Imports

Types

TrafficSecrets = object clientSecret*: seq[byte] serverSecret*: seq[byte] suite*: Tls13Suite haveClient*: bool haveServer*: bool: TLS 1.3 traffic secrets captured from a keylog. Note: keylog lines carry no suite name — set suite yourself from the negotiated cipher (e.g. OpenSSL's SSL_get_cipher_name) before calling roleKeyMaterial.

proc parseKeylog(text: string): TrafficSecrets {....raises: [ValueError], tags: [], forbids: [].}: Parse a whole keylog file's contents.
proc parseKeylogLine(line: string; secrets: var TrafficSecrets) {. ...raises: [ValueError], tags: [], forbids: [].}: Fold one NSS keylog line into secrets. Recognizes CLIENT_TRAFFIC_SECRET_0 and SERVER_TRAFFIC_SECRET_0 (each <label> <client_random_hex> <secret_hex>); ignores blanks, comments (# ...), and other labels (handshake/early/exporter). Raises ValueError on malformed traffic-secret lines.
proc roleKeyMaterial(secrets: TrafficSecrets; amClient: bool; txRecSeq: array[8, byte] = [0'u8, 0, 0, 0, 0, 0, 0, 0]; rxRecSeq: array[8, byte] = [0'u8, 0, 0, 0, 0, 0, 0, 0]): tuple[ tx, rx: KeyMaterial] {....raises: [ValueError, KtlsError], tags: [], forbids: [].}: Split captured secrets into TX/RX KeyMaterial by endpoint role. Raises ValueError when a required secret is missing.
proc trafficKeyMaterial(secret: openArray[byte]; suite: Tls13Suite; recSeq: array[8, byte] = [0'u8, 0, 0, 0, 0, 0, 0, 0]): KeyMaterial {. ...raises: [ValueError, KtlsError], tags: [], forbids: [].}: Expand a traffic secret into kernel KeyMaterial (tls13.toKeyMaterial).