[MBEDTLS_MD_MAX_SIZE];
    unsigned char early_secret[MBEDTLS_MD_MAX_SIZE];
    mbedtls_md_info_t const *md_info = mbedtls_md_info_from_type(md_type);
    size_t const md_size = mbedtls_md_get_size(md_info);

#    if !defined(MBEDTLS_DEBUG_C)
    ssl = NULL; /* make sure we don't use it except for debug */
    ((void)ssl);
#    endif

    /* We should never call this function with an unknown hash,
     * but add an assertion anyway. */
    if (md_info == 0)
        return MBEDTLS_ERR_SSL_INTERNAL_ERROR;

    /*
     *            0
     *            |
     *            v
     *  PSK ->  HKDF-Extract = Early Secret
     *            |
     *            +-----> Derive-Secret(., "ext binder" | "res binder", "")
     *            |                     = binder_key
     *            v
     */

    ret = mbedtls_ssl_tls1_3_evolve_secret(md_type, NULL, /* Old secret */
                                           psk, psk_len, /* Input      */
                                           early_secret);
    if (ret != 0) {
        MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls1_3_evolve_secret", ret);
        goto exit;
    }

    if (psk_type == MBEDTLS_SSL_TLS1_3_PSK_RESUMPTION) {
        ret = mbedtls_ssl_tls1_3_derive_secret(
            md_type, early_secret, md_size,
            MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(res_binder), NULL, 0,
            MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, binder_key, md_size);
        MBEDTLS_SSL_DEBUG_MSG(4, ("Derive Early Secret with 'res binder'"));
    } else {
        ret = mbedtls_ssl_tls1_3_derive_secret(
            md_type, early_secret, md_size,
            MBEDTLS_SSL_TLS1_3_LBL_WITH_LEN(ext_binder), NULL, 0,
            MBEDTLS_SSL_TLS1_3_CONTEXT_UNHASHED, binder_key, md_size);
        MBEDTLS_SSL_DEBUG_MSG(4, ("Derive Early Secret with 'ext binder'"));
    }

    if (ret != 0) {
        MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_tls1_3_derive_secret", ret);
        goto exit;
    }

    /*
     * The binding_value is computed in the same way as the Finished message
     * but with the BaseKey being the binder_key.
     */

    ret =
        ssl_tls1_3_calc_finished_core(md_type, binder_key, transcript, result);
    if (ret != 0)
        goto exit;

    MBEDTLS_SSL_DEBUG_BUF(3, "psk binder", result, md_size);

exit:

    mbedtls_platform_zeroize(early_secret, sizeof(early_secret));
    mbedtls_platform_zeroize(binder_key, sizeof(binder_key));
    return ret;
}

#endif /* MBEDTLS_SSL_PROTO_TLS1_3_EXPERIMENTAL */